Awareness Of Purdue Level 0 and 1 (In)Security

<p>Solving a problem typically begins with awareness that there is a problem. Back at S4x12 a group of researchers under the Project Basecamp banner demonstrated that most PLC's (Purdue Level 1 devices) were both insecure by design and ridden with exploitable bugs, as well how an attacker could leverage these issues. Nine years later I believe the issue is known in the ICS security community, even if it is just beginning to be solved.</p> <p>Similarly, ICSsec pioneer Joe Weiss has been on a content blitz the last three years pointing out that Purdue Level 0 devices, sensors and actuators, do not have any security. Primarily with the example that false process sensor data could be presented to the control system. He has asserted that the ICS security community does not know this, most recently in <a href= "https://www.controlglobal.com/blogs/unfettered/observations-from-the-2021-sans-ics-cyber-security-conference" target="_blank" rel="noopener nofollow">a post SANS ICS Security Summit article</a>.</p> <blockquote>there appeared to be a general acceptance that Level 0,1 devices were uncompromised, authenticated, and correct. That is wrong</blockquote> <p>Joe and I had <a href= "https://www.linkedin.com/posts/joew1_observations-from-the-2021-sans-ics-cyber-activity-6774725906788442112-MXZL" target="_blank" rel="noopener">a back and forth on LinkedIn</a> on whether this misconception was present in the S4 audience, SANS ICS Security Summit audience, and ICS security community in general. My belief was lack of security at Levels 0 and 1 was common knowledge in the ICSsec community and the only disagreements are the prioritization of addressing this issue amongst the large number of issues and how it should be addressed. We tried to answer this disagreement with a poll.</p> <p><img src= "https://assets.libsyn.com/secure/show/99465/Screen_Shot_2021-03-14_at_3.31.18_PM.png" alt="" width="473" height="260" /></p> <p>The same poll in my Friday Newsletter had 147 responses with 98% answering False. It is likely that there i