Another consideration that can limit timely updates, according to Byres, are certifications. “For example, a SIL Safety Certification is often required in situations where a PLC is controlling a hazardous process. Obtaining certifications is expensive, so equipment manufacturers often don’t pursue certifications for every firmware version. Asset owners may thus need to skip some patches until the next certified version is available,” he said. This means that the patch cycle for OT devices can be years long for processes where high availability is critical. The costs involved in stopping are significant, so typically these patches are scheduled on an annual or biannual basis as part of a normal maintenance cycle. “Or at least they should be,” he said.
Byres said he was shocked to see, while reviewing the distribution of firmware versions across Microsoft customers’ PLCs, that 60% were running “ancient” firmware versions with eight or more exploitable CVEs (common vulnerabilities and exposures). Even more surprising was that the updates that should have been installed had been available for more than 10 years.
As Byres noted: “There are more patching constraints in OT than in IT. But that excuse eventually expires.” He added that the issue of keeping OT systems up to date is “more of a people problem than a technical problem given the availability of the patches.”
Some of the reasons behind this “people problem” are:
- An “if it ain't broke, don’t fix it” philosophy.
- Lack of awareness.
- Procrastination.
The critical upside to keeping your OT firmware updated is a dramatic reduction in risk to cyberattacks—an increasingly important factor as more industrial companies are targeted by hackers.
Byres said that, based on research aDolus conducted with Microsoft, “we determined that if operators updated their firmware to the latest version, the number of devices free of exploitable CVEs would increase from 4% to 40%. Another way to look at the impact of updating those PLCs to the latest version: Asset owners could reduce the percentage of the devices with more than eight exploitable CVEs down to only 18%. Again, that’s still a lot of vulnerable PLCs on the OT network, but the goal should be improvement rather than perfection.”
For those operations that still find it difficult to update their controllers’ firmware, Byres recommends they “at least look at hardening configuration settings or using compensating controls.” However, Byres still advises performing the regular patch updates, because, “in most cases, deploying and maintaining compensating controls takes far more effort than installing patches.”
