Singapores Cybersecurity Certification FAQs Best Practices

FAQs on Singapore’s new cybersecurity best practices recognition scheme

What is it all about? Singapore’s Cyber Security Agency (CSA) recently announced the launch of a new cyber security certification program that will call out or rather certify firms that have implemented good cyber security practices through a certification. This is a great way of incentivizing cybersecurity among businesses. The program is divided into two halves based on the size of the organization being certified. The first part called Cyber Essentials is targeted at encouraging small and medium-sized businesses that often have to deal with limited resources and manpower to implement good cybersecurity practices including access management and control, incident response, and disaster recovery. Cyber Trust, the second half, deals with larger and more digitized enterprises including MNCs. It will offer a risk management approach that helps them understand their risk exposure, raise contextual awareness and help them focus on various areas related to cyber resilience to address and mitigate security risks and challenges. The overall security posture of the enterprise will also be assessed. Also Read: Why IoT Security is Important for Today’s Networks? CSA has put together 5 cybersecurity preparedness tiers that align with an enterprise’s unique risk profile. Each tier covers between 10-22 domains including cyber governance, awareness and education, asset protection, and cyber resilience. These preparedness tiers will be a part of a Technical Reference (TR) for cyber security standards that will be rolled out in the second quarter of this year. What will the TR contain? The TR will essentially offer a tiered approach towards deploying cybersecurity measures including: Establishing a comprehensive process to secure sensitive data Installing anti-malware solutions Securing backups from any form of unauthorized access Understanding different risk profiles of enterprises. The tiered measures take into account the operational imperatives of organizations operating in Singapore. The use of the TR, when it becomes available, together with CSA’s certification scheme, will help businesses secure and protect their digital assets, and personal data and enhance cybersecurity preparedness in a phased manner. What kind of support is CSA offering for companies that wish to obtain these marks? CSA has developed a toolkit for IT teams and curated an early ecosystem of partners with product and service offerings to help businesses meet these requirements. The toolkit for IT teams is part of a suite of cybersecurity toolkits put together by CSA and are targeted at key enterprise stakeholders. It includes resources that enterprises can utilize to prepare for cybersecurity certification. There are templates for tracking the state of various information assets included in these kits. Do these cybersecurity marks cover specific products or offerings? No, they are only related to cybersecurity best practices adopted by an organization at an institutional level. Is it mandatory? As of now, no. Who will be the certifying authority here? CSA has announced the appointment of 8 certification bodies that will act independently. These firms will be responsible for certifying the companies that apply to be part of this program. How will businesses benefit from this unique exercise? In addition to improving trust and credibility, a certification in cybersecurity best practices will also help the brand at various levels. Businesses can flaunt this new certification in all their outbound communication to convey the level of cybersecurity maturity attained as well as the priority the management and employees of the business accord to cybersecurity. Sectrio recommends that all businesses go for this certification at the earliest. This is one way of adding momentum to your cybersecurity journey as well as putting cybersecurity on your organization’s priority agenda. How can Sectrio help in this certification? If we split the requirements of this certification into further components, we can essentially call out 3 major outcome areas: Best cybersecurity measures Raising cybersecurity awareness levels of all stakeholders Putting together a roadmap for improving security on an ongoing basis Sectrio can help secure digital assets across IT, OT, IoT, and converged environments. Sectrio can also offer its threat intelligence feeds to improve threat hunting to detect and remediate threats early. Sectrio’s offerings can also enhance the overall cybersecurity posture by helping with cybersecurity requirements around: Network security Asset security Visibility into networks and assets Information on the state of vulnerabilities and patches Micro-segmentation to contain threats and apply policies at a micro level We can offer IoT and OT focused threat intelligence In addition, Sectrio also offers compliance kits to align your internal cybersecurity practices and measures to standards such as IEC 62443 and those recommended by NIST. We can also help your business embrace a Zero Trust approach and secure your business from sophisticated attacks at all levels including those that emerge at various points in your extended supply chain. Don’t wait up. Book a free and no-obligation slot with our IT, IoT, and OT cybersecurity analysts and consultants to learn more about complying with the new recognition scheme. Book here. Learn more about our IoT, IT, and OT cybersecurity solution through an interactive demo. Try our threat intelligence feeds for free for the next two weeks. Get access to enriched IoT-focused cyber threat intelligence for free for 15 days

FAQs on Singapore’s new cybersecurity best practices recognition scheme Read More »

