Cybersecurity considerations and recommendations for securing distributed energy resources on power grids

Cyber Security, Utilities / vikas.karunakaran

A recent report prepared by the U.S. Department of Energy’s Office of Cybersecurity, Energy Security, and Emergency Response and the Office of Energy Efficiency and Renewable Energy highlights the cybersecurity considerations to be taken into account for distributed energy resources (DER), such as solar, storage, and other clean energy technologies. The report also outlines the growing risks that will emerge at a grid level in the next decade. With the proliferation of diffused and distributed clean energy resources, sites are being set up with a sense of urgency around the world. The ongoing conflict in Ukraine and the rising prices of fossil fuel products are pushing governments and other players to look at renewable energy as a short- and long-term solution to reduce resilience on costly and carbon-intensive fuels. lso Read: How to get started with OT security Without adequate security, such systems could serve as entry points for hackers or end up facilitating a cyberattack. It is therefore essential to secure these systems from origin, deployment, integration, use, and maintenance standpoints to minimize any risks to power grids or other assets or the reliability of the power supply. Definition of Distributed Energy Resources The report defines DERs as “small-scale power generation, flexible load, or storage technologies (typically from 1 kilowatt to 10,000 kilowatts) that can provide an alternative to, or an enhancement of, the traditional electric power system”. DERs can be located “on an electric utility’s distribution system, a subsystem of the utility’s distribution system, or behind a customer’s meter.” Due to changing power generation models, DERs can now be connected to the grid at various points and it is pertinent to take the threats posed by them to the grid into account while planning operational resilience measures and overall availability of the grid at all times. Key trends mentioned by the report Recommendations The main recommendations proposed by the report for improving distributed energy resources security include: Recommended resources: Want to learn more about OT security? Talk to an OT cybersecurity expert from your industry now. We are giving away threat intelligence for free for the next 2 weeks. Find out how you can sign up and try out our threat intelligence feeds Download our cybersecurity awareness kits Find out what is lurking in your network. Go for a comprehensive 3-layer threat assessment now

Cybersecurity considerations and recommendations for securing distributed energy resources on power grids Read More »

The truth about cyberattacks on the healthcare sector in India

Cyber Security, Healthcare / Prayukth K V

Cyberattacks on the healthcare sector in India are rising and there are many reasons for this. Right now, India is ranked 11th among the top 20 most targeted nations in the healthcare sector in the world. The IoT and OT global threat landscape assessment report 2022 While the sector has attracted attention from APT actors globally, most attacks are still driven by unaffiliated or loosely affiliated actors who are after a ransom. Healthcare providers, insurers, and even small clinics and online pharma companies are being targeted to obtain information and to target providers and service users. Data criticality and the cost of systems force healthcare organizations to pay up the ransom just to get back on their feet. While some data is floating around on the volume of attacks on this sector in India, we have not seen any data being shared on the actual attacks that were occurring. This is why we have put this post together. a) to help healthcare industry participants understand the nature of the evolving threat landscape in the country and b) to drive awareness on the urgent need to respond to the rising cyber threats and to prevent more attacks from occurring. Here are the top trends and data on attacks on the healthcare sector in India: Why is the healthcare sector being targeted in India? There are many reasons for this. Here are a few: With such a complex modus-operandi, it comes as no surprise that Indian healthcare providers and victims are bleeding PII and more. Such information once leaked will return to haunt the victim and the provider. Sign up for our one-on-one threat intelligence and security landscape briefing to learn more about such attacks. Join our Cybersecurity Awareness Month campaign Find out what is lurking in your network. Go for a comprehensive 3 layer threat assessment now See our solution in action through a free demo

The truth about cyberattacks on the healthcare sector in India Read More »

