RSG Model Works

We encountered a security video camera failure recently. Check your computer, this post really is being written in 2011. They parked me at an empty table with a test network and a sample of the failing device. Not knowing how to connect to it, a small bit of network investigation was in order. NMAP, the universal source of network knowledge, was invoked. Nothing fancy, mind you. “nmap -sT” and “nmap -sU” is all I ever do. Keep it simple, let the NMAP elves guide me through what ports and protocols to exercise.

The camera crashed. The security video camera crashed with “nmap -sU”. Not some ninja-cool xml-encoded command line exploit magic. Just the vanilla set of UDP ports. Locked up the device, had to power cycle it.

Come on, folks, this is 2011. Crashing due to weird network input is certainly a problem we all have to worry about, but the nmap command to kill your device should be longer than the average Starbucks latte order.

Could I have a tall dry no-fat decaf udp port scan, followed by a sysDescr.0 SNMP query and response, please?

Nothing new but a decent summary of the state of cyber-security in the
Energy space. No, it’s not just another replay of the “AMI is Hot this week, SCADA was Hot last week” NERC/CIP rant.

Remember, for every substation with AMI head-end gear, there’s some ill-secured SCADA gear, debatably hiding behind it’s not-really-obscure RS-232 cabling. And next to it, if they have an access control system, will be the network drop for the badge readers for the gate.

All on the same unmanaged switch, of course.

Years ago, at the dawn of the dot-Com age, when crypto was cool and Distinguished Names were already an arcane concept, there was a story, let’s be kind and say it’s an urban legend, about root keys.  In the early days you bought a BBN Safekeeper.  It kept the RSA private key safe.  It had a battery backup on the memory it used to store the keys (remember this would have been 1980’s tech.)

There was this story about how American Express bought a Safekeeper but forgot to change the batteries.  I’m not sure it’s true but it does point out the need for the key operator to follow policy and use the “split the key and save the parts in separate places” features of modern HSM solutions.

More generally, you should buy a UPS.  Or at least make sure someone’s making sure your expectations about continuous clean in-budget power are met.  Buy a UPS, make sure you plug into the “special” power strip in the Colo, confirm the D/R plan is NOT on your task list, or somehow think about it.  At least think about it for a moment.

This is DEFINITELY not the PowerPoint slide you want shared at your next project postmortem meeting where you discuss poor estimates of project risk.

On the other hand, the next postmortem I have to attend is one of those “…and THAT is why I was standing in the data center in front of the Cisco switch, grumbling about change management” meetings and I SO am putting this image in my PowerPoint deck as a warning.  Something about letting those cowboys out in the Gulf play fast and loose with the tech…

What you feel when introduced to someone who served over 500 days in combat in World War II.