Cyberattacks from Russia are expected to rise in April Blog

A significant spike in cyberattacks from Russia could be expected in April

Cyber Security, IoT, OT / Prayukth K V

Last week during a webinar session, I was asked a question about why the cyberattacks from Russia didn’t materialize to the levels that we were warned about. To answer this question, we need to understand various aspects of how Russian APT groups operate and work on targets. Russian APT actors have never shown a linear progression in intensity and volume of attacks except in certain specific circumstances (this is mostly true after they chose a target. They don’t go after multiple targets in cyberspace at random). Mostly they choose targets, attack with ferocity till they succeed, and then move on. Such attacks are continuing as we have seen in the case of the German wind turbine manufacturer Nordex SE that was attacked last week. Russian APT groups are keeping a lookout for renewable energy companies, power firms, and oil pipeline companies to be specific. So what exactly are Russian APT groups up to and what is this ‘delay’ all about? Given the above facts, a multi-sectoral attack across geographies is not on the horizon in the near term. From the chatter we are picking up from the Dark Web and the APT groups we are monitoring, we get a view that some targets and countries are being chosen and attacked selectively with specific malware and tactics. Also Read: Why IoT Security is Important for Today’s Networks? Here are some facts on the activities of Russian APT groups in the last 8 weeks Our honeypots across Western Europe have recorded a rise in cyberattacks since the onset of the war The spike has been limited to the sectors we have mentioned earlier and manufacturing companies along with defense forces, firms, and groups Russian APT groups are running sophisticated campaigns to target NATO and defense forces in the region These groups could also start targeting countries that are supplying lethal weapons to Ukraine On the day the war started, over 10,000 modems of Viasat, a satellite broadband provider, were knocked offline Ukrtelecom, Ukraine’s biggest provider of fixed internet services confirmed a week back that they have been hit by a severe cyber attack that led to the disruption of services with several cities being disconnected and connectivity falling to as low as 13 percent of pre-war levels. It is said that the attacks had targeted home routers among other devices (that were shut down) In the days leading to the war, several Ukrainian agencies were attacked by Russian APT groups It is possible that Russia doesn’t want more attention to come its way while it focuses on the war of attrition in Ukraine Russian groups have also taken note of the advisories issued by governments and are aware that the chances of attacks being detected, contained, or even repelled are high. Russia already is facing a huge spike in inbound cyberattacks and doesn’t want more actors to join in the ongoing cyberattacks targeting its critical infrastructure and enterprises The volume of reconnaissance attacks from Russian APT groups has been steadily growing since January 2022. Such attacks have targeted OT and IoT-based infrastructure projects in Western Europe and North America The chances of false flag attacks on critical infrastructure by Russian hackers remain high. Many of these hackers are using Ransomware-as-a-Service and Malware as-a-Service in association with an APT group of a southeast Asian country to monetize cyberattacks. Intelligence indicates some degree of attrition among the two Russian APT groups. This includes the Primitive Bear group that has been targeting Ukraine. Some APT groups have been drafted to target hackers that are attacking Russia as well On analyzing these facts, we can easily conclude that Russian hackers have not given up or are going slow. It is just that they are sticking to their existing playbooks that focus on specific attacks tied to a timeline rather than attacking every piece of digital infrastructure out there. Some of the reconnaissance attacks may be upgraded to full-fledged attacks in April. Russia could also activate new botnets in its Eastern region to compensate for the loss of a few botnets in March. Lastly, Russian APT groups could release some of their tools to enable other hackers to target enterprises, individuals, and governments across the globe. In summation, we are not out of the woods yet. Sectrio advises all businesses to maintain a high state of alert and be prepared to ward off cyberattacks in the next few weeks. Interested in learning the 7-step approach to improving IoT security in 7 days? Talk to our IoT cybersecurity experts today. Book your slot now. Download and use our compliance kits to improve your institutional security posture: visit Compliance Kits Try our threat intelligence feeds for free for the next two weeks. Get access to enriched IoT-focused cyber threat intelligence for free for 15 days

A significant spike in cyberattacks from Russia could be expected in April Read More »

Sectrio detects a significant rise in DDoS attacks from compromised IoT devices in March

The volume of DDoS attacks from compromised IoT devices rose significantly in March

