<html>
<head>
<meta http-equiv="content-type" content="text/html;
charset=ISO-8859-1">
</head>
<body bgcolor="#FFFFFF" text="#000000">
FYI, request from Kelly:<br>
<br>
<br>
<br>
-------- Original Message --------
<table class="moz-email-headers-table" border="0" cellpadding="0"
cellspacing="0">
<tbody>
<tr>
<th align="RIGHT" nowrap="nowrap" valign="BASELINE">Subject: </th>
<td>[Ics-security] Problems tracking controls HW and SW</td>
</tr>
<tr>
<th align="RIGHT" nowrap="nowrap" valign="BASELINE">Date: </th>
<td>Wed, 09 May 2012 10:02:54 -0400</td>
</tr>
<tr>
<th align="RIGHT" nowrap="nowrap" valign="BASELINE">From: </th>
<td>Kelly Mahoney <a class="moz-txt-link-rfc2396E" href="mailto:mahoney@jlab.org"><mahoney@jlab.org></a></td>
</tr>
<tr>
<th align="RIGHT" nowrap="nowrap" valign="BASELINE">To: </th>
<td><a class="moz-txt-link-abbreviated" href="mailto:ics-security@jlab.org">ics-security@jlab.org</a></td>
</tr>
</tbody>
</table>
<br>
<br>
<meta http-equiv="content-type" content="text/html;
charset=ISO-8859-1">
<br>
As I get alerts from ICS-CERT, I try to look through the PR system
to see if anyone at JLab purchased the product(s) in question so I
can ensure they are informed. This turns out to be very difficult
for several reasons - <br>
1.) The controls world is notoriously incestuous in that many
companies will rebrand an OEM product and sell it as their own.
I've seen some of the HIMA I/O line sold by no less than five
manufacturers. <br>
2.) Siemens' sales slogan is "If we don't sell it we will buy a
company that does." This is pretty true of the business. When
tracking down a particular EPICS ioc manufacturer, I found the
company and/or product line had been bought and sold four times. <br>
3.) OEM manufacturers will rebrand their own devices to appeal to a
particular market - the example at JLab is the Koyo PLC line from
Asia sold in the US as "Direct Logic."<br>
<br>
Problems on the purchasing side:<br>
4.) Many components and hardware are sold through distributors.
JLab purchasing will go to multiple distributors to get the best
price. A PR search will typically not turn up a particular
manufacturer. A search for a distributor may only give a partial
list and may not include the product of interest.<br>
5.) To make matters worse, Purchasing is required to use a given
percentage of small/disadvantaged businesses. Many times these
businesses are set up to act as middlemen - they get the PO from
JLab, then go to a large distributor, who then orders from the
actual manufacturer.<br>
<br>
Things we can do to help:<br>
<br>
1.) When ordering controls HW/SW, include keywords such as Controls,
PLC, SCADA, HMI, I/O ,... that makes searching easier.<br>
2.) Try to include the manufacturer's name and/or product line in
the descriptive text.<br>
<br>
In the next few months, we would like to develop a database of
controls hardware and software used at the Lab. This will make the
job of matching threats to specific JLab equipment much easier.
If you send me (FOR SECURITY REASONS <b><u>DO NOT REPLY ALL</u></b>)
a list of controls hardware and software you are using I will start
compiling the data. Info should include:<br>
Manufacturer (e.g. Rockwell, GE, ABB, Motorola, Direct Logic,
Siemens, National Instruments, Cisco, ...)<br>
Vendor (Name of vendors on PRs or credit card purchases)<br>
Description (PLC, PC-104, SCADA SW, PLC Programming SW, ...etc.)<br>
Function (PSS, CMTF Controls, CHL Controls, Test Stand, HVAC, Fire,
Building Controls, RF HPA controls,...etc.)<br>
Location(s) - note if multiple units are used, then list the
facility as the location (CEBAF, HALLA/B/C/D, FEL, CMTF,...)<br>
Model/Part Number <br>
Software Platform (Windows XP/7 32/64 bit, Linux, RTEMS, VxWorx,
...)<br>
Software and/or Firmware Revision<br>
Owner name and e-mail<br>
JLab Property tag, if applicable<br>
<br>
<u><b>DO NOT INCLUDE NETWORK IDENTIFIABLE INFORMATION</b></u> such
as IP or MAC address, Computer name, or network name. This will be
collected separately.<br>
<br>
<br>
Kelly Mahoney<br>
<pre class="moz-signature" cols="72">--
</pre>
<br>
<pre class="moz-signature" cols="72">--
Sincerely,
Elliott
================================================================================
Those raised in a morally relative or neutral environment will hold
no truths to be self-evident.
Elliott Wolin
Staff Physicist, Jefferson Lab
12000 Jefferson Ave
Suite 8 MS 12A1
Newport News, VA 23606
757-269-7365
================================================================================
</pre>
</body>
</html>