Embedded: Green Hills CEO warns about infrastructure security dangers
Santa Barbara, CA —U.S. software infrastructure is vulnerable, and, in his opening comments at the fifth annual
Green Hills Software
Embedded Software Summit, the company’s founder, president and CEO, Dan O’Dowd treated attendees to a laundry list of those vulnerabilities. Using illustrative clips from a recent major motion picture, backed up by news accounts of actual attacks on automated systems and other computerized infrastructure, O’Dowd explained how hackers are exploiting several major vulnerabilities to take over, crash, or otherwise subvert these systems.
Michel Mayer, chairman and CEO of
, and David Grawrock, principal engineer and lead security architect at
. echoed O’Dowd’s concerns, and cited security as the biggest challenge facing embedded systems developers today. Rob Dobry, senior technical director for trusted computing with the
National Security Agency
’s (NSA’s) Commercial Solutions Center pointed out that the EAL-4 security level, which is what nearly all popular commercial operating systems can achieve, is effectively no security at all. “EAL-4 certification means the software is safe against‘inadvertent’ attacks,” he pointed out, “It is certifiably hackable!” To repel a determined attack by a determined, well funded individual or organization requires EAL-6+ certification, he said. Only one operating system is being certified to that level: GHS’ Integrity OS used on the
U.S. Department of Defense (DoD) F-35 Joint Strike Fighter [see photo of the plane].
All agreed that the only systems that could be considered hacker-proof were Department of Defense weapons systems. At an afternoon panel session featuring security system experts from industry and government, O’Dowd pointed out that software testing for both function and security was not up to the level hardware engineers consider routine. “Only one industry routinely tests software thoroughly,” he said. “That is the aerospace industry where if software fails someone dies!”
When asked what percentage of mission-critical software development cost goes into testing, Jess Irwin, principal engineer for Northrop-Grumman responded: “Ninety percent.” This compares with typical testing costs for the electronics industry as a whole of 50%-80%.
For more, also search on security atop www.controleng.com.
— C.G. Masi , senior editor
Control Engineering News Desk
( Register here and scroll down to select your choice of eNewsletters free .)