Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Utilities, Nations Need Better Plan Against Critical Infrastructure Attackers
Newest First  |  Oldest First  |  Threaded View
User Rank: Ninja
6/29/2019 | 8:23:41 AM
Utilities need to be honest with the American public
"They have either been geographically focused or sector-specific, and the reason is that it costs so much time and resources to attack one specific sector of industrial that there really hasn't been any publicly known group that has been able to cross over."

 Interesting, I have worked a few ICS companies and what I have found is the following:
  • The organizations did not to make changes to old ICS systems because they felt it would affect certain IPL device performance or cause the software to shutdown
  • The software is outdated and the patch levels were months behind
  • The operator and staff were unwilling to setup test labs, the lab can be one or two machines with ICS software installed as a test case
  • The organization was unwilling to extensively test application segmentation
  • The OS and software the companies used numerous Windows Visual Studio C++ versions and ran databases in product environments that were 7-10 years old (MSSQL 7)
  • The utility company did not implement MFA/2FA
  • After the company bought the ICS application, enhancements were not applied
  • Adequate training was not purchased and shared across organization groups (certain groups did not share information with various teams)

For example, a friend of mine in Washington, DC (Citrix Systems Integrator and Designer) worked with a utility company where he was the manager and designer of a VDI environment, the system was running (during that time) the latest version of Cisco Switches (Nexus), Cisco UCS, NetApp with high-speed connections bursting from 10G/sec to 80G/sec (numerous fibre connections from DC, Delaware to ATL). They were acquired by a large power company, the larger power company wanted to deploy their software versions (because they were unfamilar with the Citrix VDI solution currently running) on their hardware (remove existing). The company went from 99.99% uptime to 44.60% uptime after they deployed their solution (this was for the utility helpdesk). There was a buy out, people complained but they were bought out or let go. This is a prime example of individuals not willing to listen or absorb the best aspects of the company, we see it all the time in the IT business, it had nothing to do with money, it was more about control.

In certain cases, money may have been an issue but the number one issue was "fear" or unwillingness to accept that a group may be more knowledge in an area of IT. The mentality for years is based on "if it's not broke, don't fix it". Well that is no longer a valid adage for performance and security. I do think it is a mentality but with proper planning, work extensively with the vendor, setup a small lab, schedule meetings, adequately train internal staff and test patch to identify the affects; the organization can reduce their outage concerns while minimizing costs.


User Rank: Apprentice
6/19/2019 | 2:50:32 PM
Raising awareness around a growing area of risk
Great article Rob.  You shed some light onto the existing inconsistency in critical infrastructure protection, an area we started working on in 1997 with PDD 63.  Given current events and increased heat around attacks and responses on the grid, more of this kind of exposition is important.

COVID-19: Latest Security News & Commentary
Dark Reading Staff 9/21/2020
Cybersecurity Bounces Back, but Talent Still Absent
Simone Petrella, Chief Executive Officer, CyberVista,  9/16/2020
Meet the Computer Scientist Who Helped Push for Paper Ballots
Kelly Jackson Higgins, Executive Editor at Dark Reading,  9/16/2020
Register for Dark Reading Newsletters
White Papers
Latest Comment: Exactly
Current Issue
Special Report: Computing's New Normal
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
How IT Security Organizations are Attacking the Cybersecurity Problem
How IT Security Organizations are Attacking the Cybersecurity Problem
The COVID-19 pandemic turned the world -- and enterprise computing -- on end. Here's a look at how cybersecurity teams are retrenching their defense strategies, rebuilding their teams, and selecting new technologies to stop the oncoming rise of online attacks.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2020-09-22
All versions of package cabot are vulnerable to Cross-site Scripting (XSS) via the Endpoint column.
PUBLISHED: 2020-09-21
Inappropriate implementation in permissions in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to spoof the contents of a permission dialog via a crafted HTML page.
PUBLISHED: 2020-09-21
Inappropriate implementation in Omnibox in Google Chrome on iOS prior to 85.0.4183.83 allowed a remote attacker to spoof the contents of the Omnibox (URL bar) via a crafted HTML page.
PUBLISHED: 2020-09-21
Insufficient policy enforcement in media in Google Chrome prior to 85.0.4183.83 allowed a remote attacker to leak cross-origin data via a crafted HTML page.
PUBLISHED: 2020-09-21
Insufficient validation of untrusted input in command line handling in Google Chrome on Windows prior to 85.0.4183.83 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page.