Bob Doruma Journal

Saturday, March 28, 2009

SCADA--Where Are The Liabilities?

The regulatory environment is placing increased demands on SCADA systems, driving data capture and retention, documentation, training, security, policy, and reporting requirements.As a result, operators and vendors are taking steps to incorporate the impact of regulatory and legal issues (sometimes referred to collectively as "compliance" issues) into the design and use of the systems.

Legal requirements and trends have placed new emphasis on maintaining compliance, because compliance issues are subject to increasingly aggressive enforcement.Compliance is of great significance in any incident where SCADA systems may be a core component of an investigation, lawsuit, or regulatory enforcement action.Compliance failures have resulted in large fines, jail time, injunctive relief and bad press.

Threats to operators also include the potential for misinterpretation and misuse of data.Knowledge of the data, and the obligation to understand what it means or implies, will be imputed to operators and management.This means responsibility and punishment will reach into the highest levels of management.Operators and management are now facing the potential of charges of negligence being changed to allegations of willful misconduct.In addition, they are confronted with the possibility of criminal liability and increased civil exposure.

Businesses with any form of SCADA-controlled operations must be aware of potential liabilities and take prompt and appropriate actions to minimize them.Personnel with the responsibility and expertise to manage SCADA for and in these businesses are the first line of defense against charges of noncompliance violations and lawsuits.They should be able to recognize the various exposures faced by the company if the SCADA system (or an operation controlled by SCADA) fails operationally, suffers a security breach, or is in violation of compliance issues.

The following scenario illustrates the types of issues that can flow from a failure in an operation, especially a failure where an incident occurs.

If an operation fails in any way that is significant outside of the company, then it usually follows that agencies and other outsiders will become involved."Significant outside of the company" can mean an adverse economic impact on a third party ("the pipeline went down because of a leak, resulting in gasoline supply disruption"), injury or damage to the environment, or injury or death of any person (including an employee).

The outsiders will look at the failure and the company, either because they have the public charter to do so (the FTC at supply disruption, DOT at pipeline safety issues, OSHA at injuries or deaths of employees, law enforcement or injury or death of third parties, the EPA at environmental issues, etc.), or because they see an opportunity to make money (plaintiff lawyers).The outsiders will look at operations with 20/20 hindsight and, depending on the incident, may look deep into records, security, policies and procedures and the decisions of the company.

Although a failure may be SCADA related, the cause of the problem is usually external to the SCADA system.Provided the SCADA system is integrated correctly (incorporating the Holistic model consisting of operations, security, and compliance), it can actually help supply the answer to what caused the problem.

The SCADA records likely will have a critical place in the midst of the scrutiny.The first hurdle facing the company is ensuring that the records can be produced.There are certain requirements in regulatory schemes for records retention (for example, see 49 CFR 195.404 regarding liquid pipelines in the United States).Failure to produce the required records may not only be a violation, but may also raise a presumption that the company destroyed the data because it has something to hide.If a civil lawsuit is filed, rules regarding evidence preservation may come into play, along with issues regarding records that are part of common law requirements as well as regulations like Sarbanes-Oxley in the United States.

Assuming the records and data are available, they will be dissected to find any "problems" in operations.The scope of the investigations will not end there.Regulators and plaintiff lawyers will look at compliance, training given to operator personnel, the manuals and policies underlying training, the age of the system, physical security of the system, the ergonomics of the SCADA control room and system, and many other factors to find fault with the company.Even if the incident resulted from a security breach caused by a criminal act of a third party, the company will be held responsible on the theory that its security, because it was breached, was obviously insufficient.

Vendor exposures are also multi-faceted.During the course of an investigation, vendors will be subject to subpoena and discovery by regulators and plaintiff lawyers seeking information about the activities of the vendor on behalf of an operator.Vendors will need to have maintained their working files in accordance with the requirements of the operator's contract.Although contracts normally require the vendor to provide prompt access to its records and files, such access is predicated on auditing by the operator of the vendor's work, rather than seeking to preserve records that may become important during an investigation or litigation.

In the best of circumstances, vendors can plan on having their business disrupted if their client has a problem.In worse cases, the vendor can plan on being a defendant itself.In this scenario, the vendor may face the choice between accepting some liability or blaming its customer for the failure.The latter action may result in the vendor crippling its business prospects with not only the customer involved, but other operators in the industry.


About the Author

Click on the links provided for more information on scada, scada security and risk management.

Relaited Links:

Labels: , , , , ,

Sunday, November 23, 2008

Do You Know How Does Credit Scoring Works

AB Labs - Software Catalog (All software with 10% discount!)

Credit scoring was an industry mystery for many years as financial institutions kept this information to themselves.However, since the Fair Credit Reporting Act, youre entitled to one free credit report from "Annual Credit Report" each year, which helps demystify the process with credit scores explained.

Now, you can see who reported you for missed or late payments, if your credit score was checked and by whom, and the rest of your financial profile.When all is said and done, there will be a three-digit number that will quickly let lenders know how risky you are as a borrower and will affect your access to lines of credit.

If you are to take away one lesson about improving your credit scores range, its this: late or missed payments are bad, very bad.Payment history accounts for 35 of your credit score and includes everything from mortgage or rent to utilities, cell phone bills, credit cards, store charge cards, medical bills, auto loans, college tuition bills and student loans.If you are 30 days late on one payment, then its not likely to cause severe damage to your report.Its only listed when you are "currently 30 days late" and even then, you can usually negotiate with your lender to cut you some slack since youre normally a good borrower.