Complete Guide to SCADA Security

Cyber Security, ICS, OT / Abhay S K

230,000 – This is the number of people affected by a single successful SCADA attack. Attackers successfully intruded Ukraine’s power grid using BlackEnergy 3 malware in 2015. The attack left 230,000 people and more stranded without power for over 6 hours. The SCADA systems were left non-functional, forcing the workforce to restore the power manually. This attack on the SCADA system set alarm bells ringing across the globe, exposing the weak cybersecurity posture of critical infrastructure. But what are SCADA systems in the first place? The acronym SCADA stands for Supervisory Control and Data Acquisition. Ranging from power plants to railways and water treatment plants to air traffic controls, applications of the SCADA system are vast and deep. Using SCADA systems (software), one can control processes in real-time and obtain data from sensors, devices, and other associate equipment. In short, SCADA systems help an organization manage and operate an industrial plant efficiently. Also read: How to get started with OT security SCADA systems find uses across industries, infrastructure, facility processes, and others. Computers, GUI, networked data communications, and proprietary software make up a typical SCADA system. Thanks to SCADA systems, one can quickly identify a non-functioning part in an industrial plant with over 10,000 functioning parts and numerous connections. SCADA Structure: SCADA system works on collecting data and then relaying commands through the architecture to control a process or a machine. A typical SCADA system involves various collection points, administrative computers, field controllers, communication infrastructure, software, a human-machine interface, and many more. Administrative Computers: These form the core structure of a SCADA system. The administrative/supervisory computers send all the control commands to the respective machines and devices. The administrative computers harvest all the data collected in a SCADA-enabled system. Depending on the complexity of the SCADA system, the administrative computer(s) can be one or multiple, often forming a master station. Exclusive Human-Machine interface systems propel the interactions between these computers and the workforce. Field Controllers: These come in two forms: Communication Infrastructure: This deals with establishing a secure connection between the SCADA system, RTUs, and PLCs. Communication connection comes in two forms: Most of the infrastructure is modular, and the data passing through them is often unencrypted in both Field and IT communication infrastructure. The primary design objective of these systems is easy troubleshooting and ease of implementation, emphasizing reliability over security. A manufacturer-specific or industry-defined protocol is adopted while establishing the communication infrastructure. The PLCs and RTUs can operate autonomously based on the latest command received from the administrative system. Human Machine Interface (HMI) System: The administrative system can comprise a single computer to a master station comprising over ten computers. The data ranges from simple flow diagrams of processes to complex schematic diagrams of the entire plant. An operator can access graphics, data charts, and other graphical data displayed on the system using a mouse, keyboard, or touch. The HMI system presents the status of every process, component, and plant-related aspect in an interpretable manner. Evolution of SCADA Systems SCADA systems have come a long way since beginning in the early 1960s. Over the 60 years, SCADA systems have transformed from monolithic to IIoT-based systems. As per the industry standards, the Fourth Generation of SCADA Systems is in use. Shortly, the fifth generation of SCADA systems will enter industrial spaces. SCADA Generation Category Features First Generation (1960s to mid-1970s) Monolithic RTUs incorporated at industrial sites directly connected to minicomputer systems.Low RiskIndependent system Second Generation (Mid 1970’s to late 1980s) Distributed Security risk elevated from low to moderate Availability of proprietary LAN networks Smaller computers and greater computing power Multiple systems connected via LANLack of interoperability due to vendor lock-in practice Third Generation (Late 1980s – 1990s) Networked The emergence of Ethernet and fiber optic.Improved interoperability Scalability of SCADA systemSecurity risk heightened Less operating costs Fourth Generation 2000s SCADA and IoT integrated system Equipped with IoT, Cloud computing, and big dataSSL and TLS have improved security posture while exchanging data between the SCADA systems and external networks.Better interfaces on handheld devices Greater interoperability SQL database support Web-deployable The next generation of SCADA systems will have cloud computing at their core. Researchers expect the new SCADA systems to optimize resource management (at peak surges and low demand) and enhance security protocols. Even without in-depth knowledge of software, one can design complex applications using RAD (Rapid Application Development) and the upcoming new-age SCADA systems toolkit. What makes SCADA so effective? The vast industrial expanses make it very difficult for physical monitoring. We need a reliable and efficient system to automate recurrence processes and constantly get the status of everything in an industrial expanse. SCADA has been rightly serving this purpose since its inception. From data collection to setting up alarms, SCADA plays a crucial role in improving an industrial expanse’s productivity, maintenance, and functionality. SCADA Architecture: SCADA systems run through 5 levels from Level 0 to Level 4. They form five of the six levels described in the Purdue Enterprise Reference Architecture, followed by enterprise integration. The dissemination of levels helps us understand SCADA systems better and define each security policy for each level. SCADA System Levels Description Level 4 Planning and Logistics Scheduling of production processes Managing ongoing processes Level 3 Production Control Level Made up of administrative systemsData aggregation from Level 2 systemsReporting to ongoing production is produced Executing alerts and other region-wide functions Level 2 Plant Administrative Level Data aggregation from level controllersIssuing commands to respective level controllers It consists of supervisory and administrative systems Level 1 Direct Control Level Comprises local controllers – RTUs and PLCs Accepts data inputs from sensors Actuator receive commandsDirect interaction with field devices Level 0 Field Device Level Includes sensors that forward data Includes actuators that control processes SCADA Security Framework: We can confidently say SCADA systems have opted for a reliable and straightforward framework for smooth functioning. SCADA systems were relatively safe, given that they were greatly restricted to on-site locations before the internet exploded. Every security framework of SCADA should be able to meet specific objectives. These help build a strong posture contributing toward a

