Friday News and Notes
- Rockwell Automation has issued a statement on the recently announced MicroLogix vuln. It has been more than a year since Daniel demonstrated how rogue code could be loaded into RA’s ControlLogix due to the unauthenticated firmware upload feature in an S4 paper. No fix. No announced planned fix. No response except use layered security and don’t let adversaries get to the field device. I will let the loyal blog reader make their own assessment if “Rockwell Automation takes network security very seriously” as asserted in the statement. In RA’s defense, the competition in the PAC, PLC, RTU, field device space is rarely any better. Apparently improving security is not an effective business case because customers and prospects are not demanding it for field devices.
- The call for papers is open for the ICSJWG [ugh this is still a terrible name] Spring Annual Conference, April 6 – 8 in San Antonio, Texas. Submit your abstract electronically by February 5th.
- For our Japanese readers, JPCERT is having their annual industrial control system conference in Tokyo on February 9th. I was at the event last year along with Marty Edwards from INL and Sean McGurk from DHS. It is one of the few control system security events that happens in Japan, and worth attending if you are looking for a Japanese language control system security learning opportunity. The agenda is here, but it is only in Japanese.
Author: Dale Peterson
Posted: January 22nd, 2010 under Uncategorized.
Comments: 1
Comments
Comment from Ron Southworth
Time: January 24, 2010, 7:46 pm
Hi Dale,
A counter point. I have been – till now – very quietly disappointed in one player in the security provision industry. A company very well know.
One supplier I know of in the last 12 months has made contact with this security company in order to attempt to comply with a specification that was put forward to them in order to win a fully compliant supply contract, simplisticly the requirement intent was to improve the “hardening” of their RTU devices.
Both organisations are well known enterprises in North America.
I won’t divulge any further details on the issue however, the vendor company being actually interested in improving their products conducted some initial dialogue and in order for the vendor to sign up with the security company it was going to take a commitment in the order of multiple millions of dollars.
How does this help the industry in promoting security when this sort of behaviour occurs, despite some conjecture, the margin’s on these products are not that great in the grand scheme of things. These are not high volume products sold by the tens or hundreds of thousands as is the case with consumer products (IT products lumped into this catagory BTW)
When you conisder the amount of R&D that goes into a RTU product there is not that high a return actually. Most wise people would gain a better return by simply leaving their money in the bank.
This is why most vendors when faced with being outed talk about control measures. The problems uncovered are most likely not going to be short term easy things to fix, most RTU security related problems are in the same order of magnitude and there are a lot of mitigation techniques that end users should have in place that would significantly reduce the risks. We all know there are problems with this sort of stuff so how do we move forward when these early steps forward get in teh way of real progress.
Write a comment