The Globe&Mail dedicated half a page of the Report on Business section to managing your inbox today. People who work with me know that
The flurry of DNP3-related vulnerabilities reported to ICS-CERT as part of Automatak’s project Robus seems to have subsided a bit, so it may be time to take a look at where we are regarding ICS security, and where we might be going next.
Of course, I’ll only look at communications protocol security in this context: low-tech attacks on the grid1 is outside the scope of this article. In stead, I will take a look at two questions: why the focus on DNP3, and what else could they, and should they, be looking at.
Balloon hack illustration — don’t do this!
There have been a number of well-publicized security flaws in open source software lately — the most well-publicized of course being the OpenSSL Heartbleed bug1.
Then there’s the demise of Truecrypt, recent bugs in GnuTLS and recent bugs in the Linux kernel.
So, is there a systemic problem with Open Source software? Does proprietary software have the same problem?
I don’t usually use this blog to vent frustration, but I’ve been reading standards lately…
There are four versions of the horse:
When you count, that doesn’t add up to four, does it?
That’s what design by committee is all about!
Automatak will be releasing the Aegis fuzzing tool publicly and for free for the first time in a few days. Like I said yesterday:
Can hardly wait: "2 weeks until Aegis™ release" http://t.co/KrQkrbb9a9
— Ronald (@blytkerchan) March 1, 2014
to which Adam replied:
@blytkerchan I just hope the industry is ready!
— Code Monkey Hate Bug (@jadamcrain) March 1, 2014
I don’t think the industry is ready — and here’s why.
In this post, I will take a brief look at how using type lists can help optimize certain applications.
Continue reading
For one of the projects I’m working on, I needed a compile-time version of the KMP algorithm in C++. I started by making the algorithm functional.
In North America, ICS security, as regards the electricity grid, is regulated by NERC, which provides and enforces, among other things, the Critical Infrastructure Protection (CIP) standards.
In this post, I’ll provide a quick overview of those standards, provisions slightly more in-depth information than in my previous post.
In the two previous posts, I’ve shown that industrial control systems — ICSs — are becoming more pervasive, and that they rely on security through obscurity.
Now, let’s make the link with current events.
Developing elegant, high-quality solutions for highly technical problems in C . I like to work on both high level and low-level architectures - contemporaneously if at all possible - designing the overall solutions on large scale as well as the important details. I like working on parallel and distributed systems and systems of systems and finding elegant and efficient ways of developing solutions for real-world problems.
