I have identified a vulnerability in a device within an industrial control system... Now what? This article provides the guidelines to be followed when a vulnerability within an industrial control system is detected, and the different phases of this process.
Specialized blog with informative contents destined to a public with marked technical profile, in order to improve knowledge and create a culture about the security in Internet.
Post related to: Industrial Control System
Computers used in control systems to perform a particular process usually have high costs due to their specialisation for a very specific task. But is it possible to manage a process with a small-dimension mass-produced generic system? In some cases, yes, and this is being increasingly demonstrated by low-cost hardware available to both industry and individuals.
The problems originating from the application of patches in an industrial setting have consequently led to them being rejected by the operators. For years they were practically abandoned, but thanks to the support from security companies and IT departments they are now receiving their due credit.
Today, we are unable to picture cars without a hands-free system, TVs which are not smart and a bunch of other devices without information processing systems. This can be achieved thanks to embedded systems, the use of which entails security risks.
The constant pressure from operating costs and the halt in investments due to the crisis have made it so industrial systems have had to improve the administration of their assets in order to lower product prices, thus recurring to IT solutions. The result is that industry is changing in the way its processes are managed and operated in order to integrate them in business.
The Simple Network Management Protocol or SNMP, used in most industrial devices, went from an information exchange protocol related to device configuration to an actual configuration control protocol. Manufacturers add far too many functionalities for SNMP in their devices. These functionalities are often unknown by operators so they do not pay much attention to the hardening of this protocol.
The architecture of our industrial control systems is not as static as it was some years ago. The adapting of new standards, or simply trying to improve the security of our industrial networks, creates the need to introduce one or various firewalls within our network. Thinking about having to change a network's architecture, the IP of our devices, tests, etc. when introducing a new firewall often leads to the bad decision to not install it. But, do we know about transparent firewalls and how they can be installed with almost no impact in our network? These solutions have advanced a lot in the industry and may be a true plus to our security.
The evolution of industrial systems towards an almost complete automation entails new challenges in communications. New functionalities acquired by the process, such as the use of digital relays to manage emergency interruptions, are transmitted by the communications network and this cannot fail. Given this need for zero tolerance to any failure, the redundancy offered by the HSR and PRP protocols can be a key factor.