Much of the field of intrusion detection has developed in an ad hoc fashion due to its reactive nature coupled with the continually evolving problem domain.  As a consequence, work in this area is particularly fraught with difficulties regarding how to pursue research recognized as sound and persuasive.  This talk aims to frame a number of considerations and pitfalls in this regard, drawing upon the speaker's experience on more than 20 security-related program committees, and serving as program chair for the USENIX Security Symposium and two terms as program co-chair for the IEEE Symposium on Security and Privacy.

 

Industrial control systems (aka SCADA) have been neglected from the security viewpoint, but in the current world of pervasive connection their vulnerability and potential threats have to be explored. SCADA are key components of critical systems, such as power, gas and oil, chemical, pharmaceutical, and manufacturing installations. Their failure can caused severe damage, not just to their industrial setting, but to society at large. The access to Internet is not only an unwanted trait, but it is required for maintenance and updating purposes. Therefore it cannot be ignored, and it has to be factored in with all the related security implications. Many lessons can be drawn from typical information systems, but SCADA present some particular features, e.g. they generally cannot be stopped or rebooted as part of an experiment. Specific strategies for their protection and assessment are needed. More specifically, there is an urgent requirement for developing dedicated test-beds, where to try, experiment and resolve security issues. As practitioners of the computer science and information technology field know little of industrial control, and those specialised in the latter have normally less experience in ICT security, there cold be great advantages in establishing a link between these communities.