Dears,
I am curious if in practice non-repudiation is an important property in SCADA networks.
For example is it a need in case of a system failure to be able to find which employee did a wrong action (thus a message that goes from the SCADA to the PLC)?
I am also interested in the other direction where an employee canot deny he obtained an information from a PLC (thus a message that goes from the PLC to the SCADA).
Is such mechanisms really used in practice and if yes by which mean (it seems to me that industrial protocols such as MODBUS or DNP3 do not allow non-repudiation)?
Thanks in advance,
Maxime
Dear Maxime Puys,
Look the link. May be useful.
http://searchsecurity.techtarget.com/definition/nonrepudiation
http://www.academicjournals.org/article/article1380539127_Kim.pdf
Regards, Shafagat
Dear Maxime,
I suggest you alinks and attached files in topics.
- Non-repudiation and digital signature - InfoSec Resources
resources.infosecinstitute.com/non-repudiation-digital-signatur
-Non-repudiation | Network, Information and Computer Security Lab.
https://www.nics.uma.es/research/non-repudiation
- Staying in Control | IEEE Power & Energy Magazine
magazine.ieee-pes.org › January/February 2012
- Cyber Warfare: Its Implications on National Security
https://books.google.com/books?isbn=9384464473
Best regards
Dear Shafagat,
Thanks a lot for your answer.
It seems to me that the links you provided point out how to acheive non-repudiation in SCADA through assymetric crypto which strengthens my idea that it is currently not implemented in SCADA at all.
Best regards,
Maxime
Dear Mohamed-Mourad,
Thanks a lot for your answer.
Given the attachements you provided, I tend to conclude that non-repudiation is a really low priority for SCADA.
Best regards,
Maxime
I know the operator identity is logged for every action in nuclear power applications, and I have seen examples in other industries.
It is all internal to the HMI (which also manages access control) in the systems I have seen. No need to bother the rest of the system with which operator does what, if the HMI is logging each user action with ID and time stamp.
Dear Olof,
Thanks a lot for your answer, I note that non-repudiation can be important depending on the context.
I agree with you on the work done by the HMI however I do think it adds very few security to the system since the messages actually sent can easily be modified when they are in the network, e.g.: with a malware affecting a router.
Best regards,
Maxime
- Badges
- Science topic
- Similar topics
- Psychology
- Mental Processes
- Learning