Security expert Eric Byres sets the record straight (see the blog entry for 6/28/2005):
"Actually, it is me who needs to apologize. Honeywell (and you in turn) had me quoted correctly. Honeywell and I had quite a few quotes going back and forth prior to the HUG and I forgot I even said this one. However looking back on my notes I definitely did say to Honeywell, "The C300 and Control Firewall is the most secure control device combination that BCIT has tested to date. It is the only system that we were unable to disable in some manner." Obviously I need to keep track my quotes better .
"But either way, I think you hit the nail on the head. Vendors do need to start testing their systems for their communications security and robustness. I'm sure some already do good testing, but it appears that most of the units we have checked out have seen little security testing before we got to them.
"Even on this I don't fault the vendors - proper security testing is a whole new field and all of us are still finding our way through the mine field. However the world is moving forward in this area and the need for well engineered security test strategies is a reality. It doesn't matter if vendors use the BCIT Achilles tool or another tool - they just need to be clear that they have done the testing and exactly how they did the tests. In the long run my dream is that we can have IEC, IEEE or ISA defined test standards for security, just like we do for every other safety-critical factor. That way customers will be able to compare apples to apples when it comes to the security and reliability of their PLC, DCS or SCADA system components."
