Disclosure Issues - Unintended Consequences

    July 5, 2011
    I was approached by an IT penetration tester early this year wanting to test ICS equipment. This seemed like an ideal test to see if ICS equipment would be too arcane for the IT community to understand. It took less than a day for the IT tester to find many vulnerabilities, some extremely critical, including allowing control of the VxWorks device. This would normally have been bad enough.
    I was approached by an IT penetration tester early this year wanting to test ICS equipment. This seemed like an ideal test to see if ICS equipment would be too arcane for the IT community to understand. It took less than a day for the IT tester to find many vulnerabilities, some extremely critical, including allowing control of the VxWorks device. This would normally have been bad enough.
    However, an unintended glitch arose. The unintended consequence of the need to protect intellectual property (computer code) can prevent review of code for security reasons. Review of code also extends to penetration testing. This unforeseen problem can preclude even the asset owners from having vulnerabilities in their own equipment disclosed which is what happened in this case.
    One needs to consider the case of what happens when you download software.  There is generally an agreement that needs to be signed before you can download the software. It may include a statement prohibiting third parties from reviewing the software. This needs to be modified for security purposes.
    There will be discussions on these issues at the September ACS Conference.
    Joe Weiss

    Continue Reading

    Sponsored Recommendations

    Municipalities are utilizing inline total solids measurements to enhance sludge thickening, lower polymer usage and cut operational expenses.
    Carbon dioxide is increasingly recognized as a vital resource with significant economic potential. While the conversion of carbon dioxide into products is still in its infancy...
    Discover our wide range of temperature transmitters that convert sensor signals from RTDs and thermocouples into stable and standardized output signals!
    An innovative amine absorption-based carbon capture process enables retrofitting of existing industrial facilities to reduce emissions in hard-to-abate sectors, with advanced ...

    Latest from Home

    Source: Revere Control Systems and G.A. Fleet Associates
    screenshot_20250812_140944
    Businessman in recruitment concept with horseshoe magnet
    Source: MxD
    Figure 1: Steady streams of students and other visitors take in the digital and cybersecurity demonstrations at Manufacturing times Digital (MxD) institute, which provides participants with programs in digitalized tools, cybersecurity and workforce expertise.

    Most Read

    Sponsored