The AhnLab Security Intelligence Center discovered new infostealer distribution campaigns leveraging legitimate YouTube channels

Read More

This is a newly discovered email vulnerability:

The email your manager received and forwarded to you was something completely innocent, such as a potential customer asking a few questions. All that email was supposed to achieve was being forwarded to you. However, the moment the email appeared in your inbox, it changed. The innocent pretext disappeared and the real phishing email became visible. A phishing email you had to trust because you knew the sender and they even confirmed that they had forwarded it to you.

This attack is possible because most email clients allow CSS to be used to style HTML emails. When an email is forwarded, the position of the original email in the DOM usually changes, allowing for CSS rules to be selectively applied only when an email has been forwarded.

An attacker can use this to include elements in the email that appear or disappear depending on the context in which the email is viewed. Because they are usually invisible, only appear in certain circumstances, and can be used for all sorts of mischief, I’ll refer to these elements as kobold letters, after the elusive sprites of mythology.

I can certainly imagine the possibilities.

Read More

The content of this post is solely the responsibility of the author. AT&T does not adopt or endorse any of the views, positions, or information provided by the author in this article.

Here are some of the best SCADA protection strategies to ensure your organization’s safety.

Late last year, Pennsylvania’s Municipal Water Authority of Aliquippa (MWAA) fell victim to a sophisticated cyberattack, targeting its SCADA system at a key booster station. This station, crucial for regulating water pressure across Raccoon and Potter townships in Beaver County, experienced a temporary loss of communication, triggering an immediate investigation.

Upon closer examination, the technicians discovered a clear indication of a cyberattack: a message declaring, “You have been hacked.” This startling discovery led to the swift activation of manual control systems, ensuring that water quality and supply remained unaffected despite the breach.

The hacked device operated on a separate network, distinct from the main corporate systems. This separation helped to limit the breach’s impact and prevented it from affecting other essential parts of the infrastructure. The hackers, identified as being affiliated with an Iranian group, specifically targeted this equipment due to its Israeli-made components. This choice of target was part of a broader strategy, as similar devices are commonly used in water utility stations both in the US and internationally, hinting at the potential for more widespread attacks.

The incident drew significant attention from US legislators, who expressed concerns about the vulnerability of the nation’s critical infrastructure to such cyberattacks. The breach underscored the urgent need for enhanced cybersecurity measures across similar utilities, especially those with limited resources and exposure to international conflicts.

Investigations by the Federal Bureau of Investigation and the Pennsylvania State Police were launched to examine the specifics of the attack. The cybersecurity community pointed out that industrial control systems, like the SCADA system breached at MWAA, often have inherent security weaknesses, making them susceptible to such targeted attacks.

The following discussion on SCADA defense strategies aims to address these challenges, proposing measures to fortify these vital systems against potential cyberattacks and ensuring the security and reliability of essential public utilities.

How to Enhance SCADA System Security?

The breach at the MWAA sharply highlights the inherent vulnerabilities in SCADA systems, a crucial component of our critical infrastructure. In the wake of this incident, it’s imperative to explore robust SCADA defense strategies. These strategies are not mere recommendations but essential steps towards safeguarding our essential public utilities from similar threats.

1. Network Segmentation: This strategy involves creating ‘zones’ within the SCADA network, each with its own specific security controls. This could mean separating critical control systems from the rest of the network, or dividing a large system into smaller, more manageable segments. Segmentation often includes implementing demilitarized zones (DMZs) between the corporate and control networks. This reduces the risk of an attacker being able to move laterally across the network and access sensitive areas after breaching a less secure section.

2. Access Control and Authentication: Beyond basic measures, access control in SCADA systems should involve a comprehensive management of user privileges. This could include role-based access controls, where users are granted access rights depending on their job function, and time-based access controls, limiting access to certain times for specific users. Strong authentication methods also include biometric verification or the use of security tokens alongside traditional passwords. The goal is to create a robust barrier where access is tightly regulated and monitored.

