Re: [Iotops] [arch-d] How old is too old and what this means for product lifecycles? Re: [Last-Call] [TLS] Last Call: <draft-ietf-tls-oldversions-deprecate-09.txt> (Deprecating TLSv1.0 and TLSv1.1) to Best Current Practice

[Christian Huitema <[e-mail]>]

On 12/5/2020 10:10 AM, Randy Bush wrote:

> when you have a plant which can turn out a jillion new thingies with a
> day of set-up, the costs of the infrastructure to securely maintain and
> upgrade them in the field for three, let alone 20, years is astronomical
> in comparison.  now multiply that by a new and different thingie being
> manufactured next month.  now multiply that by a few hundred
> manufacturers.
>
> perhaps the only way to understand in one's gut the scale of this
> problem is to spend a few weeks in shenzhen.


That's indeed the big tension. People set up factories, hospitals and 
many other environments with a focus on their main mission, be it mass 
production of widget or the saving of lives. They don't want to stop 
doing what they are doing just because all the thermostats needs to be 
replaced. At the same time, we have ample evidence not replacing these 
obsolete little thermostats or other devices opens them to catastrophic 
failures, such as the casino that got hacked through an aquarium control 
device, the many hospitals that were hit by ransomware attacks, or the 
uranium enrichment plant that was crippled by a virus. So, what gives?

The Mirai worm attacked routers, which supposedly were acting as 
firewalls for home networks. That uranium enrichment plant was 
supposedly air-gapped. It is pretty clear that solutions based just on 
isolating networks with firewalls do not work in practice. But then, it 
is also clear that the current IAB recommendation of "regular software 
updates" does not work either. People don't do that because they fear 
the update itself will damage their network, or maybe because the device 
is so old that the manufacturer is not producing updates anymore, or for 
what other reason that I have yet to understand.

As Randy says, we are supposed to construct a reliable network from 
unreliable components. We are failing at that. What should we do? Should 
we recommend some form of preventive maintenance, in which devices are 
systematically replaced after some years, much like we currently 
systematically replace batteries or light bulbs before they fail? For 
devices that cannot be replaced, such as maybe MRI machines, should we 
suggest some kind of individual firewall that isolates them from the 
network? I don't know, and my ideas are probably wrong. But we need to 
have that discussion, and we need to have it with the people who 
actually manage plants, hospitals and other environments.

-- Christian Huitema