This document discusses and dispels four common myths about process security: Myth One: Even systems claimed to not be connected to the internet have been found to be connected through investigations. Myth Two: Viruses have been found on every system checked, with a 100% detection rate. Myth Three: Viruses have been seen transmitted via infected USB drives, hard drives and laptops, even from "trusted" vendors. Myth Four: 50% of incidents investigated by US ICS-CERT were attacks aimed at control systems, with the average time between attack and discovery being 18 months.

2. FOUR

3. FOUR

4. FOUR
MYTHS

5. MYTH
ONE:

6. MYTH
ONE:

7. INVESTIGATIONS SHOW

8. INVESTIGATIONS SHOW
That even systems which are claimed
to not be connected to the internet…

9. INVESTIGATIONS SHOW
That even systems which are claimed
ARE
to not be connected to the internet…
...

10. MYTH
TWO:

11. MYTH
TWO:

13. WE HAVE
FOUND

14. VIRUSES
WE HAVE
FOUND

15. VIRUSES
WE HAVE
FOUND
at

16. VIRUSES
WE HAVE
FOUND
EVERY
at

17. VIRUSES
WE HAVE
FOUND
EVERY
at
location that we have been checking systems…

18. That’s a

19. That’s a
100%

20. That’s a
100% hit rate!

21. MYTH
THREE:

22. MYTH
THREE:

24. WE HAVE
SEEN

25. VIRUSES
WE HAVE
SEEN

26. VIRUSES
WE HAVE
SEEN
transmitted via infected USB sticks, hard-drives and laptops

27. VIRUSES
WE HAVE
SEEN
transmitted via infected USB sticks, hard-drives and laptops
vendors
even from

28. VIRUSES
WE HAVE
SEEN
transmitted via infected USB sticks, hard-drives and laptops
vendors
even from
that should have been fine

29. MYTH
FOUR:

30. MYTH
FOUR:

32. 50%

33. 50% of the incidents
investigated
by the US ICS-CERT
!

34. 50% of the incidents
investigated
by the US ICS-CERT
!
are found to be attacks specifically aimed at control systems

35. 50% of the incidents
investigated
by the US ICS-CERT
!
are found to be attacks specifically aimed at control systems
With the average
time between
attack and
discovery coming in at

36. 50% of the incidents
investigated
by the US ICS-CERT
!
are found to be attacks specifically aimed at control systems
With the average
time between
attack and
EIGHTEEN
discovery coming in at
MONTHS

37. Still believe these process security myths?

38. It’s up to you to ensure
that your systems are
safe.

39. It’s up to you to ensure
that your systems are
safe.

40. It’s up to you to ensure
that your systems are
safe.
Amor Energy here