Catch me if you can: an in-depth study of CVE discovery time and inconsistencies for managing risks in critical infrastructures
Research output: Chapter in Book/Report/Conference proceeding › Conference contribution
- School of Computer Science, University of Birmingham, Birmingham, United Kingdom.
- University of Bristol
Industrial Control Systems (ICS) are central to the operation of critical national infrastructure (CNI) such as oil and gas, water treatment, power generation and transport systems. Effective risk management to mitigate large-scale disruption to societies and economies depends on both timely information about vulnerabilities and the consistency of this information. The longer the vulnerabilities remain "in the wild" or a lack of consistency in vulnerability reporting, the greater the impact on CNI operators' ability to systematically understand and mitigate the risks. In this paper, we focus on vulnerabilities identified and reported in Siemens ICS devices, which hold the largest share of the market. We undertake an in-depth analysis of 207 CVEs, identifying the time over which vulnerabilities were 'in the wild' before being discovered and advisories issued, and examine issues with the correctness of CVE information. We find that, on average, a vulnerability is 'in the wild' for 5.3 years, and that many CVEs do not correctly reflect and state the affected devices as Common Platform Enumerations (CPEs). Based on our findings, we propose a set of guidelines to improve the reporting and consistency of ICS CVE information.
|Title of host publication||CPSIOTSEC'20|
|Subtitle of host publication||Proceedings of the 2020 Joint Workshop on CPS&IoT Security and Privacy|
|Publication status||Published - 9 Nov 2020|
|Event||CPSIOTSec: The Joint Workshop on CPS & IoT Security and Privacy - |
Duration: 9 Nov 2020 → 9 Nov 2020
|Conference||CPSIOTSec: The Joint Workshop on CPS & IoT Security and Privacy|
|Period||9/11/20 → 9/11/20|