Maroochy Water Services Knowledge Management System - Case Study Example

Essay on Maroochy Water Services knowledge management system Name Course Tutor Date Maroochy Water Services knowledge management system Maroochy Shire Council has been in existence for a long time but never before had anybody though that the company had a weak an unsecure control system that could be attacked. This was happened until the year 2000 when Vitek Boden, a man who previously worked an Australian company, Hunter Watertech maliciously attacked their system. Apparently it is this former employee of Boden that set up Supervisory Control and Data Acquisition (SCADA), a radio-controlled sewage gadget for Maroochy Shire Council that refused to hire him after he applied for a job (Abrams & Weiss, 2008). He left his former employer after a strained relationship but with the knowledge of system that was installed at the council. As a bitter man he man he stole radio equipment used to control the system and decide to take the council down by attacking their water services system. According to Abrams & Weiss (2008) Boden’s attack made raw sewage worth 800,000 liters to spill into rivers, local parks, and even into Hyatt Regency hotel grounds. Knowledge management involved in the Maroochy Water Services Cyber Security Attack is crucial to the effectiveness of company competing business setting that need fast innovation. Unfortunately, Maroochy Water Services also lacks the understanding of how it could have developed knowledge management approaches that build successful results. This essay develops a rich and comprehensive analysis of how KM strategies can compel effective Maroochy Water Services outcomes. The essay will examine Knowledge Management strategies in the Maroochy Shire Council domain at various decision making levels of this company. First it should be considered that the KM approaches used by the manager in charge for a system project did not take into consideration the security measures while developing the system. Second, the knowledge audit was not done by the project manager. Bottom line from this occurrence is prevailing hark back of the effect that the systems can bring to a company once compromised. Slay & Miller (2006) state that A SCADA system is a critical component in vital infrastructures. However, whilst highly developed technologies have enhanced the management and operations of these particular systems they are also vulnerable to attacks. Control systems are frequently standard computing hosts having a total network stacks and operating systems rather than proprietary, isolated, systems. This raises the possibility for attacks of the systems and control signals interconnected to it (Carnegie, 2012). Boden’s knowledge of the system weakness enabled him to break in the system with vast impact once his actions and motivation pressed him to commit this offense. Running this system needed that the executive or the manager in charge to have the knowledge on how to manage the system from creating efficiency to putting the security measure in place to protect it from attacks. Having the knowledge of the management reduces error and risks (Debowski, 2006). Having the knowledge on the control system sorts would not only help the managers protect the system but also help the company on data management and information management in the context in which the system is enable individuals to take informed and knowledgeable actions. Supervisory Control and Data Acquisition systems are employed in collecting real-time data, controlling system and monitoring processes in organizational activities and public utilities, as well as chemical factories and refineries, transmission systems, water and sewage treatment (Fernandez & Fernandez, 2005, p.162). Servers that are normally situated at the main site communicate with control devices and sensors which might be within the company or at remote places. Control devices and sensors are positioned wherever equipment requires controlling or monitoring. A Supervisory Control and Data Acquisition network can cover up large geographical places, particularly in the situation of public utilities. Knowing the system ensures that the usual business is carried out that affect the stakeholders involve in the provision of water. Abrams& Weiss (2008) claim that Security Management Act (FISMA), evaluation of attacks from the platform of the regulation offered Special Publication 800-53 controls of the National Institute of Standards and Technology (NIST) Special Publication 800-53 would have moderated these attacks. Particular areas that may have been tackled consist of: Personnel Security, System Services and Acquisition, Awareness and Training, audit, Contingency Planning and Incident Response (Slay & Miller, 2008). Interruption of the water control system generally affects the stakeholders such as the customers, the management, the engineers, the maintenance employees and the society at large. Knowledge management is the activity of would have ensured that organization are well informed in matters to do with storage and security of the system (Becerra-Fernandez & Sabherwal, 2010). Because Boden was in a crucial position by the time he was leaving, the managers would have ensured that controls are in place by changing all passwords in the system to limit his chances of accessing the system. However this was not considered at the time of installation and after attack it was established that provision for