Complete Guide to SCADA Security Read More »

takeaways from the latest OTICS advisory from NSA and CISA (2)

10 takeaways from the latest OT/ICS advisory from NSA and CISA

Cyber Security / vikas.karunakaran

The latest joint advisory from NSA and CISA adds to the previous joint guidance released by the two agencies in order to stop malicious ICS activity and reduce OT exposure. Also Read: Complete guide to SCADA security The latest advisory describes the various TTPs that bad actors could use to compromise critical OT assets. It also deep dives into measures ICS and OT operators can deploy to prevent cyberattacks while building cyber resilience. Here are the 10 major recommendations cited in the latest OT/ICS advisory from NSA and CISA: 1. Newly observed TTPs in cyberattacks Partial loss of view, connections to internet-accessible PLCs, spear phishing, modifying control logic, and deployment of commodity ransomware have been listed among recently observed TTPs 2. Increasing risk to ICS Malicious cyber actors present an increasing risk to ICS networks. 3. Know thy enemy Knowing your adversary and their potential tactics and measures for creating a breach is essential for deriving countermeasures 4. OT resilience plan 5. Set up and run your incidence response plan 6. Harden networks 7. Understand and Evaluate Cyber-risk on “As-operated” OT Assets 8. Implement a persistent and continuous monitoring program 9. Understanding the malicious actor’s gameplan Threat actors often follow these steps in their strategy to breach critical infrastructure control systems 10. Mitigation Want to learn more about OT and ICS security tactics and strategies? Speak to an OT security expert. Find out what is lurking in your network. Go for a comprehensive 3-layer threat assessment now See our OT security solution in action. Sign up for a free demo now. Get your free threat intelligence feeds here. Key Takeaways from the most recent OT/ICS advisory by NSA and CISA

10 takeaways from the latest OT/ICS advisory from NSA and CISA Read More »

