• Search for:
    19Dec, 2023
    MITRE Unveils EMB3D Threat Model for Embedded Devices Used in Critical Infrastructure

    MITRE has teamed up with the cybersecurity community and the industrial sector to create EMB3D, a threat model specifically designed for embedded devices used in critical infrastructure.

    EMB3D is the work of MITRE, Red Balloon Security, Narf Industries, and Niyo ‘Little Thunder’ Pearson of ONE Gas. 

    Its goal is to provide a collaborative framework that enables organizations to have a common understanding of the threats targeting embedded devices and how those threats can be mitigated. 

    The new threat model — recommended for manufacturers, vendors, asset owners, testers and security researchers — expands on resources such as ATT&CK, CVE and CWE, with a focus on embedded devices. It provides a knowledge base of threats, including ones seen in the wild and ones demonstrated through theoretic research and proofs of concept. 

    In order to help users create and tailor threat models to specific devices, threats are mapped to device properties. The mitigations suggested by EMB3D are exclusively focused on technical mechanisms that can be implemented by device vendors. 

    “The EMB3D model will provide a means for ICS device manufacturers to understand the evolving threat landscape and potential available mitigations earlier in the design cycle, resulting in more inherently secure devices,” Pearson said. “This will eliminate or reduce the need to ‘bolt on’ security after the fact, resulting in more secure infrastructure and reduced security costs.” 

    The framework will be continuously updated by its maintainers and the cybersecurity community with new information on threat actors, vulnerabilities and defenses. 

    EMB3D is in a pre-release review period, with device vendors, asset owners, academics and researchers being encouraged to review the framework before its official launch, which is scheduled for early 2024.

    Resource : https://www.securityweek.com/mitre-unveils-emb3d-threat-model-for-embedded-devices-used-in-critical-infrastructure/

    22Dec, 2022
    Cost of a Data Breach: Infrastructure

    What Is Critical Infrastructure?

    The U.S. Cybersecurity and Infrastructure Security Agency (CISA) classifies 16 infrastructure sectors as critical to the nation. Among these critical sectors are financial services, critical manufacturing, information technology, energy, transportation systems, communications, health care and public health, food and agriculture and emergency services.

    CISA designates certain industries as critical because their assets, systems and networks, whether physical or virtual, are considered so vital to the United States that their incapacitation or destruction would have a debilitating effect on security, national economic security, national public health or safety or some combination of those factors. When cybersecurity issues occur in organizations in critical industries, there is a ripple effect with many often-unexpected consequences.

    The Colonial Pipeline ransomware attack, for example, shut down an oil pipeline that stretches 5,500 miles from Texas to New York and carries up to 3 million barrels of fuel per day. The five-day shutdown reduced the amount of gas available to the East Coast by half. Therefore, many areas experienced gas shortages and high prices. In addition, Colonial Pipeline paid $4.5 million in ransom to restore its compromised systems and faces more fines for operational lapses and management failures. The attack also resulted in new directives issued by the Transportation Security Administration for U.S. pipelines to prevent similar attacks and reduce their impact.

    What Is a Critical Infrastructure Data Breach?

    Each time an organization in a critical sector is the victim of any type of cybersecurity incident that results in data loss, the event counts as a critical infrastructure data breach. The IBM 2022 Cost of a Data Breach Report revealed the following breakdown of types of attacks on critical infrastructure industries:

    • IT failure (25%)
    • Human error (22%)
    • Third-party business partner (17%)
    • Destructive attacks (16%)
    • Ransomware (12%)
    • Other malicious attacks (8%).

    Impact of a Critical Infrastructure Data Breach

    Interestingly, the average cost of a critical infrastructure data breach was more than $1 million more than other data breaches. It cost an average of $4.82 million compared to $3.83 million in industries such as pharmaceuticals, services, entertainment, consumer goods, media, hospitality, retail and research. These totals do not include the impacts data breaches and disruption of services have on consumers and other businesses. Those might include supply chain issues or greater health care costs from delays in care.

    Not surprisingly, health care continued its 12-year reign as the most costly industry for a data breach. In 2021, the average cost of a health care data breach was $9.23 million. However, the new report found the average cost increased to $10.10 million in 2022, an increase of 9.4%. Other critical infrastructure industries ranked in the top four, with financial services coming in second at $5.97 million. Other high-cost critical infrastructure industries include technology ($4.97 million) and energy ($4.72 million).

    Although the costs for critical infrastructure are higher, the report found that defenders find and contain breaches more quickly there than in other industries. That proves the costs would be even higher without the quick action and high priority of cybersecurity workers. The Mean Time to Identify in critical infrastructure industries was 204 days, compared to 211 days for other industries. The Mean Time to Contain for critical infrastructure industries was 69 days, compared to 71 days for other industries. Overall, the combined average for critical infrastructure industries was nine days shorter than the 282 days average for other industries. 