personnel security measures was no enforced in the contract. The knowledge management concepts require that during acquisition and installation, the agreement includes provision for system security for support and service. Had the Maroochy Shire Council put the contract in writing with this specific provision, the risk of attack could have been reduced. In addition, control system weakness owing to information security standards that might have been fixed into the system. Engineers too had to look at the level of weaknesses and fix the security measure for future control. While the security measures are still fixed customers who are supported by the system are interrupted in that that they stop getting various services which they rely on, that is water and sewerage services. Maroochy Shire is located in a natural and tourist attracting place with various hotels enhancing the economic status of its location. Sewerage spillages for Maroochy Shire council not only portray the community negatively but draw away from the area because of the nature of environment. Even if the system capability was not conducted rapidly system knowledge audit was necessary to ensure various employees who were going to interact with the system was familiar with it and could work with it efficient and effectively (Bloomberg Businessweek, 2012). Conducting knowledge audit normally demonstrates to the project managers working on the system how the log events function and whether they are susceptible to outside attack over the networks. From the case study the knowledge audit shows that if the audit controls had been put in place, “the potentiality to evaluate the system activity may have offered another prompt to evaluate the state of the system and changes in the general operations as they take place” (Daft & Marcic, 2010). From the case study knowledge audit finds the need to configure Radio communications usually employed in SCADA systems properly to make it secure. Dalkir (2007) says that during this process risk management strategies are created and shared with the management team working on the system. The knowledge the team require is derived from engineering and scientific sources, from professionals and knowledge gathered from engineers and utilities. Since line of protection that was extensively installed was not properly done therefore encryption ought to be conducted as a method of protection for the company data or information. On carrying a fresh protection, it required that all data contained on mobile computers or devices which contain agency data determined to be sensitive be encrypted. Enable just remote access having a two-factor verification in which one factor is offered by the device not in connection to the computer on the access. The intention of this strategy is to create security provided by physical protection controls at the time is accessed from external location or removed and when the information is conveyed outside to a removable or portable media such as personal or digital assistant and laptop computers. The knowledge audit also establishes that training and awareness was not conducted by both Hunter Watertech and Council employees to employees on the threats of cyber attacks on the Supervisory Control and Data Acquisition system. Therefore insufficient knowledge led to a multiple penetration before the engineers could find out the system was not just experiencing a small attacks but actual attacks from outside. The case study shows that knowledge audit was not conducted on Maroochy control and communication components was lacked adequate audit ability to support error determination or forensic evaluation. Lambe (2009) claims that the conducting knowledge audit is concerned with the information on security of the system that would have been established to support other control components such like event response, flaw remediation and access control. Conducting a new a fresh knowledge after fixing the control will go through four stages, that is innovate, reuse, collaborate and study (learn) (Abrams & Weiss, 2008). In doing this the engineers should use knowledge management tools like the knowledge mapping that builds new project snapshots, actionable information and creates learning platform. This creates a partitioned physical structure that facilitates information security and protection. Results of the attack show that there was no plan in place to handle emergency situations or system breakdown. This inadequate planning led to a bigger effect on the environment compared to what it ought to have been had emergency planning been carried out. Lambe (2011, p.181) asserts that Knowledge management concepts require that incident response is within the company plans to help the situation without getting worse. However, in response to this hacking, the moment the event was suspected, Maroochy Shire Council and Hunter Watertech should have secluded the system by putting of far-off access from the system from any recognized interface to reduce the danger of a further attack. Conducting knowledge audit gives results which can then be used to create effective emergency planning, implementation and testing which are important in mitigating the vulnerability of system. DOFA (2004) recommends the analysis of the flow of initial information, and mull over the effect of the knowledge level of the resource team. The management can build on this strategy and articulates the effectiveness of Knowledge transfer as a role of the