Two-and-a-half years ago researchers at Chicago-based cyber security firm Infracritical set out to measure how many industrial control systems are openly exposed to the Internet. Their disquieting findings are up for discussion today at the 2014 ICS Cyber Security Conference in Atlanta. Infracritical remotely identified over 2.2 million unique IP addresses linked to industrial control systems at energy-related sites including electrical substations, wind farms, and water purification plants. And they were still logging an average of 2,000-3,000 new addresses per day when they closed the count in January 2014. “We never reached bottom,” says Infracritical cofounder Bob Radvanovsky, an expert in securing supervisory control and data acquisition (SCADA) systems. Continue reading “Internet-Exposed Energy Control Systems Abound”