How much can delaying a cyber threat assessment cost your business?

Between cyber-criminal groups, Lazarus (North Korea), Conti (Russia), and Mustang Panda (China), almost every business in every sector is on the radar of hackers. Because of geopolitical and economic reasons, these groups have stepped up their scanning and target acquisition activities in the last 4 weeks. Though evidence of collaboration is scant, there is some evidence to indicate that at least two of these groups have exchanged a list of targets in the past. So what have we got to worry about? Targeted attacks on OT networks are rising and depending on who is attacking, the motivation could be anything from ransom, disruption, elimination of competition, or even training Oil and gas facilities have been successfully targeted in the last two months and the ransom that came from these attacks has fueled a new wave of attacks by Conti (including the launch of a new multi-loader malware that was released early) While Lazarus is primarily targeting the financial services sector, it could switch to attacking manufacturing units and other critical or large chemical processing units for ransom Most attacks are based on spear-phishing using specific messaging By targeting oil and gas and manufacturing, the hackers are also trying to destabilize economies and large supply chains Even without these events, 2022 has been a tough year for CISOs with Cyber threat assessment for IT, OT, and IoT is the need of the hour Most businesses are not conducting security audits frequently enough. They are also not investing adequately in ramping up their security posture to cover new and emerging threats. The reason for this is simple. These businesses are not conducting enough threat assessment runs to understand internal and external threats and vulnerabilities they are exposed to. This makes such threats and vulnerabilities invisible to them and these businesses continue operations on a BAU mode while the threats multiply and grow in sophistication and potential impact. A threat assessment exercise when done in the right way at the right time could save millions in revenue, downtime avoided, and loss of market share due to delays in production and shipment of products. what are the components of a good threat assessment program? Frequency: calendarize the exercise so that the exercise is taken up periodically and frequently Coverage: cover the infrastructure as a whole including devices, networks, HMI units, SCADA systems, data platforms, and everything connected. It should also cover access privileges and any and all components including, if possible, assets that are not yet added but will be in the short term Methodology and framework: threat assessment should not be aligned to compliance objectives alone. Instead, it should also take into account all operational sources of risk, threat surfaces, and all infrastructure components. The core framework should be flexible enough to incorporate any changes in operations and the methodology should ideally be unique to your business keeping the parameters mentioned above in mind. It is advisable to build a unique methodology and framework for your threat assessment program Be clear about the objectives and outcomes. Also, a threat assessment program that doesn’t have an action plan for improving security is as good as a non-existent one Working with a cyber threat assessment partner like Sectrio can improve the outcomes and shrink the learning curve. Sectrio will build a unique framework and method for you from the ground up and conduct the exercise as well. Benefits of Sectrio’s threat assessment program: Get a comprehensive report on your cybersecurity posture including all threats, risks, vulnerabilities, misconfigurations, exposed threat surfaces, and entry points for threats Prioritize top threats so that you can avoid straining your resources while addressing the threats Action plan and roadmap to address the challenges and scale to the next level of security Rating on how your existing security posture compares with your threat environment Impact assessment for key risks, vulnerabilities Enhance maturity level of IT operations and improve data security Try our threat intelligence feeds for free for the next two weeks. Get access to enriched IoT-focused cyber threat intelligence for free for 15 days Book a demo now to see our IT, OT, and IoT security solution in action: Request a Demo

How much can delaying a cyber threat assessment cost your business? Read More »

