Belden has released new research by its Tofino Security brand showing that patching is often ineffective in providing protection from the various vulnerability disclosures and malware targeting critical infrastructure systems today.
While patching such systems is important as part of an overall Defense in Depth strategy, the difficulties of patching for industrial systems mean that compensating controls such as Tofino Security Profiles are often a better method of providing immediate protection.
Since the discovery of the Stuxnet malware in 2010, industrial infrastructure has become a key target for security researchers, hackers, and government agents. Designed years ago with a focus on reliability and safety, rather than security, Supervisory Control and Data Acquisition (SCADA) and Industrial Control Systems (ICS) products are often easy to exploit. As a result, there has been exponential growth in government security alerts for these systems in the past two years. In addition, they have attracted some of the most sophisticated (Stuxnet, Night Dragon, Flame) and damaging (Shamoon) cyber-attacks on record.
Eric Byres, CTO and vice president of engineering at Tofino Security investigated the effectiveness of patching for protecting control systems from vulnerability exploits and malware.
Key findings included:
- Number of vulnerabilities existing in SCADA/ICS applications is high, with as many as 1,805 yet to be discovered vulnerabilities existing on some control system computers
- Frequency of patching needed to address future SCADA/ICS vulnerabilities in both controllers and computers likely exceeds the tolerance of most SCADA/ICS operators for system shutdowns
- Unlike IT systems, most industrial processes operate 24x7 and demand high uptime, making weekly shutdowns for patching unacceptable
- Even when patches can be installed, they can be problematic with a 1 in 12 chance of the patch affecting the safety or reliability of a control system, and a 60% failure rate in patches fixing the reported vulnerability in control system products
- Patches often require staff with special skills to be present; in many cases, such experts are often not certified for access to safety regulated industrial sites
- Patches are available for less than 50% of publicly disclosed vulnerabilities
- Many critical infrastructure operators are reluctant to patch as it may degrade service and increase downtime
Another compensating control is Tofino Security Profiles, available in Belden’s Tofino Security product line. Tofino Security Profiles are rule and protocol definitions that address newly disclosed vulnerabilities, providing a simple way for automation system vendors to create and securely distribute malware protection.
Operators benefit from a single, easy-to-deploy package of tailored rules that can be installed without impacting operations, enabling critical industrial infrastructure facilities to quickly and effectively defend themselves against new threats.
Eric Byres, whose research highlights the multiple challenges with patching for SCADA and ICS systems, remarks that critical infrastructure operators should pursue a Defense in Depth strategy that includes patching when possible, and use compensating controls for protection when patching is not possible.
The Tofino Security product line is available in Australia through Belden Australia .