I’m sure all of you are aware of the MD5 collision research that was revealed a few weeks ago at 25C3.  Very interesting research to say the least and their paper is definitely worth the read, bonus points for using the cluster of PS3s.

But, everyone else in the world has blogged about the fallout from that.  And there has been some talk about revoking the affected root CA from Internet Explorer/Firefox, but Firefox 2.x doesn’t support that and neither does IE 6, and the certificate has a blank URL for revocation anyways.  While the research was interesting I’m sure thats been discussed enough and I’m a lot more interested in the aftermath.  This is especially true since there have been know collisions with MD5 for quite a while now, this was really just a bunch of really smart guys pointing out what a lot of people forgot that they knew, and how cheaply they could do it.

There was talk about this on the DailyDave mailing list, about how security is about making the hard decisions, and I think it’s worth thinking about this in a control system context.  At what point does a service or interface to control system have to be disabled due to security concerns, or a secure protocol is cracked?  Who controls the services/interfaces between your SCADA network and your corporate network (and the hopefully non existant interface between SCADA and internet)?  If your Historian has an unpatched vulnerability disclosed is that enough to remove access to it?  Published exploit?  Worm?  Is there ever a case where you would remove access to it?

Making the right decisions in situations like these is critical, but knowing who makes those decisions and more importantly, how those decisions are going to be put into action is just as important and often an afterthought that causes a lot of problems.  Think of it as a fire escape plan for your software, do you have one?