    Zero Trust Can Reduce Costs of Data Breaches

    A surprising finding from the report: critical infrastructure organizations were much less likely to use a zero trust framework. With a zero trust approach, an organization moves away from the traditional strategy of protecting the perimeter and endpoints. Instead, the organization reduces risk by assuming that all access requests from apps, users and devices are not authorized. The user must then prove otherwise since the organization meets every request with zero trust.

    The higher costs for critical infrastructure breaches likely relate to the lower adoption of the framework in these industries. The report found that one in five organizations in critical infrastructure industries are using zero trust. However, 41% of all organizations — both critical and non-critical infrastructure industries — now use a zero trust approach.

    The report discovered that critical infrastructure organizations that use a zero trust approach have an average breach cost of $4.23 million. Meanwhile, critical infrastructure organizations that are not using a zero trust approach have an average cost of $5.40 million. That’s a difference of $1.17 million per breach. Critical infrastructure industry organizations can reduce the cost of a breach simply by using a zero trust approach.

    Moving Forward With Zero Trust in Critical Infrastructure Industries

    While the prospect of completely shifting your cybersecurity approach can feel overwhelming, zero trust consists of multiple types of processes and technologies. By starting small, with one type of zero trust approach such as multi-factor authentication or micro-segmentation, your organization can begin to see the benefits of the approach.

    Organizations can build upon their initial framework by adding more technology and strategies as they become more experienced with zero trust. The report found that the level of maturity in zero trust makes a difference in breach costs for all organizations. That holds true both in critical infrastructure sectors and other industries. Organizations with a mature zero trust approach spent $1.51 million less than organizations just starting their journey.

    Creating a fully mature zero trust framework doesn’t happen overnight. By starting your journey today, your organization can begin reducing both risks and costs of a breach.

    Because you are in the critical infrastructure industry, your cybersecurity decisions don’t just affect your employees and customers. They affect people across the country, and even the world. With a zero trust approach, your organization ensures it is able to provide the services others depend on.

    Resource : https://securityintelligence.com/category/data-protection/

    16Dec, 2022
    The FBI’s Cybersecurity Program for Critical Infrastructure Was Hacked

    A hacker has breached an FBI program dedicated to critical infrastructure cybersecurity and is now selling access to its data on the dark web.

    Security blogger Brian Krebs reports that InfraGard, an information-sharing program maintained by the bureau, was compromised earlier this month by a cybercriminal who goes by the moniker “USDoD.” After swiping an internal database that contained contact information for “tens of thousands” of InfraGard members, the hacker proceeded to post its contents for sale on the dark web marketplace “Breached,” where anybody can now buy the info for $50,000. The hacker told Krebs that the high price set for the data was a negotiating tactic: “I don’t think someone will pay that price, but I have to [price it] a bit higher to [negotiate] the price that I want,” they said.

    InfraGard is an information-sharing network designed to allow high-level professionals both in and out of the government to collaborate on issues of cybersecurity and defense. InfraGard’s membership includes security pros from government agencies and major corporations and, on its website, it describes its mission like this:

    InfraGard is a partnership between the Federal Bureau of Investigation (FBI) and members of the private sector for the protection of U.S. Critical Infrastructure. Through seamless collaboration, InfraGard connects owners and operators within critical infrastructure to the FBI, to provide education, information sharing, networking, and workshops on emerging technologies and threats.

    In the field of cybersecurity, information-sharing is a popular way for institutions to help protect themselves and each other. Despite InfraGard’s stated mission, however, the FBI apparently missed the emerging threat of a hacker sifting through their network.

    “USDoD,” the hacker, claims that they gained entry to InfraGard’s protected environment by using a corporate executive’s stolen personal information. The hacker used the executive’s Social Security Number, birthday, and other info to file a phony application for inclusion in InfraGard’s membership (it’s unclear where the hacker got the exec’s info, but such data can also be purchased on the dark web). Within several weeks, the hacker’s application was accepted, apparently without much vetting by the FBI. Once granted access to the org’s internal environment, USDoD says they used a simple Python script aimed at one of the website’s Application Programming Interfaces (APIs) to call up and steal personal information on the other participating members.

    As of Tuesday evening, USDoD’s phony account was apparently still active and hadn’t yet been terminated by the FBI. Krebs reports:

    To prove they still had access to InfraGard as of publication time Tuesday evening, USDoD sent a direct note through InfraGard’s messaging system to an InfraGard member whose personal details were initially published as a teaser on the database sales thread. That InfraGard member, who is head of security at a major U.S. technology firm, confirmed receipt of USDoD’s message but asked to remain anonymous for this story.

    Whether the data that USDoD stole is actually all that valuable or not is a hanging question. Krebs writes that a lot of the accounts in the database are missing critical pieces of personal information, such as birthdays, social security numbers, and emails.

    When reached for comment by Gizmodo, InfraGard provided us with the same brief statement it had shared with Krebs: “This is an ongoing situation, and we are not able to provide any additional information at this time.”

    Resource : https://gizmodo.com/fbi-infragard-cybersecurity-hack-critical-infrastructur-1849893073