Security News > 2011 > May > Experts: Pressure SCADA developers on security as you would software vendors
http://www.csoonline.com/article/682990/experts-pressure-scada-developers-on-security-as-you-would-software-vendors By George V. Hulme CSO May 26, 2011 The discovery of a number of what have been described as serious vulnerabilities within industrial control systems built by manufacturing giant Siemens AG -- and the subsequent nixing of a presentation about those very vulnerabilities -- has raised questions about how the nature of vulnerability disclosure should -- or shouldn't -- change when it comes to the security flaws in industrial systems. As covered earlier this week in our story "A botched fix, not legal demands, nixed SCADA security talk," NSS Labs researchers pulled a presentation after a fix Siemens offered failed to mitigate attack. A day after that story, Dillon Beresford, the NSS Labs researcher who discovered and reported the flaws took aim at Siemens on the SCADASec mailing list for downplaying the seriousness of the vulnerabilities. According to the report "Siemens says it will fix SCADA bugs," the company is downplaying the SCADA flaws. "While NSS Labs has demonstrated a high level of professional integrity by providing Siemens access to its data, these vulnerabilities were discovered while working under special laboratory conditions with unlimited access to protocols and controllers," Siemens said. Beresford countered: "The flaws are not difficult for a typical hacker to exploit. Also there were no special laboratory conditions with unlimited access to the protocols. My personal apartment on the wrong side of town where I can hear gunshots at night hardly defines a special laboratory. I purchased the controllers with money my company so graciously provided me with." In a prior interview with NSS Labs Chief Technology Officer Vikram Phatak, he told CSOonline that the cost of the equipment was roughly $2,500. That's certainly a lower bar to uncover SCADA-related flaws than has been generally discussed. [...] ___________________________________________________________ Tegatai Managed Colocation: Four Provider Blended Tier-1 Bandwidth, Fortinet Universal Threat Management, Natural Disaster Avoidance, Always-On Power Delivery Network, Cisco Switches, SAS 70 Type II Datacenter. Find peace of mind, Defend your Critical Infrastructure. http://www.tegataiphoenix.com/