LockBit 3.0 code release opens Pandora’s box of new threats

Cyber Security, ICS, OT / Prayukth K V

When LockBit 3.0 was launched in June, the group touted it as the most powerful encryptor ever built. The launch also led to a 17 percent rise in cyber incidents directly linked to the encryptor. The new variant brought in new features such as more payment options across cryptocurrencies, new monetization options, and more means to recover or destroy data as per the outcome of negotiations with the victim. The files were not just encrypted but exfiltrated as well to put additional pressure on the victim. A typical attack begins with the victim’s device being infected and the files being encrypted with a jumbled extension. The process of data encryption is done at a rapid speed with multiple tasks being done in parallel. The infection becomes apparent with the wallpaper of the victim’s machine being changed to a ransom note. In case the ransom is not paid on time, the victim’s data is then put up for sale on the Dark Web and other forums. Sample of LockBit 3.0 Ransome Note At the time of writing this blog post, we did come across an APAC enterprise that was successfully targeted by the LockBit 3.0 group. The ransom note asked the victim to pay $10000 to extend the deadline by 24 hours, $500000 to destroy all information, and a similar amount to download the data at any time. LockBit 3.0 was much in demand in Ransomware as a Service market. Which explains the sudden and steep rise in LockBit 3.0-linked attacks. The group even ran a bounty program to incentivize the detection of bugs in its code. LockBit operators were keen on preventing non-group members from obtaining the decryption tool. Since it was first detected in the wild in mid-June, LockBit 3.0 has been reported consistently from over 33 honeypot locations of Sectrio indicating its prevalence and global presence. It even outcompeted rivals such Hiveleaks and Blackbasta in infecting maximum victims since launch as documented by Sectrio’s threat researchers. For a while, everything seemed to be going the way of LockBit 3.0 developers until an alleged disgruntled developer threw a spanner in the works by releasing the code of the encryptor which subsequently made its appearance on Twitter at least a couple of times. This will enable other ransomware groups to build on the encryptor (or modify it) and launch new and more stealthy variants. What’s next for LockBit 3.0 and other ransomware groups? New ransomware groups could theoretically launch their operations with these modified variants. Such variants could also be re-engineered in academic or research labs and in case these variants are accidentally or deliberately released into the web in the future, then the chain of attacks linked to LockBit 3.0 will continue to worry cyber defenders for months or even years.

LockBit 3.0 code release opens Pandora’s box of new threats Read More »

Threats to air force assets too real to ignore

Cyber Security, Defense, Featured / vikas.karunakaran

Imagine a scenario where hackers take control of ground-based command and control systems and connected networks to either shut down a critical system or manipulate feeds leading to wrong decisions being taken on the battlefield. Communication systems, guidance systems, and situational awareness management systems could be targeted with intrusion or extended scans to exfiltrate data. An international geopolitical event may even be triggered by a cyber attack with many countries getting involved thanks to regional defense agreements. Mission level cyber-threats During peacetime, air force teams participate in multi-geography and multi-hardware training missions. Such missions often involve exercises to test response readiness, target acquisition and engagement, tactical advantage preservation, and testing of hardware and battlefield coordination. Such exercises use dedicated communication networks where sometimes new and untested systems (from a security perspective) and hardware are added. Such hardware could have a trojan