Cyber Security, IoT / Prayukth K V

Vulnerable routers (2 global brands) and compromised monitor screens and fleet tracking systems were used extensively by hackers as part of large botnets to share and deploy rootkits across the globe in March. This resulted in a significant spike in botnet traffic recorded by our global honeypots in March. Though the spike has subsided a bit, the rise in infections caused by this sudden surge will only become apparent in the next few weeks. This trend presents a new reason for concern among IoT cybersecurity teams. Most of the attacks were logged at 2.5 MBPS and above and the requests ranged from 1.5- 3 million requests per second on certain target websites. Based on the traffic patterns, over 150 command and control servers located across 15 countries were identified by Sectrio’s threat research team. These servers were coordinating not just the spread of the attacks but the propagation of a variety of rootkits and other payloads including Revil ransomware. The sudden botnet expansion could also be attributed to the use of older versions of certain operating systems in phones and other desktop and laptop machines. With such an expansion, hackers now have more bots at their disposal as well as a means to upgrade their botnet infrastructure by promoting more bots to command and control servers. The scope for many of these Bot networks to grow exponentially in the next weeks has increased with the rising number of bots getting added each week. Also Read: Why IoT Security is Important for Today’s Networks? Traffic from these botnets was not confined to any geography and each bot was sending traffic to multiple IP addresses across regions. Analysis of this traffic reveals a well-orchestrated strategy being deployed by hackers to target IoT projects at various levels and phases as well as to expand botnets by targeting consumer devices. The level of stealth and obfuscation is growing as hackers devise new means to bring down multiple target entities through the same botnet. Many of the old botnets are also being resurrected for this purpose as hackers are planning to increase their operations across geographies. For IoT projects, this is bad news as the lessons from 2020 and 2021 as articulated in our IoT and OT Threat Landscape reports seem to have been forgotten or ignored. While a portion of these new IoT-linked botnets may be connected to projects that are in the PoC phase, a larger volume of the traffic seems to be emerging from established projects as per the traffic patterns analyzed by Sectrio’s threat research team. This is quite a worrying development as it indicates the possibility of existing IoT devices being compromised or new and untested devices being added to existing projects without security-linked adequate testing. How will this impact IoT security? Coming in wake of the crisis in Ukraine and a period of excess activity within institutional and government-run SOCs, there is a possibility that many such attacks will turn into targeted attacks on specific projects and infrastructure (which could be the ultimate objective for these hackers). The reactivation of Sandworm hackers and the appearance of new and more stealthy rootkits in the wild are two separate trends that will converge over the next few weeks as these botnets expand their range and targets. Overall, this underscores the need to enhance IoT security and invest in the right set of cyber threat intelligence feeds. With vulnerability management, patching, and devise testing receiving little or no attention, the time is ripe to diversify IoT cybersecurity measures to cover more ground and deepen the digital moat surrounding your infrastructure. While systems that are based on older OS hosts can be upgraded to minimize the number of botnets, what is also needed is action from IoT project operators who need to do some serious rethinking of their cybersecurity priorities. With the average ransom demand jumping by leaps and bounds each year, hackers are raking in profits and expanding their operations and targets. How can you improve IoT security? Always go by the ‘security-by design principle. Remember, the earlier you think of IoT security, the better are your chances of deterring hackers and bad actors Approval of IoT projects should also have a security component. That means that unless every stakeholder including IoT cybersecurity analysts are not convinced by the security measures, the project simply doesn’t get off the design board Cyber discipline and hygiene should be treated as aspects that are beyond compromises and placed above deadlines as a project imperative Go for IoT threat intelligence feeds Know what exactly is happening in your network at all times, do periodic security audits and checks From a security perspective, there shouldn’t be any difference between a PoC project and a fully operational one. This step alone could improve IoT security by a big margin Interested in learning the 7-step approach to improving IoT security in 7 days? Talk to our IoT cybersecurity experts today. Book your slot now. Download and use our compliance kits to improve your institutional security posture: visit Compliance Kits Try our threat intelligence feeds for free for the next two weeks. Get access to enriched IoT-focused cyber threat intelligence for free for 15 days

The volume of DDoS attacks from compromised IoT devices rose significantly in March Read More »

Long ignored UPS vulnerabilities are coming to roost: CISA and DoE

Cyber Security, IoT / Abhay S K

In a recent update, CISA and DoE (Department of Energy) jointly acknowledged the rising trend of cyberattacks and raised a concern over vulnerabilities associated with internet-connected UPS (Uninterruptible Power Supply) systems. This alert comes in light of the recent growth of cyberattacks targeting critical infrastructure not only in the United States but across countries that play a strategic role in various military and non-military geopolitical alliances. The alert raises concerns in the following areas: UPS systems are vulnerable to attacks when connected to unsafe networks Most UPS systems connected to the internet have little to no security on the cyber front. Out of the box, these systems come with default usernames and passwords and in most cases, the default credentials are unchanged for years after installation. In large organizations UPS systems bought in bulk often have the same login credentials across each installation to access them. Read more from the report here: Mitigating Attacks Against Uninterruptable Power Supply Devices Dependable, reliable, and omnipresent energy aid Uninterruptible power supply (UPS) has been a boon to humanity even before the dawn of the age of computers. In most cases, these systems are used to provide clean and emergency power supply in times of power outages or to regulate the surges in the flow of electricity. Also Read: Is NIST working on a potential cybersecurity framework update? In the early days, the UPS systems were often connected to critical industrial machines to prevent any occurrence of unsafe shutdowns or the breakdown of such machines due to surges in electrical power. In fairness, UPS has been a constant source of reliable and safe energy in times of desperate need. With the growth and the rise of digitalization, UPS was later introduced widely for consumer use and thus began its rise in popularity. Significant upgrades and advancements to UPS systems later followed in its evolution to provide vital insights into the networks and connected equipment. Such UPS systems now come with the ability to connect to the internet, provide vital insights into monitoring any surges in a steady stream of power, remind concerned authorities of timely maintenance, and much more. These internet-connected UPS systems are also actively in use by several healthcare (IoT sensors, IoMT equipment), manufacturers (OT, ICS, SCADA equipment), pharmaceuticals (OT and ICS equipment), enterprises (backups to servers), and other critical infrastructure industries while providing a steady flow of safe and uninterrupted energy during vital organizational operations. Also Read: Why IoT Security is Important for Today’s Networks? This growth of IoT or the internet-connected UPS systems has also become a critical component when integrated with network and poses grave cyberthreats when overlooked for its availability for functional operations. Potential casualties incurred by a successful cyberattack on internet-connected UPS systems. Manipulation of data on IoMT or denial of service on vital healthcare equipment Sensor manipulations Disabling the Automatic voltage regulation (AVR) Destruction via a surge in power supply Denial of service on enterprise servers Malware injection Lateral movement via a compromised network can lead to data leakage Privileged escalation It is hence established that internet-connected UPS plays a critical role. What can be done to secure internet-connected UPS? While the CISA and the DoE suggest regular and timely updates of software and the use of MFA as immediate steps, we at Sectrio, suggest all take a step back and follow these steps. Have ample visibility into your network, be it even a remote or a hearing aid that is connected to your network. Monitor for anomalies on the network Log network activities Segment your network into zones and conduits. Also read: How micro segmentation can help secure your connected assets. Use of MFA and strong passwords Use of safe VPN Regular vulnerability scans to identify gaps in security Compliance with IEC 62443, Zero Trust, and NIST CSF Working with real-time threat intelligence Reporting of cyber incidents or suspected incidents as quickly as possible to the right authorities. Will cyberthreats ever stop? On March 29th, 2022, a statement made before the House Judiciary Committee by the FBI cyber division stated that “As adversaries become more sophisticated and stealthier, we are most concerned about our ability to detect and warn about specific cyber operations against U.S. organizations. Maybe most worrisome is their focus on compromising U.S. critical infrastructure, especially during a crisis”. This official statement by the FBI’s cyber division brings perspective on the state of cybersecurity in North America and is an alarming wake-up call to all organizations for immediate cybersecurity revamp into their ever-growing converged cyber environment. For more information on the evolving threat landscape and insights into emerging cyberattacks and bad actors, read our latest IoT and OT threat landscape assessment report 2022Learn how Sectrio’s solutions can help secure your organizations today. Reach out to our cybersecurity experts to get started now. Join our upcoming webinar: Key Takeaways from the Sectrio’s Global Threat Landscape Assessment Report 2022 IoT and OT focused threat Intelligence feeds free for 15 days! Try it right now: Threat Intelligence

