Pwnd (owned) – derived from the word “own” that implies domination or humiliation of a rival.  In hacker jargon, to “pwn” means “to compromise” or “to control,” specifically another ,server, PC, gateway device, or application

Anyway… the thing that got me thinking down this track was an article I came across this week on BlackHat.  The Wonderware DOS vulnerability of recent months has the dubious honor of being nominated for a ‘Pwnie Award’ in the category of ‘Lamest Vendor Response’.  The whole politics of disclosure and vendor response time has been rehashed enough.  What piqued my interest is that SCADA security is once again crossing into the  ‘popular’ security spotlight.  Another example of crossover would be the DNS vulnerability reports hitting mainstream media.  These days, any story on cyber security seems to sell.  Yet is it translating into more secure systems?  I wonder if the fact that a major vulnerability has been revealed in such a key part of the Net’s infrastructure will make a difference. Many companies, particularly in the Industrial Automation world, still seem content with one or two layers of IT security.  “We got a firewall, and a password policy.  We’re good.”

Next week MatrikonOPC is releasing the OPC Security Gateway.  This aggregating server makes full use of the OPC Security specification, and provides authentication between OPC client and server connections.  That means in addition to DCOM security, users can now fully control which OPC clients can browse, read and/or write on a per tag basis in any OPC server.  A powerful security feature not seen in the vast majority of OPC products on the market today.  The OPC Security Gateway would become the secure front-end and provide this added security even if the OPC Clients do not support the OPC Security specification.

It will be very interesting to see how many companies choose to make use of this increased security layer.  Are mainstream stories like the Wonderware and DNS vulnerabilities enough incentive?  Or will some major refinery or utility need to get good and truly ‘pwned’ first?  Time will tell.

What about your company? Is cyber security and/or OPC security really a concern, or does the PR machine just pay lip service? Are there special considerations for security with your OPC installations? Would a product like the OPC Security Gateway which adds security at the Automation layer be a no-brainer for your IT folk?  If not, just tell them that the really L33T companies are using it. J