code added inadvertently through stealthy supply chains. Modification of systems during training (for compatibility with systems belonging to air force teams from other countries) could also open up new vulnerabilities. Such vulnerabilities could also open systems up for long-term scans for a potential malware insertion at a suitable time in the future. The use of old systems that may carry unpatched vulnerabilities could also contribute to an overall degradation of the overall security posture. Also read: Why IoT Security is Important for Today’s Networks? The type of mission and the number of nations involved can all contribute to the threats and risks that emerge. For instance, if the hardware diversity increases during a training exercise involving many countries, chances are that systems will be modified to ensure interoperability. This opens the system to cyber threats it may not be ready to deal with. This is why training exercises are keenly watched by adversarial nations as they could expose not just the strategic and tactical shortcomings, but such missions also bring together hardware and systems or varied origins and vintage. Training missions can therefore introduce new threats and risks to systems. These threats could play out in the long or short term and reduce the ability of an air force entity to respond to or engage an adversary in the air or on the ground. Electronic warfare in the air – Cyberwarfare in the air Most unmanned and manned platforms have an electronic warfare suite embedded or added to them. These suites help in improving situational awareness, reducing the effectiveness of enemy radar, denying unrestricted access to the electromagnetic spectrum, misleading SAMs, electronic reconnaissance, improving stealth, or simply acquiring targets by intercepting communication. These electronic pods that house the electronic warfare suite could technically be jammed or remotely acquired by an adversarial nation’s cyberwarfare group and rendered inoperable. Nuclear capable and non-nuclear capable ballistic missiles pose another major concern for air defense planners. The guidance systems of ballistic missiles could be targeted using a software-programmable radio frequency or modified electronic warfare signals that could jam or alter an ICBM’s flight trajectory toward a target. Electronic warfare in space – Cyberwarefare in Space Ground to space communications could be hacked into by APT actors who can then send a satellite off balance by manipulating its orbit control systems. The satellite could be made to lose its earth lock and turn into a threat to all space assets. Tracking such attacks will be a tough challenge especially if the satellite is lost or destroyed later. Considering the significance of space as a medium for communications through satellites any successful hacking will invariably lead to the shutdown of many systems on the ground including those related to GPS. Complex multi-function satellites providing various services could be sitting ducks to such cyberattacks. Are redundancy systems part of the solution or the problem? There is a common myth about the use of redundant systems as a security layer. Nothing could be further from the truth at least in this context. Redundancy systems cannot be equated with security. In the case of a fighter jet, redundancy systems could prevent a crash in case the fly-by-wire systems are hacked into or disabled. But they do not provide any level of security to a system or render it more robust. In fact, redundancy systems could even introduce new vulnerabilities into the network as they are often picked for their ability to serve as ready backups for key systems rather than for their security robustness. In summary, hacking of assets and networks connected with an air force could lead to: Want to learn how to secure your air force and its entire digital footprint across connected and air-gapped networks? Talk to us now. See our solution in action, book a demo now: Request Demo Try our curated threat intelligence feeds for defense entities.

