A problem family — different problems, same issues

built to be open. now under attack

12 problems across 7 fields

These 12 problems share a paradox. Monitoring technology works, but it is attached to infrastructure designed before cybersecurity existed. Members include building automation systems whose communication protocols have no authentication, water treatment controls with no independent safety limits on chemical dosing, and ship navigation systems that accept unverified position data. Every member that is physically installed is tied to equipment already in place. The underlying system can't be upgraded, so security added afterward fails on the old hardware.

You can add monitoring, threat detection, and encryption. The underlying system was designed before cybersecurity was a concern, and it can't be replaced without shutting everything down.

The 12 problems in this family

the lock is welded shutbuilt without the people who'd live with itmedium

explain the defense, expose the weaknesstested in the wrong worldhigh

millions of parts, no map of the wholeit fell between the cracksmedium

the ventilator has a password problembuilt without the people who'd live with ithigh

also in the rulebook was written for a world that no longer exists

the building runs on protocols with no passwordstested in the wrong worldhigh

smart defenses for dumb controllersbuilt without the people who'd live with ithigh

the water plant runs on outdated softwarebuilt without the people who'd live with itmedium

also in designed for a world that doesn’t exist here

ships trust position data from strangerstested in the wrong worldmedium

verifying the message takes longer than the braking windowthe rules got in the wayhigh

the pipe leaks, nobody shuts it offthe rules got in the wayhigh

also in the rulebook was written for a world that no longer exists, we can see the danger but the system won’t act

the bearing fails between detectorsthe rules got in the wayhigh

also in the rulebook was written for a world that no longer exists, we can see the danger but the system won’t act

the chlorine pump accepts any commandit fell between the crackshigh

Confidence: high = from a primary expert source (Tier 1) · medium = from an analyst, conference, or community source (Tier 2 or 3) · needs sourcing = flagged until we find a better source · the dot's size is its tier; a dashed dot needs sourcing

Loading…