Tofino’s response to Windows XP end of life reminds me of Maslow’s Hammer: “I suppose it is tempting, if the only tool you have is a hammer, to treat everything as if it were a nail.” These industrial firewalls have their place, and we have tested and recommended them for clients in certain situations … but to protect against future unpatchable Windows XP OS vulns is a real stretch. (Note: embedded XP is supported until Jan 2016) There is a lot of SCADA Apologist talk in that Tofino article as well.
Version 2 of the NIST SP800-82 Guide to Industrial Control System Security is out for public comment through July 18th. The new 67-page Appendix G overlays the SP800-53 security controls onto a typical ICS.
The bidding for Alstom had another twist this week. Toshiba offered to buy Alstom Grid, makers of the widely deployed e-terra SCADA system, if GE acquires Alstom. Seeing a Schneider Electric vuln notice this week for Wonderware is still jarring. #ICSconsolidation
I had a chance to participate in the Reuters Cybersecurity summit this week. Reuters brought in about ten reporters with different beats to interview people on the topic. Good questions and looking forward to seeing how this affects their reporting short and medium term.