3 ms·

getting it working > having it secure then its taken out of the hands of those that want to secure it. If you take two companies one developing a secure and

getting it working > having it secure then its taken out of the hands of those that want to secure it. If you take two companies one developing a secure and working product and the other just developing a working product capitalism will weed out the secure product and pass the insecure one. This is because it is cheaper to create, will get to market more quickly and be easier to configure. As these sorts of attacks are rare and there is no established and straight forward legal framework to economically punish those without security; the company with least security almost always wins. Then when someone does show the security holes the tendency is just to arrest them in order to keep this awful system going. :D I'm not entirely sure how we start to fix this.

FLUX-YOU 9y ago
Pieces like this should hopefully scare other companies into action. After all, it was conducted with permission from the wind farm companies. That they've hired pentesters indicate they are now working towards fixing the problems.
- Quarrelsome 9y ago
  Its governments that need scaring. Industry will never self-regulate.
TeMPOraL 9y ago
> I'm not entirely sure how we start to fix this. This needs to be solved at regulatory level. High computer security standards need to become part of whatever work and product safety rules companies already have to follow. But that doesn't look like is going to happen soon, so as an alternative... Did Maersk recover from that ransomware attack two days ago? I sincerely hope they didn't. We need an economically meaningful clusterfuck to get people to pay attention. Related: I think the only way for security to get taken seriously, by both companies and governments alike, is to have someone do some high-profile, damaging hacks "pro bono". Now I would hope such actors stay away from power systems due to risk of loss of life (don't want to disrupt traffic, or hospitals). But this was yesterday on Morning Paper: https://blog.acolyer.org/2017/06/28/an-experimental-security-analysis-of-an-industrial-robot-controller/ https://blog.acolyer.org/2017/06/28/an-experimental-security... I'd say industrial robots could be a good target. If someone started shutting down the plants of some prominent manufacturers of non-life-critical products, maybe enough people would lose money for someone to start treating it seriously...
- pbhjpbhj 9y ago
  Isn't the problem in part that some people see "we done been hacked in our car making doohickey" (/cletus) and respond "backdoor all the things" thinking that allowing tougher security just let's the crackers hide whilst backdoors let the "feds" catch them. I'm not even sure they're wrong per se. In theory (!!) a benevolent watchful government can promote liberty and protect its citizens (or in my case The Queen's subjects).
  - bllguo 9y ago
    that is definitely a problem. But wouldn't backdoors only allow feds to catch cybercriminals after the act? Better security would prevent disasters in the first place. This seems to me a much better way of thinking about the issue
- itgoon 9y ago
  Not as comprehensive as I'd like, but there are standards and regulations. Part of the problem is that these are relatively "new", as far as power companies go. http://www.nerc.com/pa/Stand/Pages/CIPStandards.aspx http://www.nerc.com/pa/Stand/Pages/CIPStandards.aspx
- ams6110 9y ago
  > Did Maersk recover from that ransomware attack two days ago? Somewhat-to-mostly, yes. http://gcaptain.com/maersk-operational-update-on-cyber-attack/ http://gcaptain.com/maersk-operational-update-on-cyber-attac... Still, it undoubtedly cost them a lot. The question is did it cost them more than the prevention would have? You say of course, they only needed to be up-to-date on patches. But there's a cost to that, and we don't know that they don't insure (or self-insure) against IT disasters (they likely do, given their size and scope).

FLUX-YOU 9y ago

Pieces like this should hopefully scare other companies into action. After all, it was conducted with permission from the wind farm companies. That they've hired pentesters indicate they are now working towards fixing the problems.

Quarrelsome 9y ago
Its governments that need scaring. Industry will never self-regulate.

TeMPOraL 9y ago

> I'm not entirely sure how we start to fix this. This needs to be solved at regulatory level. High computer security standards need to become part of whatever work and product safety rules companies already have to follow. But that doesn't look like is going to happen soon, so as an alternative... Did Maersk recover from that ransomware attack two days ago? I sincerely hope they didn't. We need an economically meaningful clusterfuck to get people to pay attention. Related: I think the only way for security to get taken seriously, by both companies and governments alike, is to have someone do some high-profile, damaging hacks "pro bono". Now I would hope such actors stay away from power systems due to risk of loss of life (don't want to disrupt traffic, or hospitals). But this was yesterday on Morning Paper: https://blog.acolyer.org/2017/06/28/an-experimental-security-analysis-of-an-industrial-robot-controller/ https://blog.acolyer.org/2017/06/28/an-experimental-security... I'd say industrial robots could be a good target. If someone started shutting down the plants of some prominent manufacturers of non-life-critical products, maybe enough people would lose money for someone to start treating it seriously...

pbhjpbhj 9y ago
Isn't the problem in part that some people see "we done been hacked in our car making doohickey" (/cletus) and respond "backdoor all the things" thinking that allowing tougher security just let's the crackers hide whilst backdoors let the "feds" catch them. I'm not even sure they're wrong per se. In theory (!!) a benevolent watchful government can promote liberty and protect its citizens (or in my case The Queen's subjects).
- bllguo 9y ago
  that is definitely a problem. But wouldn't backdoors only allow feds to catch cybercriminals after the act? Better security would prevent disasters in the first place. This seems to me a much better way of thinking about the issue
itgoon 9y ago
Not as comprehensive as I'd like, but there are standards and regulations. Part of the problem is that these are relatively "new", as far as power companies go. http://www.nerc.com/pa/Stand/Pages/CIPStandards.aspx http://www.nerc.com/pa/Stand/Pages/CIPStandards.aspx
ams6110 9y ago
> Did Maersk recover from that ransomware attack two days ago? Somewhat-to-mostly, yes. http://gcaptain.com/maersk-operational-update-on-cyber-attack/ http://gcaptain.com/maersk-operational-update-on-cyber-attac... Still, it undoubtedly cost them a lot. The question is did it cost them more than the prevention would have? You say of course, they only needed to be up-to-date on patches. But there's a cost to that, and we don't know that they don't insure (or self-insure) against IT disasters (they likely do, given their size and scope).