Appendix 4.4.7 Details which Capex Information affecting Any information which Information which gives The detailed information provide useful the security of the gives those with malicious potential cybersecurity has been included in the Obsolete SCADA reconnaissance network or mischievous intent attackers details on the business cases so that Equipment: information for details which reveals either electronic equipment in Energex can -Sect 3.1.1 potential cyber computer system, use, its software, demonstrate appropriate, security telecommunications or computer independently verifiable Paragraph 2 attackers. operational technology communications analysis has been -Sect 3.1.1 1 equipment types, operating protocols or the way in applied to the preparation Information such system, software which the devices are of the programs/projects -Sect 3.1.2 2 as Site Id, application, software interconnected is of proposed. manufacturers -Sect 3.2.1 Table 4 middleware or other significant benefit to and model Public release of the -Sect 3.2.2 Table 5, relevant to the planning and executing numbers, specific details however Table 6 and Table 7 cybersecurity exploits a successful cyber communication provides no public benefit which may be successful intrusion. -Sect 3.2.3 Title and protocols and to consumers, and would when used against the Table 8 information on actively work against the system should not be made various software public interest, increasing -Sect 3.2.5 Title public. bugs and other the probability of -Sect 3.3 Table 9 product or successful cyber intrusion. -Sect 4.1 Table 10
Appendix 4.4.7 Obsolete SCADA Equipment: -Sect 3.1.1 Paragraph 2 -Sect 3.1.1 1 -Sect 3.1.2 2 -Sect 3.2.1 Table 4 -Sect 3.2.2 Table 5, Table 6 and Table 7 -Sect 3.2.3 Title and Table 8 -Sect 3.2.5 Title -Sect 3.3 Table 9 -Sect 4.1 Table 10 Details which provide useful reconnaissance information for potential cyber security attackers. Information such as Site Id, manufacturers and model numbers, communication protocols and information on various software bugs and other product or Capex Information affecting the security of the network Any information which gives those with malicious or mischievous intent details which reveals either computer system, telecommunications or operational technology equipment types, operating system, software application, software middleware or other relevant to the cybersecurity exploits which may be successful when used against the system should not be made public. Information which gives potential cybersecurity attackers details on the electronic equipment in use, its software, computer communications protocols or the way in which the devices are interconnected is of significant benefit to planning and executing a successful cyber intrusion. The detailed information has been included in the business cases so that Energex can demonstrate appropriate, independently verifiable analysis has been applied to the preparation of the programs/projects proposed. Public release of the specific details however provides no public benefit to consumers, and would actively work against the public interest, increasing the probability of successful cyber intrusion.
Energex%20-%20Appendix%201.1%20Confidentiality%20template%20-%20July%202015.docx