Complete Guide to Cyber Threat Intelligence Feeds

Cyber Security, Threat Intelligence / Abhay S K

Cyber Threat Intelligence [CTI] Feeds – The devil is in the details Whether your firm is looking for a cybersecurity vendor to meet your needs or your employees are undergoing a training program, it is important to understand how cyber Threat Intelligence Feeds form the backbone of a cybersecurity action plan. So what are these threat intelligence feeds? Before that, let us understand what ‘threat intelligence’ is. In layman’s terms, threat intelligence can be defined as any data that helps in a better understanding of the cyber landscape and various threats associated with it. CTI feeds comprise data coming from a wide range of IoC (indicators of compromise) feeds like: The continuous stream of data from these feeds helps us understand the current state of the network, threats, and risks associated with it, and document various IoCs (Indicators of Compromise). It is these feeds that the SOC (Security Operation Center) continuously monitors and uses to identify any infiltrations, attempts, and attacks on the systems and the networks. With time and proper data evaluation, cyber threat intelligence feeds can be used to develop strategies to counter-attack cyber threats and understand hacker tactics, procedures, and techniques. In the due course of this blog post, we shall learn more about types, evaluation, features, benefits, and a lot more about cyber threat intelligence feeds. Types of Threat Intelligence Feeds – Data that forms the bricks Cyber threat intelligence feeds can be briefly classified into 4 types: While many choose to only list the top three, the ‘Technical Intelligence Feed’ plays a critical role if your cybersecurity vendor is serious about protecting your systems and network. 1. Strategic Threat Intelligence Feed: Often dubbed as a high-level intelligence feed, the Strategic TIF helps in understanding why a certain attack is carried out by the threat actors. Non-technical in nature, it is usually served to the c-suite of the company, helping them to better understand the reasons and intentions behind an attack. Analysts outside the cybersecurity field are often engaged to give a holistic perspective of the cyber-attack. Many cybersecurity experts believe that Strategic TIF can impact the high-level business decision makings of a company. Common sources for Strategic TIF include the following: Though the final product is non-technical, researchers and analysts go through tons of data, putting it through hundreds of analyses to suggest effective strategic intelligence. 2. Tactical Threat Intelligence Feed: Simply put, the Tactical TIF deals with the TTP (Tactics, Techniques, and Procedures) of the attackers. Often consumed by Network Operations Center (NOC) employees, Security Operations Center (SOC) employees, IT service managers, and cybersecurity architects, this type of cyber threat intelligence feeds help in analyzing the various tactics, techniques, and procedures deployed by the threat actors. These feeds comprise, but are not limited to human intelligence, data on malware attacks, cross-industry cybersecurity statistics, incident and attack reports, and other threat-related data. Using this data, a comprehensive process involving patching vulnerable systems, changing security merchandise, and improving defense mechanisms is carried out. 3. Operational Threat Intelligence Feed: The notion: “Perception without Conception is blind; Conception without Perception is empty”, is true when it comes to analyzing threats and risks of cyberspace. Without a proper context that involves the nature of the attack, type, timing, intent, and level of sophistication, it is difficult to arrive at a logical perception of how to protect key assets like data and infrastructure. Often experienced hackers and hacking groups interact in private chat rooms and away from analysts and security experts scouting the web. The researchers must keep track of online events, campaigns, and other cyber-attacks to find more valuable intelligence on hackers and their methods. Researchers and cybersecurity experts often face the problem of CAN: 4. Technical Threat Intelligence Feed: Despite its shorter period, the Technical TIF provides key insights into the tools, resources, and other variables a threat attacker has used. Often limited to a specific IoC (incident of compromise), the Technical TIF includes control channels, tools, command channels, IP addresses, hack checksum of malware, phishing email headers, and other technical data. Understanding and applying proper analysis to this feed helps in rapid response to threats. The Technical TIF is consumed by Incident Response and the Security Operation Center (SOC) teams. Most of this feed is read using a Machine Learning program and is fed directly into security systems and other installations. This helps in preventing many threats at their very source promptly. Evaluation of Threat Intelligence Feeds – The Lens that adds context to data! Cyber threat intelligence feeds truly provide critical information that can help companies mitigate cyber-attacks. But how does one evaluate a particular feed? Usually, the feeds come from internal and external intelligence: 1. Internal Intelligence 2. External Intelligence Evaluating the threat intelligence feed: Without adding context, cyber threat intelligence feeds are nothing but a bunch of data outputs. Context brings the intelligence from the feed. But how do we add one? What are the factors that we need to look at while evaluating a threat intelligence feed? Let’s learn. 1. Timely detection When it comes to cybersecurity, every second is critical during a cyber-attack. The faster a threat is identified, the greater can be the damage control. Even in the case of a threat intelligence feed, a real-time feed is priceless. It can often prevent many cyber-attacks. But currently, according to a survey from 24 cyber threat intelligence feeds and analyzing data of over 1.3 million indicators, the average delay was reported to be 21 days. Surprisingly, 56% of participants in a survey felt that threat intelligence becomes stale within a few minutes, and even seconds at times. Despite that, the participants saw it as a parameter that builds the reputation of the source. This no way means intelligence, and companies should keenly monitor for such false promises by their CTI feed providers. 2. Geographical Location Many CTI feeds show a strong bias towards a particular nation or a particular geographic region. Everyone knows that a threat actor sitting in Latin America can

Complete Guide to Cyber Threat Intelligence Feeds Read More »

