Defining Control Security

This post first appeared on the Waterfall Security Solutions Blog July, 2018

“The beginning of wisdom is the definition of terms.” – Socrates (470 – 399 B.C.)
Definitions are important – good ones shape our understanding of concepts while poor ones impair that understanding. Consider the definition:

pen: a tube of ink with a tiny ball bearing at the tip
How useful is that definition? If we give the definition to a non-English-speaker, would it seem like a word worth remembering? Consider a different definition:

Total Meltdown

The Meltdown / Spectre saga continues. Ulf Frisk just posted a description of a vulnerability he has coined “Total Meltdown”. It seems that Microsoft developers introduced an even worse vulnerability while fixing the Meltdown vulnerability in Windows 7 and Windows 2008 Server R2. With this broken Meltdown “fix” installed, any program can read or write any word in any other program’s memory, or the kernel’s memory for that matter, just by reaching out and touching – no special tricks required. The cure is worse than the disease.

Protecting Industrial Control Systems from Spectre and Meltdown

The big news today is the Spectre and Meltdown bugs. These vulnerabilities let attack code such as Javascript steal passwords, encryption keys and session cookies from kernel memory and/or browser windows on nearly all modern computers. The performance hits and code changes needed to fix these bugs are extensive. A LOT of costly testing will be needed in the very short term before fixes for Meltdown and Spectre can safely be applied to our ICS/OT/SCADA networks. The only bright spot in this situation is that as usual, Waterfall customers are taking these developments in stride. Properly-designed ICS security programs make it practically impossible for any attack code to reach vulnerable systems. Outside of this community, Spectre and Meltdown will be a major problem.