Random thoughts on security

[ferrisoxide]

Hi folks

SCADA security has always worried me. I remember all the fun of trying
to get OPC to work over DCOM - by turning off all the security.
Stuxnet, the general craziness of running production systems on
corporate networks.. if I was still working in process control today
I'd never be getting any sleep.

This article drives home the need to build security into the XPCA
framework:

http://www.wired.com/threatlevel/2011/03/scada-vulnerabilities/

I know we've touched on this by pointing at general web security
protocols. This is probably the way to go - reuse over reinvention -
but it's probably worth keeping security in mind as we go and not
compromise the safety of the design for the sake of convenience.

If we're smart about it we can position XPCA as a "secure" protocol.

Enough said for now. We've still got to build the damn thing :)

Cheers
Tom

[flipback]

Yes, for Internet technologies problem of security is matter which it is resolving since birth web. XPCA as web base technology inhere a good tradition) . Then we integrated MES systems with SCADA systems in big corporation network by OPC protocol, we could not configure DCOM in accordance security rules of company. This problem forces to use extra tools such as DataHub. It is additional cost. And I ask myself: "What for is OPC needed?" . In perspective XPCA is free from these defects.

By the way, one of possible application XPCA is OPC tunneling. It's may help for migration from OPC to XPCA.