How to avoid common cyber threat assessment pitfalls

Cyber Security / Abhay S K

When it comes to drawing up a proactive plan to secure infrastructure, a threat assessment drive can go a long way. In addition to helping understand the sources and gravity of individual threats, it can also sensitize all stakeholders on various security aspects and help organizations understand and address specific and generic threats. However, due to some inherent deficiencies, the full value of an institutional cyber threat assessment program is not realized by many enterprises who chose to conduct such an assessment program. What are these deficiencies and how can they be addressed, read on to find out. Deficiency one: wrong or outdated cyber threat assessment model In our interactions with CISOs across manufacturing, utilities, maritime, oil and gas, and financial services sectors, we found that many businesses were relying on models that were primate and not suited to the emergent threats that are now dominating the threat landscape. These models were often borrowed from their peers in the industry and have been passed down from one generation of cybersecurity leaders to another across decades in some instances. Remedy: work with a vendor or internal security operations team to prepare a model that is specific to your business. Deficiency two: lack of unit-level assessment Even today, many businesses conduct threat assessment at an infrastructure/enterprise level rather than go a few notches lower to assess threats at an equipment or transaction level. Based on the family of devices, communication protocols, supply chain characteristics, device profile, digital footprint, and many other parameters, each device could face a multitude of threats. Further, networks face a series of threats that could be unique to various network characteristics. Without taking these into account, an IoT, IT, or OT threat assessment exercise will not present sufficient actionable data that can reduce your risk exposure. Remedy: prepare an inventory of all devices and networks before embarking on a threat assessment exercise. This is especially true for OT-based infrastructures where device inventories are often outdated or do not exist. Also Read: Why IoT Security is important in today’s network? Deficiency three: low frequency of assessment In IoT and OT environments connected with critical infrastructure, threat assessments should be conducted at least once a month to identify and track new risks and threats and plug any vulnerabilities or security posture-related gaps that may arise. Remedy: calendarize and conduct threat assessments as frequently as possible. Deficiency four: compliance-driven threat assessment agenda Often businesses conduct threat assessment drives due to external factors such as audits, compliance needs, or pressure from the board or senior leadership. Sometimes threat assessments are conducted as a knee-jerk reaction to an advisory from a regulator as well. This leads to the threat assessment exercise being treated as an ad-hoc effort with no long-term view or focus. Remedy: conduct threat assessments as a calendarized activity. The agenda should be specific to the risk exposure management needs of the business that is conducting it. Compliance Kit: IoT and OT cybersecurity self-assessment tool using NIST CSF Deficiency five: lack of skilled cybersecurity threat assessment experts As threat assessment is often not seen as a core activity, the work is assigned to team members who have to learn on the job. No additional training is imparted and such team members are often made to handle threat assessments along with their other responsibilities. Remedy: allocate specific threat assessment responsibilities to team members and train them to do it professionally with diligence. Such members should also be made to undergo threat assessment certifications and act independently while making honest threat assessment recommendations. Deficiency six: lack of integration (or synergy) with the overall cybersecurity roadmap Since most businesses conduct a threat assessment exercise in an ad hoc manner, its findings or frequency, or even the objectives are not synchronized with the institutional risk management priorities. This leaves a wide gap in implementing the findings of the threat assessment exercise which are sometimes not even implemented. Remedy: integrate the threat assessment exercise with the overall risk management program using incremental steps. Never conduct a threat assessment exercise in isolation as that will simply erode the benefits that your institution could gain from such an effort Wish to know how to turbocharge your threat assessment programs to improve your institutional threat hunting and cyber risk management efforts? Talk to Sectrio. We have assisted businesses across verticals such as manufacturing, oil and gas, maritime, banking, supply chain, and pharmaceutical manufacturing to evolve and run comprehensive and beneficial threat assessment programs. Talk to us now. Wish to talk to our threat assessment specialists for more information? Share your details here. Try our threat intelligence feeds for free for 15 days to see what your threat hunting program is missing here: Sign up for FREE threat intelligence feeds Learn more about our threat assessment methodology here: OT and IoT Threat Assessment Book a demo now to see our IT, OT and IoT security solution in action: Request a Demo Try our threat intelligence feeds for free for the next two weeks. Get access to enriched IoT-focused cyber threat intelligence for free for 15 days

How to avoid common cyber threat assessment pitfalls Read More »