Long ignored UPS vulnerabilities are coming to roost: CISA and DoE Read More »

Can cyberattacks on critical infrastructure trigger a wider conflict 1

Cyberattacks on critical infrastructure could trigger a wider conflict

critical infrastructure, Cyber Security / Prayukth K V

With the ongoing crisis in Eastern Europe, many questions have been raised about countries using cyberattacks to neutralize opponents or severely minimize the effectiveness of their supply chains. So far we have seen APT groups infiltrate nuclear plants, financial institutions, power transmission infrastructure, smart cities, and data centers. With each attack, hackers are drawing ever closer to targeting complex critical infrastructure facilities such as command and control mechanisms of military hardware related to warhead delivery, ballistic missile defense, space-based communication, and disaster management, ship-to-shore communications, and other parts of an integrated command and control infrastructure related to offensive and defensive military operations. Such cyber-attacks could turn into a potential final frontier for sophisticated threat actors and they represent the ultimate stage in the evolution of their malware and breach tactics. Diversification of supply chains presents many opportunities and a risk With global supply chains running into multiple countries and vendor groups, the standardization of cybersecurity needs is still a mirage. It is little wonder that hackers have in the past launched extensive reconnaissance missions against companies involved in manufacturing complex military and civilian hardware and systems. They want to infiltrate the supply chains early to get embedded in core and peripheral systems at a firmware level so that the chances of detection are minimized during integration and the malware can travel to the target infrastructure or command and control systems with ease. Diversified supply chains often lead to better cost and production efficiencies and improved time to market. However, with the emergence of supply chain poisoning risks, defense and critical infrastructure vendors are looking at revisiting their supply chain relationships from a cybersecurity perspective. Poisoned industrial control systems could, for instance, induce flaws in products that could cause a safety hazard or cause the product to malfunction when needed. When you are talking about the hardware associated with inertial guidance for a missile system, the costs could be enormous. Latent malware could provide hackers with a bargaining chip or the same malware could be triggered at will by the developer or hackers to cause a geopolitical incident in a tense environment. When embedded in a power plant or a water treatment facility, such malware could hypothetically alter key functions to cause kinetic damage. Target Industrial Control Systems within critical infrastructure Often it is assumed that ICS systems will be air-gapped and there do not need dedicated security measures or extensive implementation oversight. Thus, when implementation errors occur or when the air gaps are bridged and the OT protocols move away from a serial existence, they turn vulnerable to direct attacks. Sometimes because of the need to deploy large-scale systems in a hurry, systems with known ICS protocol vulnerabilities are adopted without an afterthought. Over a period of time, such vulnerabilities are forgotten till they are used by hackers to launch complex attacks. In addition to ICS-specific protocols, legacy networking equipment such as switches and routers and HMI units also require protection. Random placement of firewalls or the use of VPNs induces lag and is not preferred. Intrusion detection and threat mitigation systems that can prevent the exploitation and weaponization of vulnerabilities (that can render multiple parts of the ICS architecture vulnerable to a complex attack) can be preferred over traditional systems. Also Read: Is NIST working on a potential cybersecurity framework update? In terms of an attack on ICS devices that operate at the lower level of the Purdue model, hackers can use means such as reverse engineering, modification of control logic, exfiltration of data through commandeered side channels, bypassing authentication mechanisms among others to carry out an attack. While this requires extraordinary levels of diligence and patience, some hackers do invest both to exploit vulnerabilities and take over such systems. Injecting a new control logic in a PLC can degrade the integrity and availability of the system. The attacker can also remove all traces that point to an infection. In another form of attack, an actor could install a malicious control logic that can cause an engineering application to crash if it attempts to obtain a control-related logic from the PLC. Target IoT With the increasing adoption of IoT-based monitoring in critical infrastructure facilities, multiple entry points for malware emerge. These include devices, gateways, networks, platforms, or even the cloud ingress points. Newer IoT devices that have not been tested across a range of scenarios have been deployed across critical infrastructures. These include security cameras, movement monitoring systems, weather monitoring systems, vehicle tracking systems, and many more. IoT devices with significant compute power could be commandeered to serve as conduits for transferring malware into core systems. Devices with malware-injected firmware could impart multi-loader malware into networks that could open the door for the assembly and distribution of multiple malware in small digital packets. Industrial IoT systems (IIoT) including automated assembly control and health and safety systems could again be taken over by actors to carry out various malicious tasks. Also Read: Why IoT Security is Important for Today’s Networks? The potential impact of cyberattacks on critical infrastructure Utility agencies could be taken down leading to loss of power and safe drinking water and sanitation facilities in cities Bad actors could trigger a larger conflict by creating false attribution. Loss of confidential data Loss of significant capital investments Bad actors could also leave stealthy malware behind that could be trigged at will later Danger to ecology and environment How can critical infrastructure be protected? CI operators should join hands to share information on best practices and to collaborate on cyber defense Attempts should be made to standardize security across supply chains by aligning these standards with frameworks such as Zero Trust and IEC 62443 Focus on getting the right threat intelligence to detect stealthy attacks Table-top exercises should be conducted periodically to test response measures Clear structure and workflow to be published around roles and responsibilities and reporting requirements Track advisories from CERT teams and other sources of credible threat information Maintain visibility into networks at

