Embedded: Green Hills CEO warns about infrastructure security dangers

Santa Barbara, CA—U.S. software infrastructure is vulnerable, and, in his opening comments at the fifth annual Green Hills Software Embedded Software Summit, the company’s founder, president and CEO, Dan O’Dowd treated attendees to a laundry list of those vulnerabilities.

By Control Engineering Staff December 12, 2007

Santa Barbara, CA —U.S. software infrastructure is vulnerable, and, in his opening comments at the fifth annual

Green Hills Software

Embedded Software Summit, the company’s founder, president and CEO, Dan O’Dowd treated attendees to a laundry list of those vulnerabilities. Using illustrative clips from a recent major motion picture, backed up by news accounts of actual attacks on automated systems and other computerized infrastructure, O’Dowd explained how hackers are exploiting several major vulnerabilities to take over, crash, or otherwise subvert these systems.

Michel Mayer, chairman and CEO of

Freescale Semiconductor

, and David Grawrock, principal engineer and lead security architect at

Intel Corp

. echoed O’Dowd’s concerns, and cited security as the biggest challenge facing embedded systems developers today. Rob Dobry, senior technical director for trusted computing with the

National Security Agency

’s (NSA’s) Commercial Solutions Center pointed out that the EAL-4 security level, which is what nearly all popular commercial operating systems can achieve, is effectively no security at all. “EAL-4 certification means the software is safe against‘inadvertent’ attacks,” he pointed out, “It is certifiably hackable!” To repel a determined attack by a determined, well funded individual or organization requires EAL-6+ certification, he said. Only one operating system is being certified to that level: GHS’ Integrity OS used on the

U.S. Department of Defense (DoD) F-35 Joint Strike Fighter [see photo of the plane].

All agreed that the only systems that could be considered hacker-proof were Department of Defense weapons systems. At an afternoon panel session featuring security system experts from industry and government, O’Dowd pointed out that software testing for both function and security was not up to the level hardware engineers consider routine. “Only one industry routinely tests software thoroughly,” he said. “That is the aerospace industry where if software fails someone dies!”

When asked what percentage of mission-critical software development cost goes into testing, Jess Irwin, principal engineer for Northrop-Grumman responded: “Ninety percent.” This compares with typical testing costs for the electronics industry as a whole of 50%-80%.

Control Engineering offers feature articles related to software security .

For more, also search on security atop www.controleng.com.

— C.G. Masi , senior editor Control Engineering News Desk( Register here and scroll down to select your choice of eNewsletters free .)