Attacks/Breaches
5/18/2011
02:32 PM
Connect Directly
Google+
LinkedIn
Twitter
RSS
E-Mail
50%
50%

Stuxnet: How It Happened And How Your Enterprise Can Avoid Similar Attacks

A look back at one of the industry's most complex attacks--and the lessons it teaches.

[Excerpted from "Stuxnet Reality Check: Are You Prepared For A Similar Attack," a new report posted this week on the Dark Reading Advanced Threats Tech Center.]

Iranian nuclear facilities, zero-day exploits, secret operatives and nation-state government involvement sounds more like the backstory to a spy novel than a piece of malware. Yet Stuxnet, the most researched and analyzed malware ever, is still being studied and discussed in security circles around the world--even though it was discovered more than a year ago.

You probably don’t operate a nuclear facility, so why should you care about a piece of software that targeted specific centrifuge models in particular nuclear plants in another part of the world? Simply put, Stuxnet made cybernightmares reality and changed the security world forever--while simultaneously bringing to light the high risks associated with the supervisory control and data acquisition (SCADA) networks that control operations within many energy and utility companies.

How would a Stuxnet-like attack affect your enterprise--and what can you do to stop it? Let's take a look.

First, why should you be concerned? A recent Ponemon Institute report, "State of IT Security: Study of Utilities and Energy Companies," shows that protecting SCADA systems is clearly the highest security objectives within these companies, and the most difficult to achieve. For companies that run SCADA networks, Stuxnet shows the harm a determined, highly skilled attacker with ample resources might do.

For the rest of us, while there are comparisons that could be made between private networks and SCADA networks, the risks are not the same. So, your best bet is to understand how Stuxnet works, its intent and, most importantly, why it was able to be somewhat successful, to understand the potential next-generation of malware that will attack your network.

Stuxnet was used in a targeted attack on five organizations in June and July 2009 and March, April, and May 2010, all five of which have a presence in Iran. The targeting of specific companies is what sets Stuxnet apart from the traditional advanced persistent threat.



Read the rest of this article on Dark Reading.

Yes, you can stay safe in the cloud. In this Tech Center report, we explain the risks and guide you in setting appropriate cloud security policies, processes, and controls. Download the report now. (Free with registration.)

Comment  | 
Print  | 
More Insights
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-8142
Published: 2014-12-20
Use-after-free vulnerability in the process_nested_data function in ext/standard/var_unserializer.re in PHP before 5.4.36, 5.5.x before 5.5.20, and 5.6.x before 5.6.4 allows remote attackers to execute arbitrary code via a crafted unserialize call that leverages improper handling of duplicate keys w...

CVE-2013-4440
Published: 2014-12-19
Password Generator (aka Pwgen) before 2.07 generates weak non-tty passwords, which makes it easier for context-dependent attackers to guess the password via a brute-force attack.

CVE-2013-4442
Published: 2014-12-19
Password Generator (aka Pwgen) before 2.07 uses weak pseudo generated numbers when /dev/urandom is unavailable, which makes it easier for context-dependent attackers to guess the numbers.

CVE-2013-7401
Published: 2014-12-19
The parse_request function in request.c in c-icap 0.2.x allows remote attackers to cause a denial of service (crash) via a URI without a " " or "?" character in an ICAP request, as demonstrated by use of the OPTIONS method.

CVE-2014-2026
Published: 2014-12-19
Cross-site scripting (XSS) vulnerability in the search functionality in United Planet Intrexx Professional before 5.2 Online Update 0905 and 6.x before 6.0 Online Update 10 allows remote attackers to inject arbitrary web script or HTML via the request parameter.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.