Cyberattacks on critical infrastructure could trigger a wider conflict Read More »

What could be next for the Escobar malware?

Cyber Security / Prayukth K V

The dangerous Escobar malware’s key capabilities are being modified dynamically. It was originally an old banking trojan called Aberebot that has now been modified into the deadly Escobar malware that has been reported from over 119 countries so far. Its most deadly feature is the ability to strike at the heart of user authentication with the diversion of multi-factor authentication codes and theft of login credentials and personal data. Also Read: Is NIST working on a potential cybersecurity framework update? The new variant has been peddled under the guise of an anti-virus application (it even has the same icon). However, unlike the original anti-virus app, the fake version is not available on Playstore. It has to be downloaded from third-party sites to which unsuspecting users are lured by hackers. Once installed, the Escobar malware asks for as many as 26 permissions and captures your personal information through fake login screens, by capturing and rerouting two-factor authentication tokens or one-time passwords from banks or the Google Authenticator 2FA app. It doesn’t stop there. It can also take pictures, copy and transmit your media files, take pictures, install and uninstall apps, monitor your online activity, track phone calls and messages, copy contact information, modify app information, steal keys, and even copy chat information. Since it masquerades as a genuine anti-virus application, users may be tricked into ignoring red flags or any signs of infection that they may come across. Also Read: The state of OT and IoT cybersecurity in North America Escobar represents a new breed of malware that strikes at multi-factor authentication enablement means. While the mode of deploying it is quite simple, what it does post-installation is not. The malware takes over the victim’s phone completely and if they are using the same phone for official work as well, then chances of an enterprise-level breach could also arise. Why should we worry about this new variant of Aberebot(Escobar)? Twin-factor authentication is being touted as a strong measure to keep users safe from breaches and cyberattacks but with the emergence of such malware, even this frontier could be breached Sectrio’s researchers have identified at least one variant which is now masquerading as a popular gaming app. This means that the hackers are already working on making more fake apps to trick users The activity footprint of this malware is significant yet, on popular versions of Android phones, it doesn’t create a lag or delay in any form that may alert users about a suspicious app running in the background. Escobar is sequencing its activities to prevent becoming a bandwidth and memory guzzling application The malware is based on a multi-level deception. Level one is that of an anti-virus application, level two involves routing victims to fake sites, level 3 involves preventing screen lock and other mechanisms, level 4 involves exfiltration of data to enable hackers to target non-banking sites connected with the victim. Sectrio’s researchers have come across sites that are offering this malware for rent for anywhere between 500 USD (low grade with simple functions) to USD 4500 (all functions and a guarantee on performance) per month Escobar could potentially be used to target enterprises and government agencies from here on. Considering the breadth of its functions, it could potentially turn into a tool for corporate espionage, blackmail, or even theft and sale of financial data. The only way to stay safe from this malware is by downloading apps only from the Google Play Store. Join our upcoming webinar: Key Takeaways from the Sectrio’s Global Threat Landscape Assessment Report 2022 IoT and OT focused threat Intelligence feeds free for 15 days! Try it right now: Threat Intelligence Also Read: Why IoT Security is Important for Today’s Networks? We also have the right cybersecurity solutions for your critical infrastructure. Allow us to give you a sneak preview of its capabilities through a no-obligation demo.