How to Maximize the Cybersecurity Budgets & Show the ROI on Spends

Leave a Comment / Cyber Security / Abhay S K

US Cybersecurity budget proposal stands at $10.9B (FY2023), while cybercriminals made $6 trillion in 2021 One can decipher the importance of cybersecurity and at the same notice the bridge between spending and losing in that stat. A quantum future is already in the making, and tech giants are already in the race. One research estimate put quantum computers to be a million times faster than classical computers. Such great computing power can reform the way we see and interact with technology. To be a part of such an experience, one needs to rethink cybersecurity, novel threats, and challenges posed in the ever-increasing digital space. Every enterprise, irrespective of its size and nature, allocates a certain chunk of its IT budget toward cybersecurity. These figures roughly land anywhere between 2% to 10.7% or just around 0.2% to 0.9% of their revenue. This roughly equals the (proposed) US Cybersecurity budget – around 0.45% of their GDP. In a space where black hats (criminal hackers) are intimidating even the top tech giants, one has to reassess their Cybersecurity budget, and simultaneously look after cybersecurity budget optimization to achieve the best price to performance ratio. Does your Cybersecurity budget address these key areas? A cybersecurity budget breakdown should be able to define a company’s viewpoint and direction in adopting cybersecurity practices. Our experts at Sectrio curated the four areas, where you should exclusively focus upon: 1. Reactive vs Proactive The first and the most vital step in cybersecurity is being proactive, and not reactive. By the time a security breach is discovered and acted upon, the enterprise might end up losing credibility, business, and reputation. Many enterprises only work on implementing preventive measures and miss upon securing critical data and infrastructure. A proactive approach includes building cybersecurity from a hacker’s point of view and trying to penetrate the systems. An enterprise can hire blue/red hat experts to carry out penetration exercises and ramp up its cybersecurity. Also Read: Why IoT Security is important in today’s networks? 2. Leveraging SOAR technologies SOAR (Security Orchestration, Automation, and Response) technologies may not be coming at takeaway prices, but surely their ROI can justify their costs. The in-house cybersecurity team is often overwhelmed by the quantum of alerts thrown up by security systems. Collecting, assessing, and identifying false positives is a herculean task for the security team. Where speed and efficiency are vital, these challenges can be daunting. This is where SOAR technologies help in building automated responses to low-level threats. This leaves the cybersecurity teams more time to work on tasks that require human intervention and deeper analysis. 3. Protection of infrastructure & data In a digital space, data is the key to success. Protecting every bit of that data is vital to an enterprise’s success. The following should be a part of every company’s annual cybersecurity budget breakdown: Detection tools, micro-segmentation, and encryption technologies Network monitoring solutions – Intrusion prevention systems, intrusion detection systems, web scanners, and packet sniffers Secure Email gateways to counter phishing and social engineering attacks Access and authentication technologies Robust data protection plan – Data sharing, tracking, portability, and breach notification Regular data backup and replication – This protects against data loss during ransomware attacks 4. Improving cybersecurity culture Cybersecurity is not only the cybersecurity team’s job but everyone’s. Awareness programs, skill development, basic identification and reporting, and security awareness training should be a part of the cybersecurity budget of any enterprise. This prevents a considerable number of phishing cyber-attacks. What is Cybersecurity budget optimization? Everything needs to be optimized. Your phone battery, your hard disk memory, your grocery budget, and even the nation’s budget. Similarly, even a company requires a thorough cybersecurity budget optimization to make the best use of the resources available. It is of utmost significance that a company knows where it is overspending, underspending, and where it needs to be spent optimum. This helps in minimizing costs escalating due to unnecessary or otherwise unimportant factors and spending more on areas that require time and value. Maybe you are overspending here! Our experts have decoded the four areas of overspending from a company’s typical cybersecurity budget breakdown. Make sure you address the following four areas to curb your overspending: 1. Handling Technology bloat In a company driven by technology, it is apparent that applications bloat over time. While few of them might be important, many of them can be simply pulled out of the regular workflow. Doing so will reduce time and money. Companies should deploy Technology Rationalization periodically to assess and eliminate tools and applications deemed unnecessary. 2. Legacy Systems Running processes on legacy systems is one area many enterprises are stuck with. While the individual costs don’t pop up in the annual balance sheets, these costs compound with time and become start bruising before one realizes it. It is best advised to move to modern IT infrastructure that gives better cybersecurity support. 3. Protecting all data equally Data type and nature vary greatly. While personal identification details, credit card numbers, and phone numbers can be very sensitive, policy documents and other in-house documents hardly have value. Depending on the type and nature of the data, protection tools must be deployed. This helps in bringing down the costs by a large margin with time. 4. Traditional Preventive Tools Hackers find novel ways to leverage the latest technology and tools to intrude into a system. Deploying heavy traditional tools may not be the right way to go ahead in the future. A thorough risk assessment can help in identifying the high likelihood of the type of risks and deploy cloud-based solutions accordingly. How to optimize your Cybersecurity budget? Spending more does not mean more protection. Only when you spend wisely, your protection improves. It is vital to know where to focus and how to prioritize spending across various aspects. 1. Technology that serves your purpose need not be the best More often than not, most hackers try to gain access to your enterprise’s network for financial gain.