Threats to air force assets too real to ignore Read More »

Complete guide to IoT Security

Cyber Security, Manufacturing / Abhay S K

The IoT market is projected to hit the $1.5 Trillion mark by 2025. Doesn’t that number look staggering? Putting in perspective, it’s a 600% growth from 2019, when the IoT market was pegged at $250 Billion. It is expected that 25 billion devices will be a part of the IoT network by 2025 with smartphones making 24% or 6 billion of the total devices. The biggest beneficiary of the IoT revolution is Industry 4.0. The IoT revolution can take off only if we can secure troves of data flowing through billions of IoT connections. This brings us to the focus point – IoT Security. IoT Security – The key that unlocks Industry 4.0 IoT security involves securing software, hardware, and networks that store, handle, collect, transmit, and process data. Be it your garage shutter, rolling up when your car enters your home perimeter, or your lights turning on the moment you enter the room, work on sensors. These sensors collect and send the data to a Command Center, which then processes and sends the response. This data needs to be secured. Your devices need to be secured. The entire network needs to be secured. This is what IoT security deals with. It comprises tools, strategies, and methods to secure you from bad actors who constantly keep coming back to find vulnerabilities in your networks. Unlike device-based security, like a smartphone or a laptop, IoT security is cloud-based. It is the fundamental block of the IoT – Big Data – Cloud Computing ecosystem. While IoT devices help in generating and collecting the data, the Big Data platform deals with analytics. The cloud computing system stores, processes, and addresses other aspects related to data mobility. IoT security ensures that everything taking place in the cloud and within the IoT devices is well protected. “The fate of Industry 4.0 is in the hands of IoT security and not just IoT device interconnectivity”, opines major players in Technology, Industries, Logistics, Commerce, and Government agencies. To tackle IoT Security challenges, Sectrio believes in the deployment of a robust IoT security management plan. At a design level, adopting security-by-design architecture is the best way to prevent and mitigate IoT security threats and vulnerabilities. A network without IoT Security is a house without a roof! What would it be like to lose control over a 100-Tonne machine on an industrial site? What would happen if a subway railway signaling system fails? It’s even difficult to imagine. Complex systems like power distribution, water management, traffic management, smart homes, and a ton of other systems and devices are interconnected via IoT devices, forming complex networks. Also read: Why IoT Security is Important for Today’s Networks? While the goods of IoT connectivity are already known, the worst of it is yet to come. Any compromise on the security of these complex networks can lead to a catastrophic event. If a military network, nuclear plant network, or power transmission grid is compromised, the threat could be at a national level. Robust IoT security is imperative for complex and sensitive networks which keep this world on its wheels. From a cybersecurity expert’s POV, there are a host of IoT security challenges that a cybersecurity team has to deal with. Let us take an example of a smart automotive manufacturing factory. The functioning and competence of the factory highlight what the IoT revolution has to offer with time. On the other side, the same factory is a strong case to understand how important IoT security is. Upon infiltrating the factory’s network, hackers can get access to key systems and processes running on the factory floor. It’s only a matter of time before they get control over ‘privilege escalation’ permissions. In the case of our automotive manufactory factory, hackers can tinker with the settings of a manufacturing unit or an assembly unit, putting hundreds of lives in jeopardy. Similarly, if they manage to enter a Medical Command Control that monitors hundreds of medical devices like artificial pacemakers, there is a chance for greater human loss. Even in-home gadgets like CCTVs, Smart TVs, Smart Refrigerators, and others are not safe. These devices are configured to the home networks without their default credentials being changed. This puts the entire network at risk and the mercy of bad actors. It is important to have all endpoints of a network secured. The data passing between the devices and the cloud should be encrypted at all times. This mitigates the risk even during a data breach. Understanding the IoT Security Framework Most guides based on various IoT Security frameworks strictly depend on protocols and pre-defined policies that are actioned via the cloud. Depending on the nature of the industry, level of data collected, data processing, and other parameters, enterprises meet certain compliance standards as required by local laws. While this holds good for secure data processing on the IoT device, even manufacturers and consumers should be cognizant of their practices. IoT Security Framework is primarily spread across three levels: Physical Layer: 1. Security-by-design IoT Security by design should be strictly implemented. The development team should consider the ‘security’ feature as important as the device itself, being embedded into the SoC (System on Chip). This minimizes IoT security threats during the lifetime of the IoT device. Patch and firmware updates should be provided only through a secure mechanism. 2. Accessing the device At all times, user access credentials should be confidential and private. To prevent ‘brute force’ unlocking and abusive login attempts, steps should be undertaken. A thorough IoT security testing can help minimize IoT security risks. MFA should be mandatory to access sensitive data. 3. Detection and Anti-tamper Mechanism Manufacturers should ensure that no tampering with the IoT device can take place with minimal tools during shipping and installation. A comprehensive detection system should be in-built to alert the command control if needed. Complying with certain security certifications can help consumers make better choices in buying IoT devices. This is of primary importance owing to the

Complete guide to IoT Security Read More »