What could be next for the Escobar malware? Read More »

Is the US on the cusp of a major regulatory overhaul around cybersecurity 1

US is on the cusp of a major regulatory overhaul around cybersecurity

Compliance, Cyber Security / Prayukth K V

According to these publications, the US is working on revamping the cybersecurity regulatory framework to move away from a regime that is currently based on voluntary threat assessment and management to one that is based on regulations enforced by the federal government. The move comes in wake of increasing cyberthreats to IT, IoT, and OT-based infrastructure emerging from the ongoing conflict in Eastern Europe among other factors. US lawmakers and regulatory agencies have identified the following trends as reasons for concern: New threats emerging from APT groups and actors connected to the conflict and other countries harboring adversarial intentions against the US Lack of a disciplined approach to cybersecurity by businesses Voluntary regulatory requirements are not being met The tendency to attribute successful cyberattacks to the extraordinary skills of hackers and the groups they are part of In the pandemic era, businesses that are now bouncing back from periods of low revenue and growth are now focusing on growth rather than cybersecurity measures to protect and sustain growth The threat perception of businesses in certain sectors is not aligned to ground realities Current discretionary measures are not encouraging businesses to address cybersecurity concerns on priority and treat them with the same level of seriousness as that of health and safety and environment-related priorities that are highly regulated Such trends could lead to a complete overhaul of cybersecurity legislation and the US may even bring in sector-specific regulations to improve the cybersecurity posture of the US as a country by getting businesses and industries as a whole to shrink postural gaps through regulatory compliance measures. Also Read: Is NIST working on a potential cybersecurity framework update? With improvements in malware development and payload delivery mechanisms, hackers are increasingly staying a step ahead of countermeasures. However, businesses that have multiple levels of cyberdefenses and operate with requisite levels of awareness and diligence often detect and prevent cyberattacks. Further, companies that have invested in building and operationalizing a comprehensive cyber governance regime internally and across their supply chains are at a clear advantage as compared to peers who are focused only on operational aspects and revenue. Is a cybersecurity overhaul the way forward? Governments in the UK, Singapore, India Australia, and UAE are working on some form of regulatory intervention to get businesses to pay more attention to cybersecurity. Governments in these countries are also facing the same challenges that the US government is facing in getting businesses to voluntarily adopt and comply with better cybersecurity practices and report incidents early. Legislations enacted by the US may also trigger similar legislation in other countries that are not considering any cybersecurity-related legislation at present. Also Read: The state of OT and IoT cybersecurity in North America However, one factor that we need to consider while relying on regulations is the ever-changing threat landscape. Every fortnight we are seeing the emergence of new actors, threat vectors, breach tactics, and collaborations. Access to complex malware and multi-loaders is now easier than ever and we have seen a significant deterioration of the threat environment since 2020. Thus, in addition to regulatory mechanisms, there should also be a commitment to modify these regulations periodically to keep them relevant and aligned to the threat environment and other important dynamic factors that have a bearing on cybersecurity. Regulations should also encourage businesses to collaborate on best practices at an industry or a peer-to-peer level on cybersecurity issues. To learn more about how to improve your compliance posture, download our compliance kits. Join our upcoming webinar: Key Takeaways from the Sectrio’s Global Threat Landscape Assessment Report 2022 IoT and OT focused threat Intelligence feeds free for 15 days! Try it right now: Threat Intelligence Also Read: Why IoT Security is Important for Today’s Networks? We also have the right cybersecurity solutions for your critical infrastructure. Allow us to give you a sneak preview of its capabilities through a no-obligation demo.

US is on the cusp of a major regulatory overhaul around cybersecurity Read More »