efforts spent and the knowledge levels of both teams that is the source and recipient (Wilson, 2002). On the basis of analysis of the system and optimal solutions, the engineers should liaise with the manager and acquire significant insights strategy in order to get adequate resources to amend the system in an effective manner. Conditions are offered in which the manager has the authority to optimally pursue a front-loading approach in rectifying the mess the company is experiencing. So as to successfully manage the SCADA system and knowledge and understand what this data requires to be captured, organized, stored and disseminated to sustain decision-making in future, lifecycle of knowledge is needed to be understood (McDonald, 2011). The knowledge needed is for handling and restoring modifying the data that has been manipulated in control system. The major reason for the kind of knowledge needed here is managed by the company is to best execute the action. The model in figure 1 shown below employs a Lambe's knowledge wheel model (methods, system used, skills, experience, intelligence level and relations) indicating the processes of pole inspection carried out on information with the use of knowledge to generate an output (Nickols, 2003). The model commences with using the existing knowledge to identify methods of resolving the attacks on the SCADA system, getting into the database and observe the extent of damage caused by the attacks on information. This is followed by trying to use the skill and knowledge leant to get through the problem. Experience and natural may also be employed should the existing and learnt knowledge fail to work. Finally engineers working the system can form a group in which to consult and share knowledge. Figure 1: Lambe's knowledge wheel model (Lambe, 2011) Creating, utilizing and managing of knowledge lies as the main factor for implementing a new system at Maroochy Shire Water service, therefore, focus should be placed on those three factors to ensure that development process do not fail. Maroochy Shire Council which pursues to protect its information must analyze what they understand and how to use that knowledge in positive ways, and identify what they do not understand and how to seal these gaps. Knowledge management strategies for SCADA system impact the process functionality, Maroochy expenses and the provision of water services to their customer. Hence, in a very competitive and setting with ever changing customer needs including fast changes on the control system, it’s effectively is directly influenced by the Maroochy Shire Council’s knowledge management strategies. Better application of current knowledge and a much logical strategic to learning and improvement across the entire knowledge system is a major opportunity. Enhancing the knowledge foundation and enhancing the system for knowledge management to help learning, decision-making and innovation can be a grand investment for Maroochy Shire Council. References Abrams, M., & Weiss, J. (2008). Malicious Control System Cyber Security Attack Case – Maroochy Water Services, Australia. Retrieved from NIST: http://csrc.nist.gov/groups/SMA/fisma/ics/documents/Maroochy-Water-Services-Case- Study_report.pdf Becerra-Fernandez, I., & Sabherwal, R. (2010). Knowledge Management: Systems and Processes. New York, USA: M.E. Sharpe. Bloomberg Businessweek. (2012). Cyber Crime and Information Warfare: A 30-Year History. Retrieved from Bloomberg Businessweek: http://images.businessweek.com/ss/10/10/1014_cyber_attacks/8.htm Carnegie, M. (2012). The CERT Insider Threat Center. Retrieved from CERT, Carnegie Mellon Software Engineering Institute: http://www.cert.org/insider_threat/ Daft, R. & Marcic, D. (2010). Understanding Management (7th ed.). Mason, USA: Cengage Learning. Dalkir, K. (2007). Knowledge Management in Theory and Practice (3rd ed.). Oxford, UK: Butterworth-Heinemann. Debowski, S 2006, Knowledge management, John Wiley & Sons Australia Ltd, Milton, Qld. Department of Finance & Administration (DOFA). (2004), Knowledge management: a better practice checklist, viewed 27TH May 2011, http://www.finance.gov.au/e-government/better- practice-and-collaboration/better-practice-checklists/knowledge-management.html Lambe, P. (2011). The Unacknowledged Parentage of Knowledge Management. Journal of Knowledge Management, 15(2), 175–197. Lambe, P. (2009). conducting_a_knowledge_audit. Retrieved 3rd July 2013 from http://www.greenchameleon.com/gc/blog_detail/conducting_a_knowledge_audit/ Fernandez, J., & Fernandez, A. (2005). SCADA systems: Vulnerabilities and remediation. Journal of Computing Sciences in Colleges, vol. 20(4), pp. 160– 168. Slay, J., & Miller, M. (2008). Lessons Learned from the Maroochy Water Breach. Retrieved from International Federation for Information Processing on 3rd July 2013 from http://www.ifip.org/wcc2008/site/IFIPSampleChapter.pdf Slay, J. & Miller, M. (2006). A security architecture for SCADA networks. Proceedings of the Seventeenth Australasian Conference on Information Systems. McDonald, C. (2011). The knowledge cycle. Retrieved 3rd July 2013 from http://learnonline.canberra.edu.au/file.php/3108/Knowledge_Cycle.mht Nickols, F. (2003). The knowledge in knowledge management. Retrieved 3rd July 2013 from http://home.att.net/~nickols/articles.htm. Wilson, TD. (2002). The nonsense of ‘knowledge management. Information Research, vol. 8, no. 1, Retrieved 3rd July 2013 from http://informationr.net/ir/8-1/paper144.html Read More