ICS Patching Ineffective

Thursday, March 14, 2013 @ 05:03 AM gHale

By Gregory Hale
Patching is often ineffective in providing protection from the multitude of vulnerability disclosures and malware targeting critical infrastructure systems today, new research shows.

While patching such systems is important as part of an overall defense in depth strategy, the difficulties of patching for industrial systems mean that compensating controls are often a better method of providing immediate protection, according to research from Tofino Security.

Downtime: Utility Suffers Virus
Antivirus Not Catching New Viruses
Symantec Antivirus Bug
Sophos Fixes Critical Security Hole

Since the discovery of the Stuxnet malware in 2010, industrial infrastructure has become a key target for security researchers, hackers, and government agents. Designed years ago with a focus on reliability and safety, rather than security, Supervisory Control and Data Acquisition (SCADA) and Industrial Control Systems (ICS) are often easy to exploit.

As a result, there has been exponential growth in government security alerts for these systems in the past two years. In addition, they have attracted some of the most sophisticated (Stuxnet, Night Dragon, Flame) and damaging (Shamoon) cyber attacks on record.

The report, conducted by Eric Byres, CTO and vice president of engineering at Tofino Security, found:
• The number of vulnerabilities existing in SCADA/ICS applications is high, with as many as 1,805 vulnerabilities not yet found existing on some control system computers. After analyzing the amount of software on the average control PC in a refinery and then using a metric called Defect Density to calculate the number of expected vulnerabilities, the research showed this one refinery had 1,805 possible vulnerabilities for the average PC.
• The frequency of patching needed to address future SCADA/ICS vulnerabilities in controllers and computers likely exceeds the tolerance of most SCADA/ICS operators for system shutdowns. Unlike IT systems, most industrial processes operate 24×7 and demand high uptime. Weekly shutdowns for patching are unacceptable.
• Even when a user can install patches, they can be a problem. There is a 1 in 12 chance any patch will affect the safety or reliability of a control system, and there is a 60 percent failure rate in patches fixing the reported vulnerability in control system products. In addition, patches often require staff with special skills. In many cases, such experts often do not have proper certification for access to safety regulated industrial sites.
• Patches are available for less than 50 percent of publicly disclosed vulnerabilities.
• Critical infrastructure operators are reluctant to patch as it may degrade service and increase downtime.

When patching is not possible, or while waiting for a semi-annual or annual shutdown to install patches, an alternative is to deploy a workaround, also known as a “compensating control.” Compensating controls do not correct the underlying vulnerability; instead, they help block known attack vectors. Examples of compensating controls include product reconfigurations, applying suggested firewall rules, or installing signatures that recognize and block malware.

Another compensating control is rule and protocol definitions that address newly disclosed vulnerabilities. They provide a way for automation system vendors to create and securely distribute malware protection. Operators benefit from a package of tailored rules they can install without impacting operations. The result is critical industrial infrastructure facilities can quickly and effectively defend themselves against new threats.

“My research highlights the multiple challenges with patching for SCADA and ICS systems,” Byres said. “To secure facilities, critical infrastructure operators should pursue a defense in depth strategy that includes patching when possible, and use compensating controls for protection when patching is not possible.”

Click here for more information on ICS and SCADA patching from Eric Byres.

Leave a Reply

You must be logged in to post a comment.