Business computer security just got a lot more serious.
- Cloud-based factory automation? Unsafe now.
- Mandatory remote diagnostics? Unsafe now.
- Remote updates? Questionable, and need to be blockable during crisis periods.
- Cloud-based factory automation? Unsafe now.
- Mandatory remote diagnostics? Unsafe now.
- Remote updates? Questionable, and need to be blockable during crisis periods.
We've been doing B2B business for banks and we eschew any cloud/remote infrastructure as part of our offering because no one would pay for it. Everyone demands on-prem hosting of our software and it has to exclusively flow through their network security appliances.
I had a conversation with more than one CIO who would rather suffer arbitrary DDOS attacks than allow cloudflare the ability to decrypt their application traffic.
I am more than happy to work with these kinds of customers. There is no excuse to compromise on security when the stakes are this high. Everyone is willing to take their time to get it right.
I feel like I must have slept through the point where that was ever a safe option rather than just a compromise for convenience sake.
"Web server interface is supported on UR over HTTP protocol. It allows sensitive information exposure without authentication." (Yes, they actually put a web server in a device which directly controls high voltage relays in power grids.)
"UR IED with “Basic” security variant does not allow the disabling of the “Factory Mode,” which is used for servicing the IED by a “Factory” user."
...
Those particular bugs were supposedly fixed.
[1] https://www.cisa.gov/uscert/ics/advisories/icsa-21-075-02
True story, had to manually fix vehicles (using SSH)
I was also told that most Cloud-based providers have a shared responsibility model when it comes to security, wouldn't that jeopardize some of the existing relationship between the business and the Cloud Platform?
First, companies lie. I've been through a few companies that were audited for security compliance and simple truth was the company made great pains to keep the auditors away from but a few key people who will say what the auditors want to hear. Once, I was even told what I would need to say if I were asked (and it was blatantly untrue). Companies see security as a cost, not as an investment for on-going operations. So, the goal is to check it off the list that you're complying, not actually do it.
Second, best practices actually aren't. For instance, in my company I talked with the head of security after a presentation. I said that having passwords rotated was a horrible practice. It forces users to come up with something memorable. We should be using password managers and start using a long, random, gibberish passwords. He agreed, but "this is (such and such's) standard of best practices we contracted to support so we have to do this."