Jserv's blog

軟體多樣性對嵌入式系統的影響

傍晚讀了 Jim Higgins 的文章 [Diversity protects embedded systems]，他以從事嵌入式網路裝置十年的經驗，探討廣泛應用的嵌入式裝置面臨安全性的高度挑戰，他提到一個有趣的現象：

"90% of vulnerability exposure is caused by 10% of critical vulnerabilities. "

嵌入式系統過去面臨的第一個問題是，對資源錙銖必較，而今，隨著科技的進步，已略為舒緩壓力，也得以透過既有的軟硬體元件來加速開發時程，然而，此舉也間接埋下許多不可知性到產品中，於是 Jim Higgins 還用了一段來描述：

The lack of effective network security is no longer a blameless matter. The Sarbanes-Oxley Act of 2002 and the Health Insurance Portability and Accountability Act of 1996 (HIPPA) have made corporate officers personally accountable for the security of their customers' private information. Exploitation of a vulnerability could lead to leaks of personal information and is a principle reason why the creation of a new corporate position, chief information security officer (CISO), has become prevalent. The CISO is looking to keep the CEO out of jail.

最後一句看似有些誇大，然而對很多只有一種主力產品的公司，面對自家產品眾多不可知性，到底有多少籌碼來面對種種挑戰呢？此外，文章的 "Choosing diversity" 提到一個有趣的觀點，使用開放系統已經是無法抗拒的趨勢，不過這招致許多 hacker/cracker 的覬覦，作者提到 [CyptLib] 對 [OpenSSL] 的替換性，而就既有的自由軟體來說，還有不少可作為替代的解決方案，這也就是軟體的多樣性，而 Jim Higgins 提出此特性有助於嵌入式系統的安全性。

就 [CyptLib] 與 [OpenSSL] 來說，後者主要是針對 SSL/TLS protocol 的實做，而且相當完整，相關的 Crypto Algorithm 則是個別模組，相較之下，[CyptLib] 專注於 Crypto Algorithm 與相關標準的實做。但作為軟體，以發明 shortest path routing 的 Dijkstra 就表示過：

「測試可以證明臭蟲的存在，但卻無法證明它們的不存在。」

可以想見，超過一定規模的系統軟體，勢必會有 bug / security issues，只是其衝擊程度的不同，然而，軟體的多樣性，對一個嵌入式系統的開發來說，就如前述文章提到：

Embedded systems developers can mitigate the exploitation risk dramatically by considering "security through diversity" when selecting software components for their products. Diversity is particularly critical for embedded systems since their software components are generally more opaque to an IT professional than those of an ordinary server. Further, the methods for upgrading most embedded systems are nonstandard and can be time consuming for the IT staff. These factors may delay the deployment of critical patches and increase the risk that unknown vulnerabilities exist on the network.

當然，這也不可能最佳的作法，然而這可視為有限程度的安全性策略。
由 jserv 發表於 May 5, 2006 08:07 PM