From: George W. Capehart (gwc@capehassoc.com)
Date: Wed Jul 16 2003 - 18:32:41 EDT
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1
On Tuesday 15 July 2003 04:06 am, Dawes, Rogan (ZA - Johannesburg)
wrote:
> I worked for an electricity utility in a previous life, and one thing
> I can tell you is that the mode of operation is usually:
>
> If it is working, don't touch it!
And in a former life, I designed, built, implemented and managed a
completely integrated manufacturing system that linked cell control
devices and machine control devices to "back office" ERP/inventory
management/shipping/billing systems. We had real-time updates to raw
materials and finished goods inventories, warehouse inventories,
Accounts Receivable and General Ledger. Our mode of operation was
similar. The _/*only time*/_ "the System" was brought down was over
the Christmas/New Year holiday week when the plant was down. (And BTW,
"security" was not sophisticated at all. But then, this was the early
1990s and the only external access was from customers who had dial-up
access to the rudimentary "CRM" system we had.
>
> The amount of effort that goes into commissioning or recommissioning
> a system is large, involving many people, over an extended length of
> time, and is something that the bosses would rather avoid, if at all
> possible.
Absolutely. Only upon pain of death without absolution . . . ;-)
>
> There is also very little support from the vendor, to say that "Hi,
> we know that there is this new version, here are the *supported*
> steps you need to follow to successfully migrate your installation"
It is possible to do some OS/database upgrades unobstrusively without
bringing the system completely down, but major (rev level) upgrades had
to take place during the maintenance shutdown.
>
> What concerns me is the number of process control devices that are
> now offering embedded HTTP servers, connectivity over IP, etc. Given
> the reported vulnerabilities on Bugtraq, etc, w.r.t embedded IP
> stacks in devices like JetDirect cards and the like, I would to know
> how reliable the IP stacks are in those devices.
It's not just the IP stacks (assuming the devices are communicating
using (TCP)/IP. When I was last in the manufacturing universe, the
notion of secure (authenticated and authorized) access to cell control
devices and machine control devices was unknown. Trust was assumed.
If I could get to a machine on the manufacturing floor LAN, I could go
anywhere and do anything.
>
> Also the increasing number of links between IT LANs and Process
> Control networks, for "management info", often provided via an HTTP
> interface!
In the end, however, more damage can be done by modifying data on the IT
LAN than on the Proess Control networks . . . whether it be tweaking
inventory levels, standard routing data or bill of material data . . .
Having said that, the Process Control network could be the ideal assault
base . . .
/g
- --
George W. Capehart
"With sufficient thrust, pigs fly just fine . . ."
-- RFC 1925
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.0.7 (GNU/Linux)
iD8DBQE/FdKSPhMbfSg3fpARAgu4AJ4+WBuGw0wTzuuU0xvzTwAN8xsZbwCgpEUL
yMaB4KQJhyrhP8SD8Kdtm1I=
=4YfC
-----END PGP SIGNATURE-----
---------------------------------------------------------------------------
Your network Firewall and IDS products do not prevent Web application
exploits - the most common form of online attack - resulting in Web
defacement, data theft, sabotage and fraud.
KaVaDo is the first and only company that provides a complete and an
integrated suite of Web application security products, allowing you to
assess your entire environment, automatically set positive security
policies and maintain it without compromising business performance.
For more information on KaVaDo and to download a FREE white paper on Web
applications - security policy automation, please visit:
http://www.kavado.com/ad.htm
----------------------------------------------------------------------------
This archive was generated by hypermail 2.1.7 : Sat Apr 12 2008 - 10:53:36 EDT