3. Regular Updates and Patching: This strategy must be part of a wider risk management approach. Regularly updating and patching systems involves not just applying the latest fixes, but also testing these updates in a controlled environment to ensure they don’t disrupt system stability. For SCADA systems, where uptime is crucial, patches should be applied in a manner that minimizes downtime. It’s also important to have a rollback plan in case an update introduces new vulnerabilities or system incompatibilities.

4. Employee Training and Awareness: This aspect involves creating a culture of security awareness within the organization. Training programs should be regular, engaging, and tailored to different roles within the company. This might include simulated phishing exercises, workshops on recognizing social engineering tactics, and training on the specific types of threats that target SCADA systems. The goal is to ensure that employees are not just aware of the protocols but are also invested in the security of the system.

5. Vulnerability Assessments and Penetration Testing: Regular assessments should include both automated scanning for known vulnerabilities and manual testing to uncover unknown weaknesses. Penetration testing, on the other hand, involves simulating a cyberattack under controlled conditions to test the system’s resilience. This should be done by experienced professionals who can mimic the tactics and techniques of real-world attackers. This approach helps in understanding not just where the vulnerabilities are, but also how an attacker might exploit them and how the system would respond.

6. Data Encryption: Encryption should be implemented using advanced algorithms and should encompass all data relevant to the SCADA system. This includes operational data, logs, and any communication between devices and control centers. Implementing end-to-end encryption ensures data integrity and confidentiality, especially when transmitted over potentially insecure networks. It’s also vital to manage encryption keys securely, ensuring they are stored and handled with the same level of security as the data they protect.

7. Firewalls and Intrusion Detection Systems (IDS): Firewalls for SCADA systems should be more than just standard corporate firewalls; they should be able to handle the unique types of traffic and protocols used in industrial control systems. Similarly, IDS should be tailored to recognize the specific patterns and anomalies that indicate a cyber threat in a SCADA environment. This should include the integration of behavior-based detection systems, which can identify unusual activities that signify a potential breach or malicious activity.

8. Regular Security Audits and Assessments: These should be conducted both internally and by third-party experts to ensure objectivity and thoroughness. Audits should include a review of all policies and procedures, physical security measures, user access levels, and network architecture. Security assessments can also include penetration testing and red team exercises to simulate real-world attack scenarios. The findings should lead to actionable insights and continuous improvement in the security posture.

9. Incident Response Plan: A comprehensive incident response plan for a SCADA system should include specific procedures for different types of incidents, clear roles and responsibilities, and communication strategies for internal and external stakeholders. Regular drills and simulations of cyberattack scenarios should be conducted to ensure readiness. The plan should also include procedures for forensic analysis to understand the attack vector and to prevent future incidents.

10. Compliance with Industry Standards and Regulations: This involves staying abreast of and complying with standards like NERC CIP, ISA/IEC 62443, and others relevant to SCADA systems. Compliance ensures a baseline of security, but organizations should strive to exceed these standards when possible. Regular compliance status reviews, including gap analysis against the latest standards and regulatory requirements, help ensure that SCADA systems are compliant and following the best security practices.

SCADA Security is an Ongoing Process

Implementing the strategies discussed—from network segmentation and rigorous access control to regular security audits and compliance with industry standards—represents a significant step forward in safeguarding SCADA systems. However, it’s important to recognize that cybersecurity is not a one-time effort but an ongoing process of adaptation and learning. As technology advances and threat landscapes change, so must our strategies and defenses. Organizations managing SCADA systems must stay informed about the latest threats and innovations in cybersecurity. Collaboration across sectors, sharing of best practices, and learning from incidents like the MWAA breach are essential in this dynamic environment.

Read More

Research from Ayden and the CEBR found that 35% of UK retailers fell victim to fraudulent activity, cyber-attacks or data leaks over the past 12 months

Read More