The Great Debate: Anti Virus and Monthly Security Patching Should Be Abandoned In ICS

### Overview This session, titled "The Great Debate," features a structured panel discussion on whether antivirus (AV) and monthly security patching should be abandoned in Industrial Control Systems (ICS). Facilitated by Dale Peterson, the session opens with two opposing advocates: Billy Rios, arguing for maintaining rigorous patching regimens, and Michael, an engineer arguing from an operational availability standpoint against disruptive monthly updates and AV overhead. The floor is then opened to conference attendees, sparking an extensive discussion on operational uptime, risk modeling, testing, and system architecture.

### Key Topics - **Adversary Relentlessness vs. Operational Stability:** Billy Rios outlines the attacker mindset, emphasizing that offensive researchers and adversaries do not stop seeking opportunities. Drawing on his experience as a former Internet Explorer security program manager, Rios argues that patching is difficult and demanding, but necessary to raise the bar against relentless attackers. - **Engineering and Availability Constraints:** Michael presents the perspective of critical infrastructure operators (power, water, natural gas), emphasizing that the primary imperative is process reliability and deterministic real-time control. A single untimely reboot or a delay of seconds can disrupt turbines or critical processes, while patches and AV signature updates inherently introduce unquantified operational risks. - **Vendor Roles and Testing Realities:** Participants discuss the limits of testing. Rios highlights that enterprise software vendors include major applications in test matrices only when demand or risk is severe, urging ICS asset owners to exert pressure on vendors. Others note that industrial systems are often semi-custom implementations, complicating vendor guarantees. - **Partial Patching and Risk Management:** The room debates realistic patching practices, such as patching only operating systems or applying updates quarterly or semi-annually. Commentators note that decisions are rarely binary; asset owners must weigh business risk, process interruption costs, and compensating controls. - **Antivirus Inefficiencies and Contractor Auditing:** Multiple speakers note AV's weaknesses, including its vulnerability to polymorphic code and inability to stop targeted penetration testing. Ralph Langner shares observations that roughly half of his clients experienced malware outbreaks despite having AV installed, emphasizing that lack of policy enforcement and auditing—particularly regarding third-party contractor laptops—undermines basic defenses.

### Technical Details - **Reboot Risks and Latency:** The debate notes Ralph Langner’s observation that 21 seconds of disruption could impair sensitive industrial processes like uranium enrichment, illustrating why unexpected reboots and AV scan latency during alarm storms present direct physical hazards. - **System Hardening vs. Bloat:** Speakers point out that deterministic ICS environments should minimize attack surfaces by removing unnecessary software and hardening systems rather than relying purely on stacked defensive agents like AV and whitelisting. - **Alternative Patching Paradigms:** Attendees explore academic and engineering solutions, such as employing formal mathematical methods to verify patch safety without requiring reboots, as well as leveraging virtualization to enable rapid rollback of faulty updates.

### Takeaways Informal votes taken at the conclusion show that while many participants recognize AV is technically dated and limited against advanced threats, the vast majority still rely on it to catch low-hanging automated malware and USB-borne threats. Similarly, attendees overwhelmingly reject completely abandoning security patching, agreeing that while monthly cycles may be unfeasible for 24/7 continuous operations, patching remain an essential risk-reduction practice when combined with testing, architecture redesign, and compensating controls.