Will splinternet lead to the rise of new sophisticated malware

Splinternet will lead to the evolution of new and sophisticated malware

Cyber Security / Prayukth K V

Russia, Belarus, and China have taken some definite steps towards breaking off their internet into a separate entity that is controlled by the state. Russia has had a history of conducting tests to disconnect itself from the internet. China has already its version of the WWW complete with an ecosystem of developers and government controls. This may just be a sneak preview of things to come as more countries invest in ways and means to fragment the internet into manageable pieces. The lowest common factor among all these countries is the increasing need being felt by their governments to control what citizens get to see, read and interact with. Though in its early days, we can be sure that the move to balkanize the internet is surely gaining momentum and soon we may not just have state-level internets but some countries may even join hands to form internet blocks (groups) to ensure greater control and more ‘digital sovereignty. One aspect of this balkanization that has not been studied extensively is its impact on web cybersecurity. Since the internet is primarily a vehicle for the transfer of not just data, but also malware and threat vectors, this is an aspect that merits greater scrutiny. Will Splinternet lead to a deterioration in the cyber risk environment globally? The short answer is yes. Let me explain why. Splinternet essentially is not going to be just a simple fragmentation of the internet. Instead, with greater digital control over the digital data transfer, state-backed APT groups could get a dedicated digital corridor to try out new tactics and malware while staying hidden from any form of scrutiny or exposure. Malware and breach tactics could be tried in isolation till a certain level of maturity is attained for using them to target critical infrastructure installations connected to the wider internet. North Korea’s Kwangmyong (Bright Light or bright star’) essentially a digital “walled garden” offers some insights into how some of these fragmented intranets may evolve in the future. North Korean hackers have been accused of stealing $400 mn worth of digital assets through 7 attacks on cryptocurrency platforms last year. The hackers used a series of methods including phishing, code exploits, and malware to exfiltrate funds from hot wallets. In 2019, a UN panel focused on sanctions on North Korea, issued a report suggesting that it had raised two billion dollars through cybercrime. That’s a lot of money and in addition to funding state coffers, it could also sustain multi-stage and multi-state hacking operations for years to come. A bigger concern is the level of discipline and patience shown by North Korean hackers who are said to have waited for a whopping 17 months after their first reconnaissance attack before returning to target Bangladesh Central Bank. Sectrio has recorded the footprint of the Lazarus group in attacks on financial services entities across the globe. This includes low-grade phishing attacks on banks that specialize in micro-finance or small-scale credits to small and medium businesses. The growing capabilities of North Korean hackers point to the specialized training they receive on focused digital platforms in addition to psyop techniques to orient hackers to stay loyal. Such efforts will gather momentum with Splinternet. Further, with reduced and select information being made available to citizens, it will be easier to put together freshly minted and newly indoctrinated recruits for expanding existing hacking teams. Such teams will get to work on dedicated intranet fragments and then unleash mayhem on WWW once they are ready. Also Read: Why IoT Security is Important for Today’s Networks? For cyber defenders, CERT teams, protectors of critical infrastructure, and those involved in IoT and OT cybersecurity, Splinternet will add another layer of intrigue and make it harder to pinpoint individual hackers who will be emboldened due to the extra protection offered by the new digital boundaries. The impact of Splinternet on cybersecurity can be summed up as below: To learn more about North Korean hackers and their operational footprint, get your hands on the latest copy of our IoT and OT threat landscape assessment report. Stay ahead of hackers with our contextual threat intelligence feeds for IoT and OT security Join our upcoming webinar: Key Takeaways from the Sectrio’s Global Threat Landscape Assessment Report 2022 To learn more about how to improve your compliance posture, download our compliance kits. We also have the right cybersecurity solutions for your critical infrastructure. Allow us to give you a sneak preview of its capabilities through a no-obligation demo.

Splinternet will lead to the evolution of new and sophisticated malware Read More »

Why IoT Security is Important for Today’s Networks?

