Defender Dilemma: Siemens and Microsoft Tackle Antivirus Alert Glitch in Simatic PCS Systems

Hot Take:

Siemens and Microsoft are caught in a wild antivirus tango, where the only thing getting quarantined is their dance skills! While Siemens is trying to control the beat with their Simatic PCS products, Microsoft Defender is busy deleting files like a DJ scratching the wrong record. Plant operators, prepare to be the stars of a cybersecurity thriller—complete with suspense, drama, and, hopefully, no accidental system shutdowns!

Key Points:

• Siemens is collaborating with Microsoft to resolve an issue with Microsoft Defender Antivirus (MDAV) and Simatic PCS products.
• The problem: Defender Antivirus lacks an ‘alert only’ functionality, causing potential disruption.
• Setting the antivirus to ‘ignore’ results in no alerts for detected malware, leaving operators clueless.
• Other settings might lead to the deletion or quarantine of vital files, potentially halting plant operations.
• Plant managers are recommended to conduct risk assessments and cluster configurations to manage the situation.

Defender, Defender, Why Hast Thou Forsaken Me?

Siemens, the industrial giant, has found itself in a bit of a pickle, partnering with Microsoft to fix a bothersome bug in Microsoft Defender Antivirus (MDAV) that tangoed its way into their Simatic PCS products. The glitch? Defender Antivirus is missing an ‘alert only’ feature, which means it’s either blissfully ignorant of malware or a drama queen, deleting files and causing chaos. The perfect recipe for a cybersecurity soap opera!

Alert or Ignore: Choose Your Own Adventure

According to Siemens’ guidebooks on Simatic PCS 7 and PCS Neo process control systems, the antivirus settings should allow operators to choose their threat level adventure. But alas, when set to ‘ignore’, the antivirus becomes a silent ninja—no alerts, no actions, just lurking malware. If you switch it up, Defender turns into a hyperactive bouncer, kicking out files, both innocent and guilty, and potentially shutting down operations faster than you can say “system failure.”

Risk Assessment: The Cybersecurity Crystal Ball

Until Siemens and Microsoft waltz their way to a solution, plant managers are left with the unenviable task of playing cybersecurity clairvoyant. Should they risk the wrath of malware by ignoring it, or gamble with system disruption if the antivirus decides to go on a file-deleting spree? The answer lies in conducting a thorough risk assessment and possibly clustering devices to apply tailor-made configurations. It’s like organizing a group project in school, but with more at stake than just a bad grade.

Clustering: Divide and Conquer

In a move that would make any strategist proud, Siemens suggests clustering affected devices, allowing plant operators to apply different configurations based on their needs. It’s a classic divide-and-conquer strategy, ensuring that not all eggs are in one basket—or, in this case, not all systems are at the mercy of a potentially overzealous antivirus. It’s a bit like a cybersecurity buffet; take what you want, leave what you don’t.

Conclusion: Waiting for the Symphonic Solution

As Siemens and Microsoft conduct their antivirus symphony, the final crescendo remains elusive. Plant managers must navigate the current discord, balancing the risks of malware oblivion against the perils of file quarantine. In the meantime, the ICS Cybersecurity Conference offers a stage for operational and security professionals to harmonize their efforts. Until then, plant operators, keep your eyes on the antivirus and your fingers crossed for a solution that strikes the perfect chord.