If youre often 30 days late, then you may have a hard time convincing anyone to give you a favor.Once youre sixty days late, your credit score will be slightly damaged, but when you hit more than 90 days youll have a tarnished score, which could be something like 100 points deducted for up to 7 years

After 120 days, its likely youll have a charge-off on your record or an account that slips into collections.

Short-term collection accounts will hurt you 50-75 points, although financial advisers at the Gallant Group say that older accounts wont hurt you as much, as these are just "a blip on the radar screen," they said.However, if youre applying for a new loan, then you may occasionally be required to go back and resolve any past due items on your report before being approved.

In credit scoring terms, 30 of your total number is derived from the outstanding debt you have, your credit limits and how much youve borrowed of the total extended to you.If you have an auto loan or a mortgage and you are paying the full amount every month on-time, then this will contribute to good credit scores.

Look at your credit card limits.If you have charged up 40 of the total amount without paying it off right away, then your credit score will drop 10 or 20 points.Anything over 40 will result in exponential drops, which could be as much as 100 points.If you have multiple, maxed-out credit cards, then rest assured you that your score will be off by at least 80 points.

Some people are obsessed with credit inquiries and fear that anyone checking their credit scoring will diminish their good standing.What many people dont know is that its ok to shop around.Say you are looking for auto loans and get quotes from 3 or 4 different places over a period of 14 days: that will only count as one inquirys worth of points and will only cost you 5 or 10 points for the next 30 days.

The reason inquiries cost you any points is that, statistically, people with six inquiries or more on their credit reports are eight times more likely to declare bankruptcy than people with no inquiries.You wont lose any points using credit report services as much as you like, though.Just be conscientious about applying for a bunch of new credit cards all at once.
About the Author

Mike Selvons portal will expand your knowledge on

Relaited Links:

Also see this post on AB Labs - Software Catalog (All software with 10% discount!)

Labels: , , , , ,

Friday, October 10, 2008

What are Executive Compensation Agreements

An Executive Compensation Agreement is an agreement between a company and a probable executive whom the bureau may comparable to to appoint for vocation. These agreements lay out the vocabulary of an executives job, let alone but not confined to necessities covering the executives compensation, including a bonus fix, scope of vocation, curtilage for termination, and severance service handy upon termination. Especially, each time drafting an Executive Compensation Harmony, be definite to carries with it the after requirements:

1. Give vent to Recitals. Be agreed to first include the date of the union, the remark of the firm and the executive and any abbreviations of the names that will be second hand throughout, the zone of the companys administrative center, and all-purpose goal for the unison. This performance can be as effortless as: "Organization and Executive are forming this union for executive to provide firm in addition to services as __________", and plan the heading of the position.

2. Tongue and Conditions. The first few necessities should lay out the language and conditions of the harmony. This should accommodates the banner of the position. It should likewise incorporates the element of the term of occupation, and whether or not the period is renewable by either bash or upon common oblige.

3. Scope of Obligations. The scope of the executives responsibilities and the expectations of the firm should be laid out in detail. In exchange for compensation, what is the executive personality hired to do Will he be required or looked forward to to join agreed monetary goals How a few people will he be coping with These queries should be answered in specific. If revealing these duties gets rid of up several pages, it may be desirable to create an care and point out to it in the concord. If this is the case, the preparations would read: "In commiseration of receiving compensation, executive affirms to goes the thoughts, tasks and quarters outlined in Intimacy A."

4. Compensation and Benefits. The executives compensation and benefits service should still be encompassed in detail. This should contains annual salary, bonus opportunities for realizing guaranteed goals, and stocks and treasury alternatives. His benefits package should be encompassed, catalog his glide time, homeopathic benefits, go back and forth reimbursement, 401k, pension if applicable, disability pay, etc. Yet again, if the drafter prefers, he or she may want to know to attract up this attention on a classify piece of writing, accorded it to the concord, and certainly point out to the fondness.

5. Termination. Usually an executive is subject to termination under sure realities or upon assured occasions. These grounds for termination must be accepted in this provision. There are many scenarios that may be in goes:

a. If the executive is to remain an "at-will" staff, after that management can impede the executives profession at any phase, for any reason. If this is the case, the executive should be able to do the matching.

b. In the selection, the organization may be accepted to fire the executive for any pretext, but must award the executive guaranteed hint, generally in authoring. An executive may be able to good buy for as a great deal of as twelve 12 months written notice. Another time, here the executive may well be required to do the similar.

c. Alternatively, the firm may just be granted to stop the executive for "accepted cause". If so, the season "apposite originator" must be precise. Ordinarily appropriate origin is precise as the disappointment to realize tiny fiscal targets or if the executive commits a bad act hostile the firm, such as theft, or violates his fiduciary mission, confront of loyalty, or face up to of confidentiality.

These are the most hostile supplies that must be treated in an Executive Profession Concord. Requirements covering compensation upon termination, covenants close to inventions and copyrights, help of undisclosed comment, deal not to compete, severability, and governing law should further be included. For spare announcement or to understood real clauses indulge in Executive Post Agreements, please check with the union section of this website.
About the Inventor

Characteristic Warner is an

Relaited Links:

Labels: , , , , ,