4 ms·

I'm constantly (and serially) amazed at the lack of lessons learned in other fields of security in new areas. It's as if every new area where computers are use

I'm constantly (and serially) amazed at the lack of lessons learned in other fields of security in new areas. It's as if every new area where computers are used erases the minds of the people who make the systems, and then researchers find the issues and expose them; only then will something be done about it - if, indeed, something is done. I'm not a security expert by any stretch of the imagination, but I'm staggered at how easy it seems to be to gain access and control to these kinds of systems, as if them being air gapped (if indeed, they are) is enough to ensure they can't be compromised. I appreciate that no system is truly secure, but the example given here seemed trivially easy in terms of both physical and electronic access. I do wonder if the lack of security is because of budget constraints (i.e. it was proposed by engineers but rejected by management as a needless cost), or if everyone didn't even think that there would be the potential of a breach and the possibility of exploitation?

Quarrelsome 9y ago
getting it working > having it secure then its taken out of the hands of those that want to secure it. If you take two companies one developing a secure and working product and the other just developing a working product capitalism will weed out the secure product and pass the insecure one. This is because it is cheaper to create, will get to market more quickly and be easier to configure. As these sorts of attacks are rare and there is no established and straight forward legal framework to economically punish those without security; the company with least security almost always wins. Then when someone does show the security holes the tendency is just to arrest them in order to keep this awful system going. :D I'm not entirely sure how we start to fix this.
- FLUX-YOU 9y ago
  Pieces like this should hopefully scare other companies into action. After all, it was conducted with permission from the wind farm companies. That they've hired pentesters indicate they are now working towards fixing the problems.
  - Quarrelsome 9y ago
    Its governments that need scaring. Industry will never self-regulate.
- TeMPOraL 9y ago
  > I'm not entirely sure how we start to fix this. This needs to be solved at regulatory level. High computer security standards need to become part of whatever work and product safety rules companies already have to follow. But that doesn't look like is going to happen soon, so as an alternative... Did Maersk recover from that ransomware attack two days ago? I sincerely hope they didn't. We need an economically meaningful clusterfuck to get people to pay attention. Related: I think the only way for security to get taken seriously, by both companies and governments alike, is to have someone do some high-profile, damaging hacks "pro bono". Now I would hope such actors stay away from power systems due to risk of loss of life (don't want to disrupt traffic, or hospitals). But this was yesterday on Morning Paper: https://blog.acolyer.org/2017/06/28/an-experimental-security-analysis-of-an-industrial-robot-controller/ https://blog.acolyer.org/2017/06/28/an-experimental-security... I'd say industrial robots could be a good target. If someone started shutting down the plants of some prominent manufacturers of non-life-critical products, maybe enough people would lose money for someone to start treating it seriously...
  - pbhjpbhj 9y ago
    Isn't the problem in part that some people see "we done been hacked in our car making doohickey" (/cletus) and respond "backdoor all the things" thinking that allowing tougher security just let's the crackers hide whilst backdoors let the "feds" catch them. I'm not even sure they're wrong per se. In theory (!!) a benevolent watchful government can promote liberty and protect its citizens (or in my case The Queen's subjects).
    - bllguo 9y ago
      that is definitely a problem. But wouldn't backdoors only allow feds to catch cybercriminals after the act? Better security would prevent disasters in the first place. This seems to me a much better way of thinking about the issue
  - itgoon 9y ago
    Not as comprehensive as I'd like, but there are standards and regulations. Part of the problem is that these are relatively "new", as far as power companies go. http://www.nerc.com/pa/Stand/Pages/CIPStandards.aspx http://www.nerc.com/pa/Stand/Pages/CIPStandards.aspx
arca_vorago 9y ago
I think I have some insight into this subject, due to some of the wide array of similar industries I've worked in or consulted for (not wind but oil, etc) and you are very close with your question of budget constraints. It is more than budget constraints though. I have primarily determined that budget constraints, while a factor, are a side-effect issue of a more root cause. Namely, a lack of representation for the IT department to the decision makers, whether that be a board of directors, the C-levels, etc. The problem is two-fold. The first problem is the management types are failing to understand that they need that representation to help guard from issues like these. Instead they often see more people as in their way and extra salary costs, and I have seen a disturbing trend the past 10 years or so of straight up gutting IT departments, often replaced by half-assed msp type consultants and highly overworked t1 and t2s. Second, is that the kinds of people that should be filling that role, often don't want to or don't have the business background to do it properly. Over on /r/sysadmin, ask how many senior sysadmins don't even have a CTO or CIO to report to, and instead are reporting straight to a CEO or even to a CFO. Often, when a CTO is hired, they are too far on the MBA side to do the department justice, or they are simply too focused on trying to be a techy often spending too much of their time pretending to be a programmer or something similar. Many of the sysadmins spend an inordinate amount of their time either supporting the business and trying to keep up with industry movement, to the point they often are failing to bridge the business-political gap that exists. They often understand the issue, but fail to put in to upper-management in a way that convinces them, which often leads to resentment or apathy over time, not to mention increased burn-out. I think there is a lot of opportunity to fix these issues though. A good sysadmin who transitioned into an MBA style program and then attempted to take a CTO/CIO role could really shine. In general I feel like the role of CTO/CIO is ripe for a huge turnover of fresh blood able to push more radical changes needed to survive the future. Another potential solution is in IT workers forming some type of actually useful or powerful union. LOPSA just doesn't cut it. We have seen union busting in the past, but the IT workforce is in a huge position of power to get a real union going, and hopefully with mechanisms to protect from the degredation and devolution other union forces have endured. The bottom line is this, in the end, these problems are managements fault, and until management is punished monetarily, legally, or through some other mechanism, they will not change their ways. bonus: you would be surprised at how many IT departments don't even have a budget (IE aren't given the numbers, or not in a proper form, etc. They get told to make proposals and they either get rejected or approved. You can guess which happens more.) second bonus: excess proprietary black boxes and reliance on third-party support breeds contempt for security. Misconfigured or lazily configured crap because everyone is cutting corners.

