Read on Twitter
A short thread on a recent experience that reminded me of some of the vulnerabilities facing industrial control systems. (ICS)
I'm the lone person in the @thecyberwire offices at @DataTribe these days. Everyone else is working from home, but it's easier for me to come in and work here, with all of the recording studio equipment.
Last week I noticed it was unusually warm in my part of the office, around 80 degrees. I tend to run hot anyway, so this was on the uncomfortable side for me. I sent a note to our office manager, who contacted the landlord.
The building engineer came by, a nice guy who seemed to know his stuff and was genuinely interested in fixing the problem. He had all of the controls for the building HVAC on an app on his phone. Very cool!
Our building is pretty new, and the system was reporting all sorts of info to him.
"This shows the unit on the roof is running, and the interior fans are running, but the temperature sensors show the air coming into your space is running hot. Interesting. I'm going to go get a ladder."
He was gone for a few minutes, and when he came back he reported, "I went up on the roof and the unit was not running. A contractor recently shut off the power to it and neglected to turn it back on. I fixed that, so you should be good to go."
I thanked him, and off he went. And sure enough the office cooled down quickly. But it got me thinking.
His app was telling him the unit on the roof was running. That was not true. (I'm guessing his app was really reporting that the roof unit had been sent a "Run!" signal.)
His app had no way to verify the unit was actually running. No video feed to see fans spinning, no separate sensor to report motors' status. It took a human going on the roof to see what was actually going on.
Anyway, not a big deal, but it reminded me of the kinds of challenges I hear about in my conversations with @RobertMLee
How do you know the information your sensors are sending is accurate? What kind of redundancy is there? And what does it cost to send someone out to put eyes on the problem?
ICS is complicated, and there's much more at stake than a lone podcaster feeling toasty. Still, it was an interesting real-world reminder for me. /end
