Re: potential security issues with embedded systems?

[Don Westlight <westligh () OHSU EDU>]

Kyle's question is valid.

Application specific servers and embedded systems are both lumped into
the general category of "appliances".  In both cases, patches are
generally late or non-existent.  Regardless of who manages such a
system, patches are not allowed until validated by the vendor, at which
point the whole internet is already compromised and the vendor lacks
sufficent resources to deal with the problem in under a week.

Meanwhile, your <application you can't live without> is either down or
beating up the rest of your infrastructure.  The degree to which this
matters depends on what else is in your infrastructure...

Unfortunatley, appliances are a fact of life, so we're going to have to
insist that these get better.  In the meantime, if you can avoid the
appliances, you may be able to do a better job yourself.

Are there ways to mitigate the problem: yes.  The applications can be
compiled or augmented in such a way as to render them impervious to
buffer overflow attacks, among other common problems.  The appliance
could run localized firewall software.  Vendor default passwords should
be removed.  We the customers put a second firewall or router access
list in front of the appliance which only permits the specific hosts
within our network and even then only the specific protocols needed.  In
this way, it is less important that the machine get patched in real time
when a new bug is discovered.

Have the customers demanded this: not yet...

New legislation is going to require a whole new level of sophistication
from much of the corporate world: HIPAA, FERPA, GLB, Sarbanes-Oxley, and
another few I can't remember -- all of these regulate Information
Technology management as it applies to specific industries and
practices.  Sanctions can be severe.

Speaking as an engineer for a University Hospital, we're concerned.
Anybody remember the Navy Ship which ran on an embedded NT system that
bluescreened?

-Don Westlight
OHSU.EDU




> > > kbarger () LTSP EDU 12/11/03 11:42AM >>>
The recent story about Diebold teller machines being hit by the Nachi
worm
started me thinking.  In the past few months I've seen demonstrations
of a
PBX system and of a "one card" debitcard/building access system that
were
both based on Windows.

We all know what we've had to deal with in terms of security issues
for
Windows as a server and desktop OS.  What has the track record been
for
embedded systems that use Windows?  Is this enough of a concern to
take
such products out of the running for future consideration?  What about
other operating systems?  If I buy a firewall appliance that's built
on
Linux, should I worry about how fast the vendor will be releasing
firmware
upgrades to handle Linux security issues that crop up?

Any experiences or thoughts are appreciated.
--
Kyle Barger        Manager of Computing & Telecom Services
kbarger () ltsp edu   The Lutheran Theological Seminary at Philadelphia

**********
Participation and subscription information for this EDUCAUSE Discussion
Group discussion list can be found at http://www.educause.edu/cg/.

**********
Participation and subscription information for this EDUCAUSE Discussion Group discussion list can be found at 
http://www.educause.edu/cg/.