Quarrelsome 9y ago

getting it working > having it secure then its taken out of the hands of those that want to secure it. If you take two companies one developing a secure and working product and the other just developing a working product capitalism will weed out the secure product and pass the insecure one. This is because it is cheaper to create, will get to market more quickly and be easier to configure. As these sorts of attacks are rare and there is no established and straight forward legal framework to economically punish those without security; the company with least security almost always wins. Then when someone does show the security holes the tendency is just to arrest them in order to keep this awful system going. :D I'm not entirely sure how we start to fix this.

FLUX-YOU 9y ago
Pieces like this should hopefully scare other companies into action. After all, it was conducted with permission from the wind farm companies. That they've hired pentesters indicate they are now working towards fixing the problems.
- Quarrelsome 9y ago
  Its governments that need scaring. Industry will never self-regulate.
TeMPOraL 9y ago
> I'm not entirely sure how we start to fix this. This needs to be solved at regulatory level. High computer security standards need to become part of whatever work and product safety rules companies already have to follow. But that doesn't look like is going to happen soon, so as an alternative... Did Maersk recover from that ransomware attack two days ago? I sincerely hope they didn't. We need an economically meaningful clusterfuck to get people to pay attention. Related: I think the only way for security to get taken seriously, by both companies and governments alike, is to have someone do some high-profile, damaging hacks "pro bono". Now I would hope such actors stay away from power systems due to risk of loss of life (don't want to disrupt traffic, or hospitals). But this was yesterday on Morning Paper: https://blog.acolyer.org/2017/06/28/an-experimental-security-analysis-of-an-industrial-robot-controller/ https://blog.acolyer.org/2017/06/28/an-experimental-security... I'd say industrial robots could be a good target. If someone started shutting down the plants of some prominent manufacturers of non-life-critical products, maybe enough people would lose money for someone to start treating it seriously...
- pbhjpbhj 9y ago
  Isn't the problem in part that some people see "we done been hacked in our car making doohickey" (/cletus) and respond "backdoor all the things" thinking that allowing tougher security just let's the crackers hide whilst backdoors let the "feds" catch them. I'm not even sure they're wrong per se. In theory (!!) a benevolent watchful government can promote liberty and protect its citizens (or in my case The Queen's subjects).
  - bllguo 9y ago
    that is definitely a problem. But wouldn't backdoors only allow feds to catch cybercriminals after the act? Better security would prevent disasters in the first place. This seems to me a much better way of thinking about the issue
- itgoon 9y ago
  Not as comprehensive as I'd like, but there are standards and regulations. Part of the problem is that these are relatively "new", as far as power companies go. http://www.nerc.com/pa/Stand/Pages/CIPStandards.aspx http://www.nerc.com/pa/Stand/Pages/CIPStandards.aspx

arca_vorago 9y ago

I think I have some insight into this subject, due to some of the wide array of similar industries I've worked in or consulted for (not wind but oil, etc) and you are very close with your question of budget constraints. It is more than budget constraints though. I have primarily determined that budget constraints, while a factor, are a side-effect issue of a more root cause. Namely, a lack of representation for the IT department to the decision makers, whether that be a board of directors, the C-levels, etc. The problem is two-fold. The first problem is the management types are failing to understand that they need that representation to help guard from issues like these. Instead they often see more people as in their way and extra salary costs, and I have seen a disturbing trend the past 10 years or so of straight up gutting IT departments, often replaced by half-assed msp type consultants and highly overworked t1 and t2s. Second, is that the kinds of people that should be filling that role, often don't want to or don't have the business background to do it properly. Over on /r/sysadmin, ask how many senior sysadmins don't even have a CTO or CIO to report to, and instead are reporting straight to a CEO or even to a CFO. Often, when a CTO is hired, they are too far on the MBA side to do the department justice, or they are simply too focused on trying to be a techy often spending too much of their time pretending to be a programmer or something similar. Many of the sysadmins spend an inordinate amount of their time either supporting the business and trying to keep up with industry movement, to the point they often are failing to bridge the business-political gap that exists. They often understand the issue, but fail to put in to upper-management in a way that convinces them, which often leads to resentment or apathy over time, not to mention increased burn-out. I think there is a lot of opportunity to fix these issues though. A good sysadmin who transitioned into an MBA style program and then attempted to take a CTO/CIO role could really shine. In general I feel like the role of CTO/CIO is ripe for a huge turnover of fresh blood able to push more radical changes needed to survive the future. Another potential solution is in IT workers forming some type of actually useful or powerful union. LOPSA just doesn't cut it. We have seen union busting in the past, but the IT workforce is in a huge position of power to get a real union going, and hopefully with mechanisms to protect from the degredation and devolution other union forces have endured. The bottom line is this, in the end, these problems are managements fault, and until management is punished monetarily, legally, or through some other mechanism, they will not change their ways. bonus: you would be surprised at how many IT departments don't even have a budget (IE aren't given the numbers, or not in a proper form, etc. They get told to make proposals and they either get rejected or approved. You can guess which happens more.) second bonus: excess proprietary black boxes and reliance on third-party support breeds contempt for security. Misconfigured or lazily configured crap because everyone is cutting corners.