How to Maximize the Cybersecurity Budgets & Show the ROI on Spends Read More »

Understanding the implications of OTCC-1: 2022 for your business

OT, ICS / Abhay S K

The National Cyber Security Authority of Saudi Arabia recently issued the “Cyber Security Controls Document for Operational Systems (OTCC-1:2022)”. This document aims at enabling sensitive industrial facilities, critical infrastructure, private businesses, and government agencies to adopt best practices and standards to ensure the security of operations at all times. Specifically, (OTCC-1:2022) has been developed to increase the level of cyber protection accorded to OT/ICS environments in view of the rising attacks on OT and OT-linked infrastructure and networks. What do you need to look out for in the NCA’s OTCC-1:2022? According to the authority, the document outlines the approved controls for operational systems to help them align towards reducing the cyber risks to operational technology-based systems. The document aims to raise the bar as far as cybersecurity is concerned to ensure that the businesses and entities concerned enforce minimum requirements for protection and follow them up by extending basic cybersecurity controls to improve risk management. As per the accompanying mandate issued by the NCA, these controls must be implemented as an extension to NCA’s Essential Cybersecurity Controls (ECC-1: 2018) issued earlier. The term Industrial Control Systems (ICS) includes all devices, systems, or networks used to operate and/or automate industrial processes. The issuance of these controls comes within the authority’s mandate to set policies, governance mechanisms, frameworks, standards, controls, and guidelines related to cyber security in the Kingdom and based on its role in regulating and protecting cyberspace, and seeking to promote and protect vital interests and sensitive national infrastructures by enhancing cyber security for operational systems at the national level. To comply with the requirements suggested by the document, businesses and agencies should: Rise the level of baseline protection accorded to OT systems Invest in continually improving security measures Revisit risk management measures to align them with emerging cyber threats Expand the scope of basic security controls as a follow-up to point 1 Identify security gaps and work towards addressing them to improve the overall security posture Implications of OTCC-1: 2022 for your business OTCC-1:2022 has multiple implications for your business. From the data layer up to cloud ingress, underlying controls, first response mechanisms, and back-ups, a streamlined effort is needed to comply with this mandate and to ensure the minimization of your institutional risk exposure. Sectrio is a leading provider of IoT, OT, IT cybersecurity solutions, and threat intelligence. Our proven expertise can help your business in meeting its compliance mandates and infrastructure protection needs. Sectrio’s cybersecurity experts can help you draw a roadmap to comply with this OTCC-1:2022 and to improve your risk management measures to contain and mitigate threats. Speak to our experts now to initiate your threat assessment and mitigation journey. Talk to us about the simplified approach to OT security that minimizes your institutional risk exposure significantly. Worried about not having the right threat intelligence for improving your SecOps? Talk to us to try our threat intelligence feeds for free for the next two weeks. Participate in the CISO Peer Survey 2022 and make your opinion count now, fill up our uniquely designed survey here: CISO Peer Survey 2022 Book a demo now to see our IT, OT and IoT security solution in action: Request a Demo Try our threat intelligence feeds for free for the next two weeks. Get access to enriched IoT-focused cyber threat intelligence for free for 15 days

Understanding the implications of OTCC-1: 2022 for your business Read More »

Is India up for a major cybersecurity overhaul?