Supply chain cybersecurity tips from NSA and CISA are timely and critical

Cyber Security, Featured / vikas.karunakaran

Supply chains have become a preferential target for hackers. Government reports from the UK, USA and many other parts of the world confirm the growing attacks on supply chains impacting businesses and even government agencies. Such attacks often involve secondary or even tertiary targets that are attacked through a series of breaches across organizations connected through a supply chain How are supply chains targeted? A chain is only as strong as the weakest link and this adage is true even in the digital world. Hackers target supply chains by studying the entire supplier network for identifying weak points for entry into a network. This network is then used as a conduit to target networks belonging to other organizations upstream or downstream. A single breach could potentially expose a whole chain and many service providers. Also Read: Why Supply chain poisoning is an imminent concern Using specific data, hackers target multiple employees across various organizations. This is done through a phishing email or a waterhole attack. While earlier attacks were not targeted, most of the attacks we have seen this year are targeted at specific individuals and involve state-backed actors. The whole approach is more structured and organized and hackers are clear about what they are looking for or want from these organizations. The ultimate targetsThe more sophisticated the hacker, the more distant would the ultimate target be. In the case of a large defense hardware manufacturer in Europe, the first point of entry for the hackers was a firmware-linked entity based in Asia. The hackers used the first breach to move across continents and more targets downstream till the ultimate target was breached nearly 11 months later. The target organizations and their supply chain connects are mapped and observed over a period of time before an attack attempt is made. Software supply chain cybersecurity tips from NSA and CISA, US Software supply chain compromise is a common form of supply chain attack. The most common compromise methods involve exploitation of inherent design flaws in the software, addition of vulnerable third-party components into a software product, breach and infiltration of multiple supplier’s networks with malicious code before the final software product being delivered, and injection of malicious software which is finally deployed by the customer. The U.S NSA and CISA recently shared tips to secure the entire software supply chain. This is certainly a welcome move. The recommendation document covers security across: The document states that “stakeholders must seek to mitigate security concerns specific to their area of responsibility. However, other concerns may require a mitigation approach that dictates a dependency on another stakeholder or a shared responsibility by multiple stakeholders”. This points to a collaborative approach towards identifying and mitigating threats within and outside a supplier’s own area of responsibility. The document while articulating the need to focus on vulnerabilities, states “dependencies that are inadequately communicated or addressed may lead to vulnerabilities and the potential for compromise”. Areas where these types of vulnerabilities may exist include: We recommend that all supply chain entities across verticals read, understand, and adhere to these tips. It will go a long way in securing not just supply chains but also the entire digital footprint of various enterprises and governments. Sectrio Learn more about supply chain security by interacting with our cybersecurity experts today Do a complete cyber threat assessment now to find out your security gaps To learn how you can protect your business, book a free consulting appointment with our IoT and OT security experts and see our IoT and OT security solution in action now: Schedule a time now Try our threat intelligence feeds for free now: Sign up for free threat intelligence feeds today.

Supply chain cybersecurity tips from NSA and CISA are timely and critical Read More »

7 measures to address critical IoT Security Challenges (1)

How to address IoT security challenges?

