Gitex: Kaspersky Plans Security Software For Nuclear Plants

Russian anti-virus software company Kaspersky Lab is developing a secure operating system to run computers inside nuclear power plants and other vital infrastructure and industrial plants, its founder and CEO said on Tuesday.

Eugene Kaspersky, the Russian computer scientist turned multi-millionaire cyber security expert, told reporters at a company news conference in Dubai the system was at the prototype stage, with his Moscow-based company in talks with government institutions about installing the new operating system. He declined to identify any, saying the talks were confidential.

Energy and water plants, factories and transportation systems are typically run with SCADA (supervisory control and data acquisition) systems that are accessible via conventional computer networks, making them vulnerable to hackers, Kaspersky said.

SCADA software is sometimes left unaltered for decades, which means that it does not get updates to protect against security bugs as they are discovered.

“It’s not possible to design SCADA in a secure way, so the most obvious solution is to have a secure envelope which monitors what’s going on within SCADA,” Kaspersky told Reuters after announcing the project.

“Engineers travel with laptops, USBs, so even if the system is disconnected from the internet there is traffic.”

Computer hacking was once seen as the preserve of rogue programmers working alone or in small groups.

These usually targeted company websites and caused little long-term damage, but the rise of so-called “hactivist” collectives as well as suspected state-sponsored cyber attacks has shifted the threat towards government-run institutions energy, transport and telecommunications networks. Many such plants use firewalls designed to protect SCADA systems from being infiltrated by malicious bugs. But Kaspersky said he was developing an entire security-focused operating system to beef up their security further.

Some 30,000 computers at state oil producer Saudi Aramco were infected in August, although there is no evidence that the virus got into its industrial control systems. But the Stuxnet worm virus that penetrated Iran’s nuclear enrichment facility is now freely available on the internet.

“After Stuxnet, the attacks on Aramco and other incidents, governments and enterprises are listening,” Kaspersky said.

Earlier this month U.S. lawmakers said China’s top telecom equipment makers should be shut out of the U.S. market as they posed a potential security threat, but Kaspersky was unconcerned that his new operating system might attract similar concerns.

“This system is quite compact – it’s easy to check it doesn’t have extra functionality, you own it,” he added.