Leave a Comment / Compliance, Cyber Security / Abhay S K

Cyberattacks in India continue to grow at an alarming rate with each passing week and various quarters have called for a complete revamp of India’s cyber defense posture to not only reduce the impact of these attacks but also to send a strong message to the groups that are behind these attacks. However, such an approach begs the question. Will a single piece of legislation or mandate change things on the ground? Or does India need to look at multiple options? This article sheds light on the following questions: Cyberattack trends in India 2022 Why do cyberattacks in India continue to grow at an alarming rate? Why is India in need of a major cybersecurity overhaul in 2022? Will the Digital India program only remain as a vision? How can India strengthen its cyber defensive capabilities? The 6-hour cyber incident reporting rules The Summary – Getting down to brass tacks Cyberattack trends in India 2022 To understand why India is in dire need of a major cybersecurity overhaul, we need to first analyze the trends of cyberattacks from the past and be prepared to defend networks from any new and emerging threats. In the larger scheme of things, while dealing with cyberattacks, it’s always a wise decision to operate with an accurate assessment of the cyber threat landscape through cyber threat intelligence (CTI). Now, let’s get started with the highest priority and work our way down the pecking order. To get started, Critical infrastructure is the backbone of a nation’s economy. In this case, Critical infrastructure in India is a vital operating organ of a nation that is currently in the middle of a massive digital makeover AKA transformation. Although the definition of critical infrastructure is wildly subject to change and often mistaken, here is a quick graph of what constitutes a part of the critical infrastructure. If you are now familiar with it, we can proceed to how the trends in cyberattacks impacting this sector have grown significantly. Getting down to the numbers. The attacks on critical infrastructure segments grew significantly by almost 70% in 2021 (Sectrio’s Global Threat Landscape 2022) when compared to the previous year. While the impact of the pandemic accelerated the growth and use of more technology, it also led to a staggering rise in the number of cyber-attacks and sophisticated threat actors which resulted in stealthy ransomware attacks, halts, or disruptions in vital operations, and reputation damage via data leaks. While rapid shifts and tactical attacks on critical infrastructure can be overwhelming and difficult for one to grasp, one sector faced the brunt of such cyberattacks and bad threat actors. The manufacturing sector faced a record number of cyberattacks, a massive 101% rise in cyberattacks, targeting Industrial control systems (ICS), SCDA, PLCs, SIS systems, operational technology (OT), and in some cases even connected IoT devices such as printers, Internet connect Uninterrupted Power Supply (UPS) were compromised and became a beacon for lateral movement of malwares across networks. Smart cities in India also witnessed a spike of 20% in 2021 when compared to the previous year. This included attacks on Oil and Gas plants and power grids and substations. In fairness, the overall number when compared to the previous year was a whopping 290%, the highest spike recorded to this date in India. Source: The global threat landscape analysis and assessment report. In 2022, India could effectively come close to beating the United States in the number of cyberattacks considering the escalating geopolitical tensions in Europe. We expect a plague of sophisticated malwares, exploiting vulnerabilities at sight, regardless of a particular target in mind. A lowered threshold of state-backed actors is once again a growing concern in the days to come. Why cyberattacks in India continue to grow? There are plenty of motives behind a cyberattack or even none as a matter of fact, in some cases. But quantifying it in terms of weaknesses or flaws in a system open for exploitation is the right way. To touch base on a few prominent vulnerabilities that exist from what we have seen in the past are: Not Patching known vulnerabilities / Delayed process of patching vulnerabilities Lack or no practice of network segmentation and micro-segmentation Most compliance regulations often come across as advisories rather than mandatory requirements. Lack of visibility into the networks (no traffic Logs/ Inventorized data on network-connected assets) Lack of initiatives to bring awareness to the cyber threats that plague the environment. In actuality, the list is quite long. If we were to go digging down the list of CVEs and other challenges like the ones that are not yet identified (Zero-day vulnerabilities) we are expecting multifold cascading cyberattacks. In addition to the above, another reason why cyberattacks will continue to rise significantly is that the number of dark web users has also risen by quite a large volume. This means that most APT groups often dump cyberattack kits, and tutorial videos that are available for anyone to access (Some even as cheap as $5), and in some cases they are restricted to certain groups of people. Such access to information in making a quick buck often draws significant attention and is followed through by clusters of cyberattacks via budding threat actors gaining traction to take on bigger targets. Such attempts also make it difficult for forensic teams to pinpoint particular actors responsible for the attacks. Participate now: CISO Peer Survey 2022 Another factor we must not ignore is India and its geopolitical ties with other nations. India is familiar with attacks originating from neighboring countries in the past but is new to cyberattacks with heightened sophistication while bearing numerous attack surfaces with the potential to send the country into the dark ages. While India plays a strategic role on many accounts at an international level enabling spotlight and partnerships it also paints a sweet large target for geopolitical threat actors to get through. Why does India need a major cybersecurity overhaul in 2022? India needs a major cybersecurity overhaul

Is India up for a major cybersecurity overhaul? Read More »

