Siemens wants to release security advisories on the second Tuesday of every month, similar to Microsoft, Adobe and SAP.
The company carried out a pilot test last month, when it published a total of 16 advisories – including new advisories and updates to previously posted announcements – on November 13. It’s now hoping to get some feedback and comments from customers on the decision to release advisories on Patch Tuesday, which the company has dubbed “Siemens Advisory Day.”
“We constantly improve our service quality and are eager to give you the best options we can to run your Siemens systems as secure as possible. Our approach with vulnerabilities in our products is to communicate them transparently and responsibly,” Martin Ruf of Siemens ProductCERT told customers via email.
“We want to give you the chance to better plan resources and maintenance windows. Therefore, we decided to publish vulnerabilities once a month. We decided to take the second Tuesday as you might already have service windows aligned to that date in place,” Ruf added. “In case we have reasons to publish advisories out of band (e.g. due to criticality), we will still do so.”
Learn More About ICS Vendor Strategies at SecurityWeek’s ICS Cyber Security Conference
Siemens’ advisories typically inform customers of vulnerabilities, but they don’t always announce the availability of patches. The German industrial giant also uses advisories to tell customers that it’s investigating the impact of specific flaws on its products, that mitigations and workarounds are available for a security hole, or that fixes are in the process of being developed.
One out-of-band advisory was published on November 27, when Siemens revealed that some of the Linux and GNU components of a multifunctional platform for its SIMATIC S7-1500 industrial automation controllers are affected by over 20 vulnerabilities.
It’s not uncommon for Siemens products to be exposed to attacks due to vulnerabilities in third-party components. The list includes several variants of the Meltdown and Spectre vulnerabilities, and the Foreshadow/L1TF flaws.
Related: Flaws in Siemens Tool Put ICS Environments at Risk
Related: Flaws Expose Siemens Protection Relays to DoS Attacks
Related: Flaws Expose Siemens Central Plant Clocks to Attacks
Related: Electrical Substations Exposed to Attacks by Flaws in Siemens Devices