PD-12-11 Stuxnet and Security: Dos & Don’ts

Description:

In all of the panic and anxiety caused by Stuxnet, there’s been a lot of discussion about how the latest technology (e.g. application whitelisting, data diodes, etc.) might have been able to contain it. But all of this focus on what could have been done potentially distracts us from what is really at issue. There really is no silver bullet. A given technology may block what we see today, but what’s on the horizon? What gets lost in all of this distraction is the importance of security fundamentals and of having a proper appreciation of the capabilities and limitations of your security program; which is to provide a program or tools that minimize your exposure and maximize your ability to contain and recover without adversely affecting your controls.