- The vendor doesn't support any third-party software loaded by anyone else by the vendor. Loading third-party software can void the warranty because it hasn't been tested for compatibility.
- The laboratory hardware connected to the computer requires a special driver or software that only runs on Windows 3.1 or 95. Upgrading the computer to XP or Windows 7 requires purchasing a new software license that is "too expensive."
- The vendor using an embedded operating system from another vendor that you don't have access to in order to install patches or turn off vulnerable services.
Case #2 is a touchy subject for some. From the security standpoint, I want to recommend that they pony up the bucks and buy the new version of the software and/or hardware. However, having the academic background that I do, I know it can be difficult for researchers to shell out tens of thousands of dollars to make that purchase.
I think we're seeing a perfect example of case #3 with the recent VxWorks vulnerabilities. I've spoken to several friends who've called their vendors looking for a fix to vulnerabilities they've identified on their networks using the Metasploit Framework's scanning module or the new Nessus plug-in. The vendor ends up forwarding the call to numerous other people who have no idea that their printer, Fiber Channel switch, or other device even runs VxWorks.
So what are we as security professionals left to do when faced with these unpatchable systems? We could be jerks and force them all to be unplugged. Or we could work with the individuals who use them daily so as to not impact their productivity while protecting them and our network.
For example, you should segment these devices from the rest of the network. If they don't need Internet access, don't let them have access, or if they do, force them through a highly restrictive proxy. If they don't need to be on the network, then remove their NICs or fill the ports with epoxy.
There are many ways to approach it, but the key is to work with IT and the uses to come up with usable scenarios that allow productivity while maintaining security. And when it comes time to replace the device, find a new vendor.
John H. Sawyer is a senior security engineer on the IT Security Team at the University of Florida. The views and opinions expressed in this blog are his own and do not represent the views and opinions of the UF IT Security Team or the University of Florida. When John's not fighting flaming, malware-infested machines or performing autopsies on blitzed boxes, he can usually be found hanging with his family, bouncing a baby on one knee and balancing a laptop on the other. Special to Dark Reading.