Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Database Security
Authentication
Mobile
Privacy
Compliance
Careers and People
Identity & Access Management
Security Monitoring
Advanced Threats
Insider Threats
Vulnerability Management
Comments
Utilities, Nations Need Better Plan Against Critical Infrastructure Attackers
Newest First  |  Oldest First  |  Threaded View
tdsan
50%
50%
tdsan,
 User Rank: Ninja
6/29/2019 | 8:23:41 AM
Utilities need to be honest with the American public
"They have either been geographically focused or sector-specific, and the reason is that it costs so much time and resources to attack one specific sector of industrial that there really hasn't been any publicly known group that has been able to cross over."

 Interesting, I have worked a few ICS companies and what I have found is the following:
  • The organizations did not to make changes to old ICS systems because they felt it would affect certain IPL device performance or cause the software to shutdown
  • The software is outdated and the patch levels were months behind
  • The operator and staff were unwilling to setup test labs, the lab can be one or two machines with ICS software installed as a test case
  • The organization was unwilling to extensively test application segmentation
  • The OS and software the companies used numerous Windows Visual Studio C++ versions and ran databases in product environments that were 7-10 years old (MSSQL 7)
  • The utility company did not implement MFA/2FA
  • After the company bought the ICS application, enhancements were not applied
  • Adequate training was not purchased and shared across organization groups (certain groups did not share information with various teams)

For example, a friend of mine in Washington, DC (Citrix Systems Integrator and Designer) worked with a utility company where he was the manager and designer of a VDI environment, the system was running (during that time) the latest version of Cisco Switches (Nexus), Cisco UCS, NetApp with high-speed connections bursting from 10G/sec to 80G/sec (numerous fibre connections from DC, Delaware to ATL). They were acquired by a large power company, the larger power company wanted to deploy their software versions (because they were unfamilar with the Citrix VDI solution currently running) on their hardware (remove existing). The company went from 99.99% uptime to 44.60% uptime after they deployed their solution (this was for the utility helpdesk). There was a buy out, people complained but they were bought out or let go. This is a prime example of individuals not willing to listen or absorb the best aspects of the company, we see it all the time in the IT business, it had nothing to do with money, it was more about control.

In certain cases, money may have been an issue but the number one issue was "fear" or unwillingness to accept that a group may be more knowledge in an area of IT. The mentality for years is based on "if it's not broke, don't fix it". Well that is no longer a valid adage for performance and security. I do think it is a mentality but with proper planning, work extensively with the vendor, setup a small lab, schedule meetings, adequately train internal staff and test patch to identify the affects; the organization can reduce their outage concerns while minimizing costs.

Todd

 
jackdanahy
50%
50%
jackdanahy,
 User Rank: Apprentice
6/19/2019 | 2:50:32 PM
Raising awareness around a growing area of risk
Great article Rob.  You shed some light onto the existing inconsistency in critical infrastructure protection, an area we started working on in 1997 with PDD 63.  Given current events and increased heat around attacks and responses on the grid, more of this kind of exposition is important.


Commentary
What the FedEx Logo Taught Me About Cybersecurity
Matt Shea, Head of Federal @ MixMode,  6/4/2021
News
Edge-DRsplash-10-edge-articles
A View From Inside a Deception
Sara Peters, Senior Editor at Dark Reading,  6/2/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-23394
PUBLISHED: 2021-06-13
The package studio-42/elfinder before 2.1.58 are vulnerable to Remote Code Execution (RCE) via execution of PHP code in a .phar file. NOTE: This only applies if the server parses .phar files as PHP.
CVE-2021-34682
PUBLISHED: 2021-06-12
Receita Federal IRPF 2021 1.7 allows a man-in-the-middle attack against the update feature.
CVE-2021-31811
PUBLISHED: 2021-06-12
In Apache PDFBox, a carefully crafted PDF file can trigger an OutOfMemory-Exception while loading the file. This issue affects Apache PDFBox version 2.0.23 and prior 2.0.x versions.
CVE-2021-31812
PUBLISHED: 2021-06-12
In Apache PDFBox, a carefully crafted PDF file can trigger an infinite loop while loading the file. This issue affects Apache PDFBox version 2.0.23 and prior 2.0.x versions.
CVE-2021-32552
PUBLISHED: 2021-06-12
It was discovered that read_file() in apport/hookutils.py would follow symbolic links or open FIFOs. When this function is used by the openjdk-16 package apport hooks, it could expose private data to other local users.