Provider cuts smart meter vulnerabilities in half

Powered by SC Magazine
 

Avoids patch cost blow-outs.

US-based utility Itron has reduced the number of security vulnerabilities in its products, including smart metres, by 50 percent by deploying an in-house build of Microsoft’s Security Development Lifecycle (SDL).

The company introduced Microsoft’s SDL – designed to increase software security assurance – in 2008 to monitor for potential security threats during the early design build phases of its utility products, and slash security remediation costs.

Lead security engineer Ido Dubrawsky said the strategy cut the number of vulnerabilities by a least half between 2008 and 2010.

“Utilities are conservative and are very concerned about vulnerabilities because they don’t just affect one device, but up to two million,” Dubrawsky said.

“It’s very expensive for a bug fix to be rolled out then; not just monetary, but there’s a hit to reputation.”

He said vulnerabilities were particularly expensive to fix and cost up to 75 percent more when made at the end of a product lifecycle.

The cost of fixes was exacerbated because the devices were expected to last for more than 20 years, Dubrawsky said.

"You can eliminate a vulnerability as much as possible, but even if you nailed everything you can think of, someone will think of some new attack," he said.

"You need to make sure whatever they do will have limited impact so [smart metres] don't roll over so easily."

Vulnerabilities, previously only labelled as ‘bugs’, were flagged by security teams and sent to coders for remediation.

Smart metres were considered to exist in “hostile environments” because customers had physical access to the devices. They were outfitted with tamper protection mechanisms and encryption to protect data.

Firmware vulnerability patches were delivered by utility operators over private wireless networks.

Darren Pauli travelled to Redmond as a guest of Microsoft. 

Copyright © SC Magazine, Australia


Provider cuts smart meter vulnerabilities in half
 
 
 
Top Stories
Windows 10 lands in Australia
Campaign to get business to upgrade kicks off.
 
NSW to build its own myGov
Service NSW digital profiles available by September.
 
Android bug leaves a billion phones open to attack
Hackers only need phone number to target devices.
 
 
Sign up to receive iTnews email bulletins
   FOLLOW US...
Latest articles on BIT Latest Articles from BIT
The 5 Windows 10 privacy issues you should be aware of
Jul 31, 2015
There are a few unsettling details when it comes to Windows 10 privacy
Windows 10 is here! (For some)
Jul 29, 2015
Delivery of the free upgrade versions of Windows 10 began today - have you got yours yet?
Microsoft reveals Microsoft Send, a new enterprise chat app to rival Slack
Jul 27, 2015
Microsoft Send is MSN Messenger for grownups, and you could be using it at work very soon
Developers offered $500,000 grants to find HoloLens uses
Jul 8, 2015
Can augmented-reality end up in business?
Microsoft Tossup: The planning app for unorganised groups of friends
Jul 8, 2015
App allows friends to research venues, vote on plans and chat. And depending on how you run your ...
Latest Comments
Polls
Should law enforcement be able to buy and use exploits?



   |   View results
Yes
  14%
 
No
  51%
 
Only in special circumstances
  17%
 
Yes, but with more transparency
  18%
TOTAL VOTES: 752

Vote