Why Control System Cyber-Security Sucks…
summary
CERN control networks, device tests and red-team exercises reveal concrete failures: 53 commercial devices scanned in 2007, about 17% crash on malformed packets and ~15% suffer buffer overflows; an oscilloscope or power supply can be rooted or killed in seconds (root extracted via TFTP core dump, remote DoS over Ethernet), Nessus and Nmap find low-hanging fruit, patching XP->7 costs ~3–10k CHF per unit and maintenance windows are every six weeks; inventory, lifecycle and CI tooling (puppet, git/Jira) are being adopted but an open, cheap certification recipe of basic tests does not yet exist.
AI-written summary · about
chapters (5)
- 0:00Start
- 15:44Why do I have to do due diligence and bear the costs(!) instead of those vendors shipping insecure applications/devices?
- 22:42With an Internet of Things, how prompt and agile must (should?) patching be?
- 25:43The air-gap is a myth and hard to maintain: Robustness & resilience must take over!
- 28:36Why is "security" still separated from functionality, usability, availability, and maintainability?
related talks
26mHacking buildings: Security flaws in embedded building control systems
30mPractical Attack Vectors and Their Ideal Defensive Strategies for ICS & SCADA
44mNight of the living vulnerabilities
20mCalcifying Crisis Readiness
23mSecure Code, Safe Future: Mastering Security in Critical Software Development
41mThe Divine and Felonious Nature of Cyber Security
39mNight of the living vulnerabilities
47mWhy is SCADA Security an Uphill Battle?