Long ignored UPS vulnerabilities are coming to roost: CISA and DoE

Cyber Security, IoT / Abhay S K

In a recent update, CISA and DoE (Department of Energy) jointly acknowledged the rising trend of cyberattacks and raised a concern over vulnerabilities associated with internet-connected UPS (Uninterruptible Power Supply) systems. This alert comes in light of the recent growth of cyberattacks targeting critical infrastructure not only in the United States but across countries that play a strategic role in various military and non-military geopolitical alliances. The alert raises concerns in the following areas: UPS systems are vulnerable to attacks when connected to unsafe networks Most UPS systems connected to the internet have little to no security on the cyber front. Out of the box, these systems come with default usernames and passwords and in most cases, the default credentials are unchanged for years after installation. In large organizations UPS systems bought in bulk often have the same login credentials across each installation to access them. Read more from the report here: Mitigating Attacks Against Uninterruptable Power Supply Devices Dependable, reliable, and omnipresent energy aid Uninterruptible power supply (UPS) has been a boon to humanity even before the dawn of the age of computers. In most cases, these systems are used to provide clean and emergency power supply in times of power outages or to regulate the surges in the flow of electricity. Also Read: Is NIST working on a potential cybersecurity framework update? In the early days, the UPS systems were often connected to critical industrial machines to prevent any occurrence of unsafe shutdowns or the breakdown of such machines due to surges in electrical power. In fairness, UPS has been a constant source of reliable and safe energy in times of desperate need. With the growth and the rise of digitalization, UPS was later introduced widely for consumer use and thus began its rise in popularity. Significant upgrades and advancements to UPS systems later followed in its evolution to provide vital insights into the networks and connected equipment. Such UPS systems now come with the ability to connect to the internet, provide vital insights into monitoring any surges in a steady stream of power, remind concerned authorities of timely maintenance, and much more. These internet-connected UPS systems are also actively in use by several healthcare (IoT sensors, IoMT equipment), manufacturers (OT, ICS, SCADA equipment), pharmaceuticals (OT and ICS equipment), enterprises (backups to servers), and other critical infrastructure industries while providing a steady flow of safe and uninterrupted energy during vital organizational operations. Also Read: Why IoT Security is Important for Today’s Networks? This growth of IoT or the internet-connected UPS systems has also become a critical component when integrated with network and poses grave cyberthreats when overlooked for its availability for functional operations. Potential casualties incurred by a successful cyberattack on internet-connected UPS systems. Manipulation of data on IoMT or denial of service on vital healthcare equipment Sensor manipulations Disabling the Automatic voltage regulation (AVR) Destruction via a surge in power supply Denial of service on enterprise servers Malware injection Lateral movement via a compromised network can lead to data leakage Privileged escalation It is hence established that internet-connected UPS plays a critical role. What can be done to secure internet-connected UPS? While the CISA and the DoE suggest regular and timely updates of software and the use of MFA as immediate steps, we at Sectrio, suggest all take a step back and follow these steps. Have ample visibility into your network, be it even a remote or a hearing aid that is connected to your network. Monitor for anomalies on the network Log network activities Segment your network into zones and conduits. Also read: How micro segmentation can help secure your connected assets. Use of MFA and strong passwords Use of safe VPN Regular vulnerability scans to identify gaps in security Compliance with IEC 62443, Zero Trust, and NIST CSF Working with real-time threat intelligence Reporting of cyber incidents or suspected incidents as quickly as possible to the right authorities. Will cyberthreats ever stop? On March 29th, 2022, a statement made before the House Judiciary Committee by the FBI cyber division stated that “As adversaries become more sophisticated and stealthier, we are most concerned about our ability to detect and warn about specific cyber operations against U.S. organizations. Maybe most worrisome is their focus on compromising U.S. critical infrastructure, especially during a crisis”. This official statement by the FBI’s cyber division brings perspective on the state of cybersecurity in North America and is an alarming wake-up call to all organizations for immediate cybersecurity revamp into their ever-growing converged cyber environment. For more information on the evolving threat landscape and insights into emerging cyberattacks and bad actors, read our latest IoT and OT threat landscape assessment report 2022Learn how Sectrio’s solutions can help secure your organizations today. Reach out to our cybersecurity experts to get started now. Join our upcoming webinar: Key Takeaways from the Sectrio’s Global Threat Landscape Assessment Report 2022 IoT and OT focused threat Intelligence feeds free for 15 days! Try it right now: Threat Intelligence

Long ignored UPS vulnerabilities are coming to roost: CISA and DoE Read More »

