With the news that Industroyer2 was found (great work by Ukraine CERT and ESET) targeting the electric system in Ukraine this marks the sixth ICS specific malware. It’s a busy time for ICS defenders. However the good news is none of what we’re seeing changes the guidance folks have been giving for years. You need a robust security program but tailored for ICS. - ICS specific incident response plan - Defensible architecture - ICS network monitoring/visibility - MFA for remote access - Key vuln mgmt program Those five controls put people into an amazing place. The focus on tactics, techniques, and procedures like those mapped out in MITRE ATT&CK for ICS also enable folks to move from reactionary to proactive. These are heightened times but with preparation don’t need to be fire drills. Good luck out there folks
Linda Rust
2y
"With preparation there don't need to be fire drills" From your mouth to God's ears!
Thanks for Sharing. Looking forward for more insights on Industroyer2 from Dragos. Glad to have these points covered in "The OT Security Dozen" series. https://www.linkedin.com/pulse/ot-security-dozen-12-part-series-building-ics-cyber-program-faisal/ OR https://gca.isa.org/blog/ot-security-dozen-series-on-building-an-ot/ics-cybersecurity-program
John Mueller
2y
All good points. And expect to see more attacks and attention toward ICS/OT/Critical Infrastructure in the future. Shields up!
Mirel Sehic
2y
Good list Robert M. Lee, Defensible architecture can include; hardening (CIS etc.) + solid architecture design (zones, network conduits, perimeter protection) 🔒
"In addition to Industroyer2 <sic> a variant of CaddyWiper was used" "moved from the IT network to the Industrial Control System (ICS) network"- ESET
Absolutely these 5 points make robust security program for any ICS/SCADA related industry.
Your content is really helpful Robert
Cybersecurity & Risk Management Executive Leader | Board Member | Empowering Marginalized Communities
2yI’ll be sure to tune in Robert! The APT actors have mastered the development of custom malware for targeting ICS/SCADA devices. The threat actors will be able to easily scan, compromise, and control the targeted devices upon successfully establishing initial access to the operational technology (OT) network. In addition to it, threat actors can exploit Windows-based engineering workstations present in information technology (IT) or OT environments by leveraging an exploit compromising an ASRock motherboard driver. Those actors could elevate privilege and move laterally, disrupting critical devices or functions by maintaining full system access to ICS/SCADA devices. Isolating the ICS/SCADA systems and networks from corporate and internet networks, regularly updating the passwords of the control systems, regularly keeping backup of the data, limiting network connection of the ICS/SCADA systems, employing robust log monitoring systems, regularly updating the existing software with latest security patches are some additional measures organizations can adopt to prevent the malicious activities. Andrew Stravitz Mario Memmo Nicole Darden Ford Daniel Conroy Kirsten Davies Devon Bryan Tomás Maldonado Aaron Hughes