Use Purchasing Decisions to Demand better ICS Security

Eric Byres made a very good point in his blog article “S4 SCADA Security Symposium Takeaway: Time for a Revolution” about the user community needing to unite and put pressure on automation vendors to improve the security of their products.  I am writing to be, dare I say, more militant about this point.

The IT World Routinely Pressures Vendors for Better Security

I mentioned BugTraq in my last posting.  It is a tool that has worked well for end users of software applications and operating systems.  Newly-discovered vulnerabilities are listed, and so are the defences against them, where possible - even if that means “avoid or disable until patched.”

I also touched upon the protocol of “You’ve got 30 days before we go public with this vulnerability” whereby an IT vendor would receive 30 days advance warning of its public announcement.  This was to give the vendor time to release a patch before the rest of the world knew there was a problem. The protocol came about for the same reasons we’re seeing in the ICS world – vendor inertia.

Some Organizations “Go Legal” rather than Improve Security

Without the threat of the public humiliation, a lot of organisations (not all) would sit on their hands and ignore security vulnerabilities.  Some even tried to suppress announcements by starting actions under the Digital Millennium Copyright Act (DMCA) against the people who notified them of a vulnerability and said that they would go public in due course.

For example, in 2002, an HP vice president warned SnoSoft, a loosely organized research collective, that its members "could be fined up to $500,000 and imprisoned for up to five years" for its role in publishing information on a bug that lets an intruder take over a Tru64 Unix system.

There are many well-documented cases of this, and you can find them with a simple web search.

I am still amazed that any company thinks it’s better to throw lawyers at a problem instead of just fixing it and learning from the experience.  I know the impact it has had on my purchasing decisions – avoid these organisations if at all possible.

Using Security to Guide Purchasing

For example, about ten years ago I recommended spending over $100,000 USD to replace an application from a vendor that simply refused to provide security patches.  The vulnerability in question would have allowed valuable Intellectual Property (IP) data to be stolen from the end user’s company. The Board of Directors agreed that it was worth spending the money to save the IP.  It was then they told me that actually I had been hired because they had already been hit!

It’s time we got more vocal and named and shamed indifferent vendors on a regular basis.  Plus, we should consider how much assistance a vendor will provide in helping us maintain good security and factor this into our purchasing scorecards.

Nowadays the issue of governance matters to us as professionals and to the Board of Directors of the organizations we work for. Boards have a legal and fiduciary duty to the company and to shareholders to know what’s going on and to protect assets and their value. They won’t want the details, but if you can explain a purchasing choice by saying “this vendor enables me to enforce your policies and the losing bidders don’t” then you shouldn’t have many problems.

The bottom line is that nothing causes change better than negative purchasing decisions.  Choose vendors with good security practices and you certainly won’t lose any sleep wondering when the next incident will hit you.

This article is a special guest contribution by:

David Alexander Head of Vulnerability Research, Regency IT Consulting david.alexander@regencyitc.co.uk

Practical SCADA Security thanks David for this article.

Related Content to Download

Note: you need to be a member of tofinosecurity.com and logged in to have access to the document below. Register here to become a member.

Article - "Revealing network threats, fears"   This article by Eric Byres explains how the ANSI/ISA-99 security standards provide a framework for dealing with network security threats.              It is a good article about the fundamentals of Industrial Control System security.

Related Links

• S4 SCADA Security Symposium Takeaway: Time for a Revolution
• Securityfocus.com: BugTraq
• SCADA Security and the Broken Business Model for Software Testing
• Wikipedia: Digital Millennium Copyright Act
• Electronic Frontier Foundation: Coders’ Rights Project
• More SCADA Security Threats: Where There’s Smoke, There’s Fire
• Siemens PLC Security Vulnerabilities – It Just Gets Worse

  Subscribe to the "Practical SCADA Security" news feed