• Search for:
    7Nov, 2022
    Cyberwar is Changing – is Your Organization Ready?

    Some say that a global cyberwar has been raging for many years now, with the latest geopolitical instabilities, malware and intellectual theft campaigns originating from Russia, China, Iran and North Korea directed against many Western and NATO nations (as well as vice versa), being a continuation of the existing silent cyberwar. In other words, the argument goes, nothing has changed, and there is nothing to worry about – unless you’re aligned with a targeted state. 

    However, a lot has changed. Today’s cyberwar targets extend well beyond state entities and impacts organizations around the world.

    In fact, cyber-attacks against critical infrastructure, manufacturers and tech firms have become so common that CISA has implemented its ‘Shields Up’ advisory, providing updates on how Russia’s ongoing actions are impacting organizations beyond the immediate warzone, along with guidance for preventing cyber-attacks.

    Industrial and Manufacturing Are Top Targets

    Recently, the trend of cyber-attacks has pivoted to target operational technology (OT) and industrial control systems (ICS) in manufacturing providers for all industries.

    The two most notable recent examples include ransomware attacks on Bridgestone Americas and a suspected cyber-attack on Japan-based Toyota plants. The latter attack happened on the same day Japan joined Western countries in restricting transactions with the Central Bank of the Russian Federation. However, please note that bad actors are often driven by monetary reward and not just geopolitics.

    Attacks on critical infrastructure increased by 3900% from 2013 to 2020, and 55% of OT security practitioners rate ransomware as the #1 threat to OT systems, double the percentage that rated it as the #1 threat in 2019. Why?

    For one, the emergence of ransomware gangs like Conti, who extorted at least $180m from victims in 2021. This is around double the amount extorted by DarkSide/BlackMatter, who were responsible for the well-known attack on Colonial Pipeline. Ransomware is proving to be very profitable for bad actors. 

    Whereas aggressors once sought plausible deniability in their attacks, many now seem to pursue cyberwarfare against consumer services, critical infrastructure, hospitals and the like with impunity. Today, cyberwarfare is the most convenient, asymmetrical and cost-effective way for countries and bad actors to conduct warfare.

    Cyber Resilience Is Key

    Continued migration to the cloud, the move to mobile and BYOD, the convergence of IT/OT/IoT and the sharp increase in remote working have changed how we must approach cybersecurity. As the number of connected devices in the workplace and manufacturing plants grows, the IT/OT and security tools previously relied on are becoming ineffective. 

    For critical infrastructure and OT organizations, given the unprecedented geopolitical situation, every organization should, at the bare minimum, be able to answer these questions:

    • What is connected to my network?
    • What are these devices doing while connected?
    • Are there active exploits crossing my enterprise?
    • What is the risk posture of our devices and our organization?

    Visibility Gaps

    Many organizations do not have the required insight and visibility into their infrastructure, nor do they have all the policies and processes to respond effectively to an attack. If you can’t see your blind spots, you are more likely to be the target of a significant attack.

    Ideally, you should be aware of all the processes in the organization and spread them out on a virtual map. This includes every connected IT and OT asset – managed and unmanaged – found within and around the enterprise and network equipment and related devices that connect to the network. Once the map is established, behavior pattern threat detection can detect anomalies in real time and allow for swift action.

    It only takes one missed asset to suffer from a cyber-intrusion; therefore, organizations can respond much more quickly and effectively if they have a comprehensive view of all assets. Every time a new high-severity vulnerability/CVE is published, vulnerability analysts can cut to the chase and quickly determine the total risk it poses to the business based on all the impacted assets. Then, based on risk levels to the business, they can define which assets should be remediated first (if possible), quarantined or even taken offline. 

    Mapping out all processes and assets is also vital to recovery during a cyber intrusion. Following an attack, organizations can sometimes go down for a day or two, and in unusual cases, it can take months to get back in business. Companies should also push for assurances by independent auditors that their infrastructure can rapidly recover after a cyber-attack. 

    Overall, ensuring best-in-class cyber asset visibility and security partners or providers is crucial to any organization’s future security, safety and profitability in this age of cyberwarfare – where any organization can be a target.

    Resource : https://www.infosecurity-magazine.com/opinions/cyberwarfare-changing-org-ready/

    7Nov, 2022
    World’s Most Expensive Observatory Floored by Cyber-Attack

    The world-famous Atacama Large Millimeter Array (ALMA) observatory in Chile has become the latest unlikely victim of a cyber-attack, forcing it offline.

    The facility, which also claims to house the world’s most powerful telescope for observing molecular gas and dust, revealed the incident on Twitter earlier this week.

    It said the attack on its computer systems came last Saturday, “forcing the suspension of astronomical observations and the public website.”

    At the time of writing, the official ALMA website was still down.

    “There are limited email services at the observatory. The threat has been contained, and our specialists are working hard to restore affected systems. The attack did not compromise the ALMA antennas or any scientific data,” it explained.

    “Given the nature of the episode, it is not yet possible to estimate a date for a return to regular activities. We are thankful for the support across the ALMA partnership and apologize for any inconveniences resulting from the recovery efforts.”

    Kelvin Murray, senior threat researcher at OpenText Security Solutions, argued that space-related technology is increasingly a focus for threat actors.

    “The cyber-attack on the ALMA radio telescope is a stark reminder that no matter the industry, cyber-defenses need to be regularly assessed and updated to ensure that hacks like these don’t happen,” he added.

    “As digital equipment and software develops, the industry needs to keep cyber risk top of mind and continually assess the strength of its defenses. The consequence of the breach cannot be undermined.”

    It remains to be seen what kind of attack the observatory suffered, although ransomware would be an obvious candidate given the facility was forced offline.

    Chris Vaughan, VP of technical account management EMEA at Tanium, argued that ALMA was likely working with “very limited” IT budgets and staff.

    “A high level of network visibility should be utilized as part of a zero-trust approach. This is where implicit trust is eliminated and the principle of ‘never trust, always verify’ is used,” he advised.

    “This means that strong authentication methods, network segmentation and lateral movement prevention is key. If these practices are embedded within an organization’s culture along with effective staff training, then institutions like ALMA can carry on their fantastic work without costly interruptions caused by cyber-threats.”

    ALMA is believed to have cost around $1.4bn to build.

    Resource : https://www.infosecurity-magazine.com/news/worlds-most-expensive-observatory/