Rising threats on Critical Infrastructure amidst the Ukraine crisis

Cyber Security, ICS, IoT, OT / Abhay S K

IoT, ICS, and OT security should be your highest priority if you are a professional working in at least one of the sixteen critical infrastructure sectors. The United States of America is currently on high alert after issuing joint advisory from 4 different agencies for 3 different countries, A cautionary alert on attempts of rising ransomware attacks, and the latest alert raised by CISA on February 14th, 2022, warning all businesses – small, mid-sized and enterprises to stay on their guard (“shields up”). On the 26th of February two days following the official announcement by the Russian president indicating his intentions with Ukraine, the Department of Justice (DOJ and Cybersecurity and Infrastructure Security Agency (CISA) jointly issued a cybersecurity advisory of two destructive malwares known as WhisperGate and HermeticWiper that are currently being used to target organizations in Ukraine and Europe. Counties in North America, the Middle East, and the Asia Pacific have been facing persistent cyber-attacks for a long time and in light of the escalating Ukraine crises and geopolitical tensions, the number of cyberattacks continues to grow significantly. Considering an added layer of involvement of certain countries in the Russia – Ukraine Crisis, we have analyzed a few key attack surfaces in critical infrastructure that are easily targeted. This includes: Exploiting existing vulnerabilities Stealthy reconnaissance attacks Persistent attacks by Botnets Sophisticated APT on Critical Infrastructure sectors Ransomware attacks on businesses regardless of size Why will such cyberattacks continue to rise amidst the Ukraine crisis? This is a question you already know the answer to. A long-drawn battle against an old enemy has continued since the culmination of the cold war but this time it’s online, a hybrid tactical cyber warfare where the enemy has proven to have the added advantage of the necessary skillset from attacks in the past. Kudos to you if you guessed the country we are talking about right. For others, it’s Russia. In the past and the digital era, Russia has extensively leveraged tactical methods of cyber warfare to add additional pressure. Disruptions or permanent damage be it a cryptic lock via ransomwares, damage to health and safety by disabling SIS systems, or even a complete system override and shut down in critical infrastructure operations of energy sectors and telecommunications. Such attempts in the past have proven to be effective in swaying and accelerating decisions of a nation’s government, military, and even the general population, which fits the Russian agenda. Such events stay hidden from the limelight as most don’t want to admit to a security failure or the lack of security measures. With attacks brazenly targeted regardless of your size or affiliations, all organizations globally must realize the looming threat and take immediate actions to safeguard themselves. As immediate steps, here are a few steps you can take to safeguard from cyberattacks: Enable multi-factor authentication (MFA) org-wide and ensure that passwords are reset frequently Ensure that softwares used org-wide is updated with the latest security patches available. Doing this prevents lateral movement of malwares Conduct rigorous and regular vulnerability audits and drills to identify gaps in your security Raise awareness with your immediate clients and partners to heighten security measures as risks of chain attacks have been witnessed in the past. Such as the infamous SolarWinds attack Complete visibility on your network, logging the devices that are connected, and are actively using your network Monitor any abnormal functions of the devices connected to your network and raise immediate red flags for immediate investigation. Segment your network and comply with industrial compliance mandates. Read more about Sectrio’s Microsegmentaion module. Re-check/rework your remediation and mitigation playbooks to ensure that you are taking an updated approach during an incident. Isolate traffic from unverified sources that are deemed suspicious for a deep monitoring Build and assign resources to incident response teams. Ensure that your resources and SOC teams are not fatigued from overworking Build substitute teams if you are not functional at an optimal level. Ensure that you comply with compliance regulations such as NIST CSF, IEC 62443, Zero Trust framework, and other compliance mandates that apply to you. Head over to the compliance kits section on the website to get started Self-assess your preparedness for a cyber incident, conduct mock drills Working with actionable threat intelligence that can help you assess your cyber threat landscape If you do not have access to threat intelligence feeds, do not trust OSINT as they can often mislead your teams. Go for a credible and trusted source. Read the CISO guide in selecting the right threat intelligence vendor if you are unsure of what is best for your organization Subscribe to the latest updates from trust sources that you can rely on. Sectrio is currently offering free weekly subscriptions to key personnel that opts in Working with a small cybersecurity budget can be extremely difficult. Not all organizations get the same budget as industrial leaders. Leverage the threat landscape reports to bring awareness to the organization for a higher cybersecurity budget. Read our guide in deriving a higher cybersecurity budget to improve value ROI Understand organizational dynamics and align your goals for a secure environment Understand complexities involved in the integration of IT-IoT and OT technology as each brings its own challenges Organizations undergoing a digital transformation must take extra precautions and is often better to opt-in for a security tool that can provide you with the necessary visibility, detailed analysis without overburdening your SecOps teams with branded jargon when it comes to dealing with the convergence of technologies Always document and log changes to the system, this will help you in forensic analysis and identifying gaps These 20+ point guidelines will help you get headed in the right direction for improved resilience and cyber vigilance. Why the escalating Ukraine crisis can be a new frontier for APT actors? In the past, we have witnessed APTs with ties to Russia, and other countries inflicting maximum damage by exploiting known vulnerabilities using spear-phishing attacks, brute force, and sophisticated malwares Such

Rising threats on Critical Infrastructure amidst the Ukraine crisis Read More »

By Industry

By Compliance

Business Needs

Services

Contact Us