Utilities

Wikipedia defines a dead drop or dead letter box is a method of espionage tradecraft used to pass items or information between two individuals using a secret location. In cyberspace, however, a variant of this tradecraft has emerged in the last few years. This involves rogue insiders in organizations dumping valuable data including credentials, network information, or even ways to bypass security measures in online forums or the Dark Web. They expect hackers to find and use this data to target their organization as a means of exacting revenge or settling scores as the case may be.  We are encountering many such data dumps across forums now as dead drops. In the last few months, the number of such drops encountered by our research team has risen steadily enough to warrant concern and action. Insiders are compromising even highly confidential information belonging to employees such as pitch decks, pricing documents, and meeting minutes. From the shop floor, production schedules, device information (including patch status in some instances), machinery information, default system control passwords for remote devices, and more are compromised.  More than the loss of data, it is the exploitation of such data that should worry businesses. It also represents the failure of data protection measures at many levels. Such drops are also making it easier for hackers to breach networks and systems and encrypt data and demand ransom for its release.    Dealing with the insider threat (Dead Drops) The US Cybersecurity and Infrastructure Agency (CISA) recommends the institutionalization of preventive measures. This includes the establishment of an Insider Threat(Dead drops) Program Office to work towards progressively lowering this threat. It also recommends detection and managing access by gathering and investigating incident and threat information, assess and categorize those risks; then implement management strategies to mitigate the threats.   In addition to these, businesses can also establish perimeters around information and only allow logged access on a need-to-know basis to avoid dead drops. No information should be published in a place where it can be accessed without leaving a trail behind. Information audits should also be conducted periodically to identify data that has been stored or accessed without adequate access management measures or permission.       Even discussions on sensitive data should be discouraged outside the group that needs to access and use that data.   In case of a breach, through a detailed forensic investigation, the source of the breach should be identified.   How can Sectrio help  Sectrio’s products for IoT-OT and IT security can help detect cyber-attacks early and prevent them from succeeding. Our products are designed to offer critical infrastructure-grade security to protect your data and assets from hackers and other malicious actors.   Sectrio is a leading IoT and OT cybersecurity vendor. Our offerings include:  Vulnerability management module: helps identify and address vulnerabilities and prevent hackers from exploiting them. Discover authenticated and rogue devices.  Threat management module: gain deep insights into network activity to detect threats    Micro segmentation module: deploy compliance measures at a granular level, prevent lateral movement of malware. IoT-OT-IT Converged Security Suite: secure systems across IoT, OT, and IT; prevent attacks and movement of malware and threats Threat intelligence: Together with a strong insider threat management program, our offerings can secure your business.   To see how our offerings can help your business, book a demo now.  

As per Sectrio’s Threat Landscape Report for H1 2021, Cyber-attacks on Middle Eastern entities continued to rise this year with more cyberattacks logged from 5 known clusters outside the region targeting critical infrastructure, manufacturing, utilities, and oil and gas sectors. Most of these attacks were characterized by: An exponential increase in the degree of sophistication  A strong geopolitical connect  The timing of the attacks was designed to coincide with major offline events including the onset of holidays, reopening of offices, and even government to government discussions Malware deployed in the region showed higher levels of new codes and segments indicating that the hackers may be working towards exclusively targeting entities in the region or using the region as testing grounds Attacks on manufacturing registered a 200 percent rise  New APT clusters have sprung up within the region and are now targeting strategic sectors of the economy in countries like Saudi Arabia, UAE, and Oman The level of activity associated with regional and external APT actors continues to be a source of concern. Some of these players are also collaborating by exchanging information on vulnerabilities and privileges some of which seem to have come from rogue insiders. There is also evidence for an increase in the number of dead drops (data willingly and illegally released by disgruntled insiders) across the UAE, Bahrain, Kuwait, and Oman. Download the Global threat landscape report for H1, 2021 today Attacks on oil and gas entities and manufacturing sectors continue to rise disproportionately. Through infrastructure optimization measures, many new devices and systems were introduced into the networks of companies in these two sectors across 2020 and 2021. These devices are introducing new vulnerabilities into the system and creating opportunities for large-scale breaches to occur in the future. Key takeaways from the global threat landscape report for the Middle East region: Businesses need to do a lot more to detect and address vulnerabilities and rogue insider activity OT cybersecurity is not getting as much attention as it should. Businesses should look at identifying a credible OT security vendor like Sectrio to address challenges related to OT, SCADA, and ICS security The window of opportunity available for hackers to exploit has expanded since the pandemic began. The data stolen from businesses in the initial days of the pandemic continue to appear on the Dark Web and other forums Several vulnerabilities have emerged in 2021 chiefly due to a lack of discipline with patching and deploying updates IoT security took a back seat because of the availability of cheaper and untested devices Businesses need to urgently revisit their cybersecurity posture and work towards adding more layers of security to protect their infrastructure  Worried about your cybersecurity posture, talk to us and we will help you address challenges related to OT and IoT security. As a leading IoT and OT cybersecurity vendor, Sectrio has the solutions and consulting expertise to help. Talk to us today.

