Provider cuts smart meter vulnerabilities in half

Powered by SC Magazine
 

Avoids patch cost blow-outs.

US-based utility Itron has reduced the number of security vulnerabilities in its products, including smart metres, by 50 percent by deploying an in-house build of Microsoft’s Security Development Lifecycle (SDL).

The company introduced Microsoft’s SDL – designed to increase software security assurance – in 2008 to monitor for potential security threats during the early design build phases of its utility products, and slash security remediation costs.

Lead security engineer Ido Dubrawsky said the strategy cut the number of vulnerabilities by a least half between 2008 and 2010.

“Utilities are conservative and are very concerned about vulnerabilities because they don’t just affect one device, but up to two million,” Dubrawsky said.

“It’s very expensive for a bug fix to be rolled out then; not just monetary, but there’s a hit to reputation.”

He said vulnerabilities were particularly expensive to fix and cost up to 75 percent more when made at the end of a product lifecycle.

The cost of fixes was exacerbated because the devices were expected to last for more than 20 years, Dubrawsky said.

"You can eliminate a vulnerability as much as possible, but even if you nailed everything you can think of, someone will think of some new attack," he said.

"You need to make sure whatever they do will have limited impact so [smart metres] don't roll over so easily."

Vulnerabilities, previously only labelled as ‘bugs’, were flagged by security teams and sent to coders for remediation.

Smart metres were considered to exist in “hostile environments” because customers had physical access to the devices. They were outfitted with tamper protection mechanisms and encryption to protect data.

Firmware vulnerability patches were delivered by utility operators over private wireless networks.

Darren Pauli travelled to Redmond as a guest of Microsoft. 

Copyright © SC Magazine, Australia


Provider cuts smart meter vulnerabilities in half
 
 
 
Top Stories
Westpac interim CIO resigns
Group CIO yet to be appointed.
 
Five emerging technologies that will transform financial services
[Blog post] Far out ideas that aren't far off.
 
Earning the right to innovate
Breaking down the barriers to innovation is a long, but rewarding process, says Bank of Queensland Group CIO, Julie Bale.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest articles on BIT Latest Articles from BIT
Pass on carbon tax savings, warns ACCC
Jul 24, 2014
The ACCC is warning businesses that supply "regulated goods" to pass on any cost savings ...
Have customers that won't pay debts?
Jul 10, 2014
The ACCC and ASIC have updated their advice when it comes to collecting debts.
Carpet cleaner faces court over online testimonials
Jul 4, 2014
The ACCC has initiated proceedings against A Whistle (1979) Pty Ltd, the franchisor of Electrodry...
You can now get 15GB of free online storage using Microsoft OneDrive
Jun 25, 2014
Cloud storage has reached both the capacity and price where it's a viable alternative to local ...
Another clever trick you can perform with Xero
Jun 25, 2014
Here is another way to reach out to particular subsets of your customers using Xero.
Latest Comments
Polls
What is delaying adoption of public cloud in your organisation?







   |   View results
Lock-in concerns
  27%
 
Application integration concerns
  3%
 
Security and compliance concerns
  28%
 
Unreliable network infrastructure
  9%
 
Data sovereignty concerns
  23%
 
Lack of stakeholder support
  3%
 
Protecting on-premise IT jobs
  5%
 
Difficulty transitioning CapEx budget into OpEx
  3%
TOTAL VOTES: 911

Vote