Cyber Security, IoT / vikas.karunakaran

My first association with IoT was way back in 2016. We were then working on developing an IoT-based solution for monitoring blood banks. Security was on the table but it was not a big priority for many businesses back then as I found out from my interactions with many IoT experts. Many DDoS attacks and generations of IoT devices later, enterprises are still struggling to address IoT security concerns. Let us examine why IoT security continues to pose a huge challenge to enterprises and what needs to be done to address this. What security challenges are IoT devices facing? 1. Expanding surface area Users often represent the most important attack surface area as they could be the target for a phishing campaign, could inadvertently or voluntarily share credentials or other sensitive information, or could easily be tricked into taking actions that may lead to the deployment of malware. All these actions could not just compromise data and credentials but also cause attacks that could be costly and set back production schedules or other goals by days, months, or even years. Also read: Why IoT Security is Important for Today’s Networks? The addition of devices also represents an addition of threat surface area. In addition, misconfiguration of networks or devices could also lead to the opening of gaps in the security architecture. 2. The growing number of IoT devices The number of IoT devices coming online continues to grow each month. Depending on which data source you subscribe to, this number can vary by the thousands. With new use cases being added every year, IoT has already made deep inroads into sectors such as agriculture, smart homes, transport, financial services, and manufacturing. The number of IoT vendors has also grown exponentially in the last few years. The number of IoT device manufacturers has also seen exponential growth with the rise in the number of manufacturers in countries where they were manufactured traditionally as well as the addition of new manufacturing units in other countries. With such a rise in the number of devices manufactured, one would have hoped security would receive more attention and generational security gaps would be addressed with the arrival of new and more efficient IoT devices. However, what we are seeing instead is the detection of new vulnerabilities at all levels in new devices along with generational vulnerabilities that have not been addressed. Such a scenario is creating new opportunities for hackers to exploit. 3. Rising sophisticated attacks IoT devices and projects are attracting plenty of attention from APT groups now. The rising integration of IoT into critical infrastructure projects and the use of IoT in the financial services and other key sectors could be one of the reasons why APT groups are increasingly scanning IoT devices across verticals. According to Sectrio’s threat research team, IoT projects logged a 77 percent rise in cyberattacks in the month of April 2022. Also read: Complete Guide to Cyber Threat Intelligence Feeds This was the single biggest rise in attacks ever registered. The number of sophisticated attacks logged a 133 percent rise in the same month. Oil and gas and manufacturing were the most attacked sectors. 4. Regulatory/Compliance Standards There are many standards that enterprises can adopt to improve their security. We have compiled them for you here. In addition, the OneM2M standard also enables IoT applications to discover and interface with IoT devices in various distributed environments based on a common service layer. It also prescribes many other avenues for improving IoT security. While most of the standards are voluntary, regulators often recommend voluntary adherence to them in order to mitigate risks and reduce risks and this could be one of the reasons why such standards are not adhered to by many businesses across sectors. Some of these standards when adopted could improve efficiencies and promote the network and asset transparency which translates into improved productivity and return on capital invested. These are just some of the reasons why IoT security is still a challenge for enterprises. In order to address these aspects, businesses will have to scale up their overall security measures around. Also Read: The Complete guide to IoT Security Here are 7 measures to address critical IoT Security challenges: Do an IoT threat assessment now to find out your security gaps To learn how you can protect your business, book a free consulting appointment with our IoT and OT security experts and see our IoT and OT security solution in action now: Schedule a time now Try our threat intelligence feeds for free now: Sign up for free threat intelligence feeds today.

How to address IoT security challenges? Read More »

Educational institutions and students on hacker’s radar

Cyber Security / vikas.karunakaran

Over the last two months, hackers have stepped up attacks on academic institutions and students thereby opening a new frontier in the battle against cybercrime. Rising attacks on educational institutions could have multiple security and risk implications for the overall security of everything connected and beyond. Implications of attacks on educational institutions: Major security incidents involving academic institutions in the last 30 days: Sectrio’s threat research team has identified multiple hacker groups that are actively targeting academic institutions. This includes APT groups such as Transparent Tribe (Pakistan) and APT 41 (China). Both these groups have stepped up their attacks on educational institutions. The rising interest of APT groups points to a growing realization among hacker groups of the importance of academic institutions as a target. Also read: Complete Guide to Cyber Threat Intelligence Feeds With no established cybersecurity practices and a lack of awareness of the prevalence of sophisticated hacker tactics, schools and colleges are soft targets for hackers. APT groups targeting them could be acting with an intent to stay entrenched through vectors in their networks. Such malware could be activated remotely in case of any geopolitical tensions between the countries involved. Such an approach also points to a widening of the list of targets sought by hackers. With more such options to choose from, hackers will find it easier to target enterprise or government targets. Also read: Why IoT Security is Important for Today’s Networks? While the democratization of hacker activity is a reality of the times we live in, now we are having to deal with the democratization of targets as well. With such a spread of targets, it will become difficult for enterprises and governments to attribute cyberattacks or validate an attribution claim. Either way, attacks on such soft targets represent the opening of a new frontier for hackers. Educational institutions will have to pay more attention to cybersecurity from now on. Even simple cyber hygiene measures including sensitization of all stakeholders will go a long way in securing educational institutions. To learn how you can protect your business, book a free consulting appointment with our IoT and OT security experts and see our IoT and OT security solution in action now: Schedule a time now Try our threat intelligence feeds for free now: Sign up for free threat intelligence feeds today.

Educational institutions and students on hacker’s radar Read More »

By Industry

By Compliance

Business Needs

Services

Contact Us