Provider cuts smart meter vulnerabilities in half

Powered by SC Magazine
 

Avoids patch cost blow-outs.

US-based utility Itron has reduced the number of security vulnerabilities in its products, including smart metres, by 50 percent by deploying an in-house build of Microsoft’s Security Development Lifecycle (SDL).

The company introduced Microsoft’s SDL – designed to increase software security assurance – in 2008 to monitor for potential security threats during the early design build phases of its utility products, and slash security remediation costs.

Lead security engineer Ido Dubrawsky said the strategy cut the number of vulnerabilities by a least half between 2008 and 2010.

“Utilities are conservative and are very concerned about vulnerabilities because they don’t just affect one device, but up to two million,” Dubrawsky said.

“It’s very expensive for a bug fix to be rolled out then; not just monetary, but there’s a hit to reputation.”

He said vulnerabilities were particularly expensive to fix and cost up to 75 percent more when made at the end of a product lifecycle.

The cost of fixes was exacerbated because the devices were expected to last for more than 20 years, Dubrawsky said.

"You can eliminate a vulnerability as much as possible, but even if you nailed everything you can think of, someone will think of some new attack," he said.

"You need to make sure whatever they do will have limited impact so [smart metres] don't roll over so easily."

Vulnerabilities, previously only labelled as ‘bugs’, were flagged by security teams and sent to coders for remediation.

Smart metres were considered to exist in “hostile environments” because customers had physical access to the devices. They were outfitted with tamper protection mechanisms and encryption to protect data.

Firmware vulnerability patches were delivered by utility operators over private wireless networks.

Darren Pauli travelled to Redmond as a guest of Microsoft. 

Copyright © SC Magazine, Australia


Provider cuts smart meter vulnerabilities in half
 
 
 
Top Stories
ATO shaves $4m off IT contractor panel
Reform cuts admin burden, introduces KPIs.
 
Turnbull introduces data retention legislation
Still no definition of metadata to be stored.
 
Crime Commission prepares core systems overhaul
Will replace 30 year-old national criminal database.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest articles on BIT Latest Articles from BIT
Do you direct debit customers? Read this
Oct 10, 2014
Authorities have been targeting direct debit practices with iiNet and Dodo receiving formal ...
Optus expands 4G coverage
Oct 10, 2014
If you rely on an Optus phone for work you might be interested to know that there are now 200 ...
Microsoft Office is now free for some charities
Oct 10, 2014
Microsoft has announced that eligible Australian non-profit organisations and charities can now ...
Vodafone lights up 4G in Adelaide
Oct 9, 2014
Live and work in Adelaide? Vodafone has switched on its 4G network in the city and suburbs.
Next year tradies will be able to take payments using ingogo
Oct 3, 2014
Ingogo is going to provide a card payment service for Xero users.
Latest Comments
Polls
In which area is your IT shop hiring the most staff?




   |   View results
IT security and risk
  27%
 
Sourcing and strategy
  13%
 
IT infrastructure (servers, storage, networking)
  21%
 
End user computing (desktops, mobiles, apps)
  14%
 
Software development
  25%
TOTAL VOTES: 435

Vote
Would your InfoSec team be prepared to share threat data with the Australian Government?

   |   View results
Yes
  54%
 
No
  46%
TOTAL VOTES: 209

Vote