All ICS are not created equal — at least not from an impact to the critical infrastructure. There is a tendency to treat every ICS vulnerability or ICS security issue as a dire impact to a nation’s critical infrastructure. Those responsible for securing the critical infrastructure don’t have the bandwidth to address every ICS security issue and probably shouldn’t unless a government believes they are an adjunct to every companies’ security department.

The latest and largest example are the worthy efforts by Project SHINE, Eireann Leverett (see his S4 presentation) and other researchers to highlight the problem that a large number of insecure ICS devices are accessible from the Internet. Project SHINE has found over 500,000 Internet accessible ICS devices in six months, so there is no disputing this is a security issue for a large number of companies and organizations.

The question is what should be done about this? Particularly what should a government organization responsible for homeland security, such as DHS, do about this? Finding who owns these devices is not easy and the numbers would require either staffing up or allocating a significant percentage of ICS-CERT or other DHS resources to this problem.

Almost all of these systems are not what the US Government would label as critical infrastructure ICS (let’s say the top 1000 if such a list exists). This is self evident in that even if all 1000 had Internet accessible connections it would only amount to .2% of the SHINE findings. In our experience, which admittedly is limited based on our size and working with ICS that pay for security consultants, ICS that a consensus would consider critical infrastructure are not Internet accessible. This has been true for about five years now. I’m not arguing that critical infrastructure ICS are adequately secured, but their being Internet accessible is not one of the significant problems. Therefore if DHS is focused on securing ICS that run the critical infrastructure than tracking down the SHINE identified devices would be highly inefficient risk reduction.

DHS or other government organizations can and are doing a good job highlighting this widespread problem and the risk associated with it. These organizations are well suited for this security awareness role because of the respect and attention they garner from the media and business. I’d argue this is efficient risk reduction if Alerts and presentations raise awareness and result in thousands of ICS owner/operators looking for Internet accessible ICS devices.

[Read more…]