There is an interesting blog post over at ThoghtFest.co.uk
about how vulnerabilities in the ‘internet of things’ may impact cybersecurity
operations. The author, Bob Griffin, the Chief Security Architect at RSA, uses
recent reports about a ‘smart’ refrigerator being used in an DOS attack to take
a brief look at how we are going about security critical infrastructure.
Bob makes the point that while it is sad that the embedded processor
in the refrigerator is vulnerable to attack and subsequent use as a message source
during a DOS attack, it does not really make that refrigerator a cyber threat.
Instead, it would seem that it would be more profitable for a security manager
to focus on how his networked items respond to such an attack. If his network
is properly and adequately protected then a rogue refrigerator is no more of a
threat that a script kiddie with an old computer and slow modem.
The time spent responding to the ever increasing number of
vulnerabilities, and particularly the vulnerabilities being discovered in industrial
controls systems, will detract from the real core security problem here; the
detection and response on assaults on our systems. Regardless how good our
security teams are, something is going to get through the security perimeter
and assault our systems. Attackers only have to get it right one time while the
defense only has to fumble one attack to fail.
Posts