Problem statement: improving cybersecurity in water and wastewater treatment plants Solution: use a multi-phased approach targeting vulnerabilities and use of cybersecurity best practices to deter, detect and contain cyberattacks  The average water plant doesn’t have a cybersecurity expert on its rolls and that is just one part of the problem. Another part has to do with the emergence of sophisticated hacker groups that are working to target such facilities. The last part has to do with many vulnerabilities in the IoT and OT systems that remain unaddressed due to various reasons. Fact: in October 2021, cyberattacks on water and wastewater treatment plants rose 7 percent across the globe. Source: Sectrio Threat Research Team Impact of a cyberattack on a water and wastewater treatment plant Through a potential breach, a hacker could potentially control key parts of the plant. This includes the pumping system, valve control, and even the control room. All these components are either powered by OT systems like SCADA and PLC or have some degree of automation enabling remote management. By being in control, the hacker can add or remove some chemicals that are added to the water being treated rendering the water unfit for human consumption, or in the case of wastewater, it may not be suitable for release into the environment. While the problem is being tackled by operators regulatory interventions can help nudge operators to move faster. In the US, America’s Water Infrastructure Act of 2018 or AWIA is a step in that direction. AIWA’s stated objectives include improving drinking water and water quality, deepening infrastructure investments, enhancing public health and quality of life, increasing jobs, and bolstering the economy.   Implications of AIWA The Act which was signed into law in October 2018, mandates community water systems that serve a population of over 3,300 persons to conduct a risk and resilience assessment of all systems. This includes assessing the state of security of any electronic, computer, or other automated systems that the community water system uses. While this Act has been in existence for nearly 3 years now, there have been some major cyberattacks against water treatment facilities in the US. These attacks have occurred due to a lack of diligence and a lack of understanding of the threat environment and risk factors that impact the functioning of such facilities. How water treatment plants can improve IoT, OT, and IT cybersecurity Water distribution and water treatment operators have to pay more attention to the type of attacks that are happening around them. In addition, they also need to understand the mode of attacks and the mechanisms that could be used to detect, contain and remediate such attacks. As critical infrastructure, all elements of plant operation and management have to be accorded the highest level of priority. Operators need to pay attention to the following: Vulnerability detection and remediation Getting the right threat intelligence to detect threat vectors Prevent rapid and unchecked expansion of threat surfaces No untested and unchecked device or component should be added to the plant infrastructure. Each device should be tested for vulnerabilities Networks should be segmented and micro segmented to ensure more control over activities Prepare a roadmap for plant cybersecurity covering IoT, IT, and OT assets Embrace frameworks such as Zero Trust and IEC 62443 to ensure integration of sound cybersecurity practices at all levels of operations Such measures will help strengthen the implementation of America’s Water Infrastructure Act and secure the plant from sophisticated actors and malware to some extent. More diligence will however be needed continually to ensure that plant machinery and operations are kept safe and secure.  Key takeaways Plant security has to be addressed at multiple levels Unless there is a clear understanding and appreciation of the threat environment that surrounds public utility infrastructure and the need to protect them, such assets cannot be secured Networks and infrastructure have to be secured through best practices A roadmap for security is essential and will serve as a guide to scale cybersecurity practices Frameworks will act as force multiplier Plant employees have to be sensitized  Watch the ON demand webinar here:Cyberattack Prevention for the Water & Wastewater Industry