Cyber Security, IoT / Sharath Acharya

Internet of Things is the acronym for IoT. With each ticking second, our lives are becoming more intertwined with digital gadgets and spaces. The Metaverse revolution set to unfold soon only deepens our digital interactions. Given the non-standard manufacturing of IoT devices and troves of data flowing through the IoT devices, we are constantly exposed to cyber-attacks. Vulnerabilities, cyber-attacks, data theft, and other risks arising from the usage of IoT devices make the need for IoT security solutions even more. Why do we need IoT Security Solutions in today’s networks? Lack of physical boundaries, improperly configured systems, non-standard gadget manufacturers, poor QC & QA (Quality Assurance and Quality Control) make a strong case when talking about IoT Security Solutions. The need for IoT security solutions is supported by two primary cases: Securing the functionality and digital perimeter of a network Data privacy IoT Devices – Network – Data in Numbers: Division Value Estimated IoT connections (by 2024) 83 Billion Active IoT Devices as of 2021 10 Billion IoT Devices Market by 2026 $1.3 Trillion IoT Medical Devices by 2025 $62 Billion Data generated by IoT devices by 2025 73.1 Zettabyte IoT Device connections per minute by 2025 150,000+ Global IoT Healthcare Market reach $14 Billion Estimated IoT Spending 2019 – 2025 $15 Trillion Market size of IoT in retail by 2025 $94.5 Billion Estimated Cellular IoT Connections by 2023 3.5 Billion The worth of IoT enabled Smart Factories in the US by mid-2022 $500 Billion IoT devices used in clinics, medical offices, and hospitals in 2020 (according to Forbes) 646 million Annual spending on IoT Security Solutions in 2021 (according to Forbes) $631 million Common Threat for IoT devices: The foremost challenge for IoT devices is the wide range of threat vectors that they are often subjected to. While few are due to manufacturers and firmware developers, others can be due to targeted cyber-attacks and system exploitation. No wonder, as many as 2 in every 3 households in the United States complained about cyber encroachment in the past couple of years. Most of them don’t have IoT security solutions in place to protect their data. How hackers enter networks: Outdated Operating Systems IoT devices running outdated/unsupported OS are easily exploited. Hackers can bring down an entire network by accessing a single vulnerable system on the network. The 2017 WannaCry Ransomware targeted 300,000 machines running on Windows. It successfully breached those systems which had no security updates. Poor Testing & Encryption Poor QC and QA lead to poor testing and encryption. Adding the lack of IoT security solutions to the network with such devices means exposing the network to attacks. With the increased availability of high technology, eavesdropping has become a profession. Israeli researchers managed to eavesdrop using a light bulb! Exposed Service Ports (Telnet and SSH) A report on ZDNet in 2020 revealed that credentials of over 500,000 IoT devices, home routers, and servers were published by a hacker, after the Telnet ports we left open. Similarly, in 2017, Rapid7’s National Exposure Index claimed that over 10 million IoT and other devices have their Telnet ports open. The development teams should close the Telnet ports post-product deployment. DDoS (Distributed denial-of-service) Attack Botnets are used to send enormous traffic to the server/device causing it to stop functioning. In 2016 internet service provider Dyn became the victim of a large DDoS attack. This led to a severe outage. Entry through HVAC and other Systems Entry through HVAC and other remotely controlled systems is the biggest threat IoT networks face. Usually, vendors are given remote access for the installation of systems and firmware. The endpoints of the vendor systems are often unprotected by a strong firewall and IoT security solutions. Hackers see this as an entry to gain access to the entire IoT network. Also Read: Rising threats on Critical Infrastructure amidst the Ukraine crisis 3 Most Vulnerable IoT Networks for Hackers! Each IoT network comes with its band of IoT security solutions deployed at various levels and failure points. The Medical, Consumer, and Commercial IoT networks are often the most affected. In a Consumer IoT network, the failure points are one too many. Devices operating on ancient operating systems and default passwords are the most vulnerable points. In Commercial IoT networks, remote access vendors of unmanaged IoT devices are often the primary cause. Affordability (in the case of Consumer IoT devices), and insufficient security testing are often the primary reasons for threats arising in Consumer IoT and Commercial IoT networks. Unsupported/outdated operating systems and devices from diverse vendors running various operating systems are the challenges faced by the Minerals and Mining industry. Despite various IoT security solutions that enterprises and consumers deploy, hackers still manage to break into networks through IoT devices and cause cascading effects. Without real-time management and dependable security solutions, these networks are often the softest targets for any hacker, hands down. Even critical infrastructure is currently nowhere equipped to deal with a swarm of intense cyber-attacks. Insiders make the case for IoT Security Solutions compelling! Many industries face the threat of snooping by their employees. There are verified reports of insiders planning to inject ransomware into systems, giving autonomous control and access to critical data to hackers. If not for the change of mind of the employee, Tesla would have been the victim of a bribed ‘malware attack’ on its system in 2019. Enterprises must step up in how they would limit the access to critical and sensitive information only to a very few, without affecting the Knowledge Transfer and other production aspects. This opens up a whole new dimension – the need to protect data even when internal systems are compromised. This is where IoT security solutions come into play and are often the salvation for many enterprises. Take a look at the state of OT and IoT cybersecurity in North America to understand how the kind of challenges OT and IoT infrastructure is currently facing. The big question: Are IoT Devices safe? The answer is

Why IoT Security is Important for Today’s Networks? Read More »

BazarLoader malware opens a new frontier in cyberspace

Cyber Security, ICS, IoT, OT / Prayukth K V

While reports were coming in of hackers using company forms to trick employees to download a variant of BazarLoader malware, Sectrio’s research team has come across another method that hackers are using to push this malware. What is BazarLoader? It is a very stealthy and sophisticated malware that serves as the level one infector to drop multiple payloads. Since it serves to push for multiple malware payloads once installed, it is a much sought out malware among hackers. It is by design a highly resilient and complex malware that has been used extensively in multiple campaigns including those associated with Ryuk and Conti. BazarLoader utilizes the EmerDNS domain name and record system which is based on blockchain. This renders it safe from any form of censorship and modification from non-author entities. So, shutting the associated domains is a tough proposition. Since the last few weeks, security teams have been discussing hackers using company forms to push infected links. WeTransfer, TransferNow, and in some instances even Dropbox links were being used to transfer a .ISO file with a .LNK shortcut and a masked DLL file after the hacker established a line of communication with the purported victim. Sectrio’s researchers intercepted an email earlier today that claimed to be coming from a prominent software review site. A look at the email address revealed that it was from another domain altogether and was being pushed through many server loops to improve its authenticity. On clicking any link, the attack chain is activated with the download of an .ISO file with the shortcut and the masked DLL file. Since this email was targeting a team that would usually be interested in such communication, this was likely a targeted attack through a spoofed ID. Such variation in phishing methods within just a couple of weeks indicates that hackers are working hard to improvise their tactics to push BazarLoader. For more informational content, subscribe to our weekly updates and stay tuned with updates from Sectrio. Try our rich OT and IoT-focused cyber threat intelligence feeds for free, here: IoT and OT Focused Cyber Threat Intelligence Planning to upgrade your cybersecurity measures? Talk to our IoT and OT security experts here: Reach out to sectrio. Visit our compliance center to advance your compliance measures to NIST and IEC standards: Compliance Center Get access to enriched IoT-focused cyber threat intelligence for free for 15 days

BazarLoader malware opens a new frontier in cyberspace Read More »

By Industry

By Compliance

Business Needs

Services

Contact Us