Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Database Security
Authentication
Mobile
Privacy
Compliance
Careers and People
Identity & Access Management
Security Monitoring
Advanced Threats
Insider Threats
Vulnerability Management
Comments
Utilities, Nations Need Better Plan Against Critical Infrastructure Attackers
Newest First  |  Oldest First  |  Threaded View
tdsan
50%
50%
tdsan,
 User Rank: Ninja
6/29/2019 | 8:23:41 AM
Utilities need to be honest with the American public
"They have either been geographically focused or sector-specific, and the reason is that it costs so much time and resources to attack one specific sector of industrial that there really hasn't been any publicly known group that has been able to cross over."

 Interesting, I have worked a few ICS companies and what I have found is the following:
  • The organizations did not to make changes to old ICS systems because they felt it would affect certain IPL device performance or cause the software to shutdown
  • The software is outdated and the patch levels were months behind
  • The operator and staff were unwilling to setup test labs, the lab can be one or two machines with ICS software installed as a test case
  • The organization was unwilling to extensively test application segmentation
  • The OS and software the companies used numerous Windows Visual Studio C++ versions and ran databases in product environments that were 7-10 years old (MSSQL 7)
  • The utility company did not implement MFA/2FA
  • After the company bought the ICS application, enhancements were not applied
  • Adequate training was not purchased and shared across organization groups (certain groups did not share information with various teams)

For example, a friend of mine in Washington, DC (Citrix Systems Integrator and Designer) worked with a utility company where he was the manager and designer of a VDI environment, the system was running (during that time) the latest version of Cisco Switches (Nexus), Cisco UCS, NetApp with high-speed connections bursting from 10G/sec to 80G/sec (numerous fibre connections from DC, Delaware to ATL). They were acquired by a large power company, the larger power company wanted to deploy their software versions (because they were unfamilar with the Citrix VDI solution currently running) on their hardware (remove existing). The company went from 99.99% uptime to 44.60% uptime after they deployed their solution (this was for the utility helpdesk). There was a buy out, people complained but they were bought out or let go. This is a prime example of individuals not willing to listen or absorb the best aspects of the company, we see it all the time in the IT business, it had nothing to do with money, it was more about control.

In certain cases, money may have been an issue but the number one issue was "fear" or unwillingness to accept that a group may be more knowledge in an area of IT. The mentality for years is based on "if it's not broke, don't fix it". Well that is no longer a valid adage for performance and security. I do think it is a mentality but with proper planning, work extensively with the vendor, setup a small lab, schedule meetings, adequately train internal staff and test patch to identify the affects; the organization can reduce their outage concerns while minimizing costs.

Todd

 
jackdanahy
50%
50%
jackdanahy,
 User Rank: Apprentice
6/19/2019 | 2:50:32 PM
Raising awareness around a growing area of risk
Great article Rob.  You shed some light onto the existing inconsistency in critical infrastructure protection, an area we started working on in 1997 with PDD 63.  Given current events and increased heat around attacks and responses on the grid, more of this kind of exposition is important.


Edge-DRsplash-10-edge-articles
I Smell a RAT! New Cybersecurity Threats for the Crypto Industry
David Trepp, Partner, IT Assurance with accounting and advisory firm BPM LLP,  7/9/2021
News
Attacks on Kaseya Servers Led to Ransomware in Less Than 2 Hours
Robert Lemos, Contributing Writer,  7/7/2021
Commentary
It's in the Game (but It Shouldn't Be)
Tal Memran, Cybersecurity Expert, CYE,  7/9/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
How Enterprises are Attacking the Cybersecurity Problem
Concerns over supply chain vulnerabilities and attack visibility drove some significant changes in enterprise cybersecurity strategies over the past year. Dark Reading's 2021 Strategic Security Survey showed that many organizations are staying the course regarding the use of a mix of attack prevention and threat detection technologies and practices for dealing with cyber threats.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-34580
PUBLISHED: 2021-10-27
In mymbCONNECT24, mbCONNECT24 <= 2.9.0 an unauthenticated user can enumerate valid backend users by checking what kind of response the server sends for crafted invalid login attempts.
CVE-2011-4126
PUBLISHED: 2021-10-27
Race condition issues were found in Calibre at devices/linux_mount_helper.c allowing unprivileged users the ability to mount any device to anywhere.
CVE-2011-4574
PUBLISHED: 2021-10-27
PolarSSL versions prior to v1.1 use the HAVEGE random number generation algorithm. At its heart, this uses timing information based on the processor's high resolution timer (the RDTSC instruction). This instruction can be virtualized, and some virtual machine hosts have chosen to disable this instru...
CVE-2020-7867
PUBLISHED: 2021-10-27
An improper input validation vulnerability in Helpu solution could allow a local attacker to arbitrary file creation and execution without click file transfer menu. It is possible to file in arbitrary directory for user because the viewer program receive the file from agent with privilege of adminis...
CVE-2021-26610
PUBLISHED: 2021-10-27
The move_uploaded_file function in godomall5 does not perform an integrity check of extension or authority when user upload file. This vulnerability allows an attacker to execute an remote arbitrary code.