Self-disclosures by XIoT vendors have surpassed independent research outfits as the second most prolific vulnerability reporters
A major impact of the pandemic has been the acceleration of digital transformation, which has expanded from advanced digitization into increasingly unmanaged automation. This automation is largely controlled by unmanaged cyber/physical devices. It started with the first generation of largely consumer oriented IoT devices but has grown into what some now call Industry 5.0.
The key aspect is no longer simply whether the device has internet connectivity, but whether it performs its functions automatically in an unmanaged fashion. This has become so much wider and more complex than the original concept of IoT or even IIoT. It now includes automatically functioning medical devices, building controls, smart city management, many aspects of OT and industrial control systems, and much more.
Rather than define terms for the different types of ‘IoT’, industrial cybersecurity firm Claroty has settled on an umbrella phrase: the extended internet of things (XIoT). This effectively refers to and includes any unmanaged device, which is inherently more difficult to secure than any managed device (that is, one operated by a human manager). This is the cyber/physical domain, and notably, 70% of vulnerabilities can be targeted remotely over the internet.
Claroty, a firm focused on securing the cyber/physical space, has published its State of XIoT Security report (PDF) covering the first half of 2022, and focusing on vulnerabilities and vulnerability disclosures. The total number of disclosures is relatively flat (747, affecting 86 different vendors), but the report notes a major improvement in vendors’ approach to their own vulnerability discovery and reporting.
“For the first time, vendor self-disclosures have surpassed independent research outfits as the second most prolific vulnerability reporters,” notes the report. Third party companies remain the top reporters (337), with vendors second (214) and independent researchers slipping to third (138).
“The improvement in vendor disclosures,” Amir Preminger, Claroty’s VP of Research, told SecurityWeek, “is down to the growing maturity of the cyber/physical market.” Threat awareness, especially the potential severity of the threats, is better understood – and manufacturers are attempting to get ahead of the game.
The industry standard period allowed to manufacturers by vulnerability researchers is 90 days from reporting to disclosure. “We don’t do that,” said Preminger. “We will give the vendor as much time as he needs to patch a vulnerability before we publish any details on the vulnerabilities we discover. But I can tell you that doesn’t always happen. There have been cases where details are published before the vendor has fixed the flaw, and sometimes in less than the 90 days.”
It’s the standard full disclosure debate – but the stakes are higher with cyber/physical devices. If a vulnerability is actively exploited before a fix is available, lives could be lost. The vendors are trying to find and fix their own vulnerabilities before they can be prematurely disclosed by researchers.
Firmware vulnerabilities
A second area of improved vendor performance can be found in firmware fixes. Firmware flaws are typically more difficult to remediate than software flaws – which perhaps explains vendors’ historical response. In the second half of 2021, firmware fixes were running at 21%; but this jumped to 40% in the first half of 2022.
Preminger has seen signs of improvement for some time. It almost starts with better reporting to the company, and improved response from the company. “We must remember that although these are critical devices, the vendor is a commercial company. It needs to make money, while security fixes are a drain. That said, I am very happy to see they are improving their own goods based on their own internal review and response to researchers.”
This improvement is the first visible sign of the vendors’ growing maturity. If this is the case, the improvements should continue. “Definitely, yes,” said Preminger. “It’s a continuation of a trend we’ve been seeing for a couple of years. Currently it is strongest in the big cyber/physical companies – such as Siemens – and less so with the smaller boutique vendors.” For these larger companies, it is simply more efficient to find and remediate internally than be forced to negotiate and work with disclosure parties.
However, these improvements in vendors’ own vulnerability management cannot be seen as a relaxation of the cyber/physical threat. As Industry 5 continues to grow, there will be an increasing number of cyber/physical devices, and both the size and severity of the threat will continue to expand.
“After decades of connecting things to the internet, cyber-physical systems are having a direct impact on our experiences in the real world, including the food we eat, the water we drink, the elevators we ride, and the medical care we receive,” said Preminger The purpose of this report is to enable organizations “to properly assess, prioritize, and address risks to the mission-critical systems underpinning public safety, patient health, smart grids and utilities, and more.”
Related: COVID’s Silver Lining: The Acceleration of the Extended IoT
Related: OT Data Stolen by Ransomware Gangs Can Facilitate Cyber-Physical Attacks
Related: Cyber-Physical Security: Benchmarking to Advance Your Journey