Patching for Industrial Cybersecurity Is a Broken Model

It's probably not a big surprise, if you stop and think about it, but recent research from Belden Tofino Security confirms that patching is often ineffective in protecting from the multitude of vulnerability disclosures and malware targeting critical infrastructure systems today.

Not patching obviously is not an option, but it's easy to understand why companies, especially with the emergence of Ethernet as a single network within manufacturing plants, are moving to revamp their industrial automation network infrastructures to make them more bulletproof.

Eric Byres, CTO and vice president of engineering at Tofino Security, investigated the effectiveness of patching for protecting control systems from vulnerability exploits and malware. In a recent press release, he summarized the results of this work and revealed that:

In June 2010, the Stuxnet worm triggered a worldwide sensation as the first publicly known root-kit attack targeted at industrial plants. According to Innominate Security Technologies, it infected tens of thousands of PCs, abusing and manipulating Windows-based automation software for its own purposes to ultimately infiltrate malicious code into the controllers of specific real-world industrial installations.

A white paper titled "Post-Stuxnet Industrial Security" from Innominate concludes that after Stuxnet, the threats in automation networks can no longer be ignored. But the real danger is not from Stuxnet itself, but from mutations created by imitators who could circulate other arbitrary, malicious code utilizing the same basic techniques.

Apart from the fact that PCs in industrial use often are not (and cannot be) equipped with antivirus software, Stuxnet has also made it clear that conventional virus scanners do not provide protection against attacks of this caliber. The retrospective analysis of Stuxnet has shown that the worm had been out in the wild unnoticed for at least 12 months before its discovery and had not been detected by antivirus programs during that period for lack of any known signatures for the malware.

Related posts: