\n

\"One thing to note here is that ransomware has to announce itself to be successful,\" adds Tim Erlin, VP at Tripwire. \"In industrial environments, cyber events aren\u2019t always this visible. Increasing visibility into industrial networks becomes more important as attackers continue to target critical infrastructure.\u201d<\/p>\n\n\n\n

Brad Brooks, CEO and President of OneLogin, rightfully concludes: \"This attack represents just how quickly the stakes are escalating on Cybersecurity, with controlling and knowing who has access to your IT systems a board level priority for every company. We are moving from an invisible Cold War that was focused on stealing data to a highly visible hot war that has real implications for physical property and people\u2019s lives.\u201d<\/p>\n","post_title":"Ransomware roundtable | A threat in the pipeline","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"ransomware-roundtable-a-threat-in-the-pipeline","to_ping":"","pinged":"","post_modified":"2021-05-10 18:12:55","post_modified_gmt":"2021-05-10 17:12:55","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=6024","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4871,"post_author":"3","post_date":"2021-02-09 19:22:22","post_date_gmt":"2021-02-09 19:22:22","post_content":"Detectives assigned to the Digital Forensics Unit at Pinellas County Sheriff\u2019s Office are investigating an unlawful computer software intrusion at the City of Oldsmar\u2019s water treatment plant. While the cyber attack was unsuccessful, it does highlight the need for cybersecurity tools in critical infrastructure applications.\n\nOn Friday, February 5, 2021, the Pinellas County Sheriff\u2019s Office was notified by the City of Oldsmar that its computer system had been remotely accessed at 8:00am and 1:30pm by an unknown suspect. According to detectives, the City of Oldsmar\u2019s computer system at the water treatment plant allows for remote access by authorised users to troubleshoot any system problems from other locations.\n\nThe initial intrusion was brief and not cause for concern due to supervisors regularly accessing the system remotely to monitor the system. At 1:30, a plant operator witnessed a second remote access user opening various functions in the system that control the amount of sodium hydroxide in the water. The operator noted the remote access user raised the levels of sodium hydroxide in the water from 100 parts per million to 11,100 parts per million. The operator immediately reduced the levels to their appropriate amount. Sodium hydroxide is used in small amounts to control acidity, but a large amount could have caused major problems in the water.\n\nThe initial investigation revealed that the hacker remotely accessed the treatment plant\u2019s computer for approximately 3 to 5 minutes. Speaking at a press conference about the cyber attack, Sheriff Bob Gualtieri stated: \u201cAt no time was there a significant effect on the water being treated, and more importantly the public was never in danger.\u201d\n\nCommenting on the attack, Andrea Carcano, co-founder at Nozomi Networks stated: \u201cUnfortunately, this attack plays into a troubling trend we\u2019ve been following over the last year. As the pandemic forced critical infrastructure organisations to quickly shift to remote access options to keep systems up and running, we\u2019ve seen threats rise and bad actors reach new lows \u2013 setting their sights on life threatening targets. Fortunately, in this case, operators monitoring Oldsmar\u2019s treatment plant spotted the attack and were able to respond before anyone could be harmed. But it\u2019s a stark reminder that with limited cybersecurity resources and few regulations water utilities are vulnerable to attack. When it comes critical infrastructure, operational resilience must a top priority and advances in AI-powered OT security and network monitoring are available to give operators the network visibility they need to quickly spot trouble and respond before harm is done.\u201d\n\n\u201cThis targeted attack appears to have started by the \u2018bad actor\u2019 getting access to a vulnerable network\/system and working their way through the network trying to find the next weak access point while gathering data and understanding how the organisation operates along the way,\u201d added Niamh Muldoon, Global Data Protection Officer at OneLogin. \u201cIn this instance, understanding the information assets, applying not only MFA but enhanced multi-factor authentication, would have reduced the risk of this unauthorised attack materializing. It\u2019s a critical part of the MFA policy to enforce time limits for end-users and their trusted devices to re-authenticate, requiring them not only to validate themselves but also the identity of the device trying to access critical systems\/applications and the network. Without knowing more of the details, applying enhanced MFA to the execution of critical actions particularly for IT and systems administrators would have reduced the associated risk further. Having logging in place, and understanding logged events would support with the associated monitoring and alerting events. After the event has happened, crisis management is critical for successfully managing the attack response to reduce business impact and consequences, and it appears the Florida agency has done that.\u201d\n\n\u201cWhile this incident will rightfully cause concern, it appears that likelihood of real damage was minimal due to the fail safes in place,\u201d observes Tim Erlin, VP at Tripwire. \u201cThere are real impacts to be worried about, and actions to be taken, but this doesn\u2019t appear to be a sophisticated or novel attack. From a cybersecurity standpoint, we should be particularly concerned about how the attacker was able to authenticate into the remote access software. That entry point should be very well protected, given that it provides access to such obviously sensitive capabilities. Protecting remote access into industrial systems where these types of changes can be made should be a high priority for any industrial environment.\u201d\n\nLocal, State, and Federal investigators are working together to identify those responsible and the investigation is ongoing. Other utility providers have been informed of the intrusion, so they can take their own protective measures.","post_title":"Florida water system cyber attack highlights role of cybersecurity in critical infrastructure","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"florida-water-system-cyber-attack-highlights-role-of-cybersecurity-in-critical-infrastructure","to_ping":"","pinged":"","post_modified":"2021-02-09 19:22:25","post_modified_gmt":"2021-02-09 19:22:25","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4871","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4178,"post_author":"3","post_date":"2020-12-07 14:52:36","post_date_gmt":"2020-12-07 14:52:36","post_content":"Nozomi Networks and Chinook Systems have partnered to provide advanced cybersecurity solutions to protect industrial and critical infrastructure facilities across North America. Under the deal, Chinook will offer Nozomi Networks\u2019 complete portfolio of OT and IoT security solutions.\n\n\u201cFacilities that fully leverage their OT systems deliver tremendous returns when it comes to energy and operational savings, the safety and comfort of occupants and lower total cost of ownership,\u201d said Chinook\u2019s President, Wanda Lenkewich. \u201cAt the same time, the network connectivity that enables these systems, also introduces new and growing cyber threats. Partnering with Nozomi Networks allows Chinook to support clients with an integrated, comprehensive cybersecurity solution that ensures cyber threats are actively discovered, monitored and managed.\u201d\n\n\u201cWe are absolutely delighted to team with Chinook to help industrial and critical infrastructure facilities meet new requirements for secure connectivity across OT, IT and IoT networks,\u201d said Chet Namboodri, Vice President, Worldwide Business Development and Channel Sales at Nozomi. \u201cWe\u2019ve already worked together to deliver on a number of joint customer engagements in both the government and commercial sectors. Partnering with Chinook accelerates our joint efforts to make sure facility-related control and building management systems are safe from cyber threats.\u201d\n\nwww.nozominetworks.com<\/a>\n\nwww.chinooksystems.com<\/a>\n\n ","post_title":"Nozomi Networks and Chinook Systems partner for OT and IoT security solutions","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"nozomi-networks-and-chinook-systems-partner-for-ot-and-iot-security-solutions","to_ping":"","pinged":"","post_modified":"2020-12-07 14:52:40","post_modified_gmt":"2020-12-07 14:52:40","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4178","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4140,"post_author":"3","post_date":"2020-12-03 11:07:21","post_date_gmt":"2020-12-03 11:07:21","post_content":"Civil Nuclear Constabulary (CNC) police officers based at Harwell have launched Project Servator a collaborative community approach to policing. Project Servator aims to disrupt a range of criminal activity, including terrorism, while providing a reassuring presence for the public.\n\nCNC\u2019s officers are experienced and specially trained to spot the tell-tale signs that someone is planning or preparing to commit an illegal act. It works with other police forces, local businesses and the public to protect the Harwell site and the surrounding area and everyone who lives, works or visits there and to make it a difficult place for terrorists and other criminals to operate. Project Servator has been successful in gathering intelligence that has assisted Counter Terrorism Units across the UK in investigating and preventing acts of terror.\n\nProject Servator\u2019s patrols are highly visible and can happen at any time and in any location. Officers will talk to the public and local businesses to let them know what they\u2019re doing and remind them to be vigilant, trust their instincts and report any suspicious or unusual behaviour.\n\n\u201cWe are deploying these additional tactics to further complement the operational activity that exists in and around our Operational Policing Units,\u201d explained Supt Donna Jones, who is leading on the implementation of the project across the Constabulary. \u201cOur aim is to build upon relationships with partners as well as businesses and communities. These tactics are not new but allow us to have a focus on community engagement and encourage people to be our extra eyes and ears. This is not restricted to the Harwell site but also extends to the surrounding area. We are aware of the vast amount of information members of our community have and they are aware of what is out of the ordinary. All we ask is that they report any suspicions to us and we\u2019ll do the rest. The deployments will be unpredictable and our tactics will vary from one deployment to the next. The aim is to work with our local communities to deter any hostile threat.\u201d\n\nwww.gov.uk\/government\/organisations\/civil-nuclear-constabulary<\/a>","post_title":"CNC Harwell launches Project Servator","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"cnc-harwell-launches-project-servator","to_ping":"","pinged":"","post_modified":"2020-12-03 11:07:23","post_modified_gmt":"2020-12-03 11:07:23","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4140","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4102,"post_author":"3","post_date":"2020-11-30 17:30:23","post_date_gmt":"2020-11-30 17:30:23","post_content":"Radiflow and Mitsubishi Electric UK are collaborating to address the needs of IEC62443 cyber security standards in the Critical Infrastructure and Industrial Automation markets. The companys believe that the combination of the automation knowledge and tools of Mitsubishi Electric UK with the cyber security and IEC 62443 compliance skills of Radiflow will provide a holistic view of a client\u2019s risk posture.\n\nRadiflow will also provide Mitsubishi Electric UK customers with a consultancy service for cyber security, which includes the provision of OT security risk assessments, provision of Radiflow intrusion detection software and general advice on alignment with IEC 62443-3. In addition, the solution is intended to help customers to support asset owners in satisfying the requirements of the NIS Directive along with due diligence in alignment with CPNI (Centre for the Protection of National Infrastructure) best practice.\n\n\u201cOur new collaboration with Radiflow provides expertise in the field of OT cyber security which compliments and broadens the services that we offer our customers through the Mitsubishi Electric UK System Service Operation,\u201d said David Bean, Solutions Manager for Mitsubishi Electric UK. \u201cThere is a growing demand for solutions that address the requirements of cyber security in the OT space and we are looking forward to delivering those solutions and building our relationship further with the team at Radiflow.\u201d\n\n\u201cRadiflow sees huge value for OT organisations to have cyber security services and solutions aligned with their automation systems,\u201d added Ilan Barda, Founder and CEO of Radiflow. \u201cBy combining the automation knowledge and tools of Mitsubishi with the OT cyber security skills and tools of Radiflow, we are able to provide a holistic view of an organisation\u2019s OT risk posture.\u201d\n\nwww.radiflow.com<\/a>","post_title":"Radiflow and Mitsubishi Electric UK collaborate on cyber security standards","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"radiflow-and-mitsubishi-electric-uk-collaborate-on-cyber-security-standards","to_ping":"","pinged":"","post_modified":"2020-11-30 17:30:25","post_modified_gmt":"2020-11-30 17:30:25","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4102","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":3359,"post_author":"3","post_date":"2020-10-16 17:11:16","post_date_gmt":"2020-10-16 16:11:16","post_content":"Senstar explains how its products can be applied to protect the full range of upstream, midstream, and downstream facilities in the oil and gas industry.","post_title":"Senstar explains its security solutions for oil and gas","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"senstar-explains-its-security-solutions-for-oil-and-gas","to_ping":"","pinged":"","post_modified":"2020-10-16 17:11:17","post_modified_gmt":"2020-10-16 16:11:17","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=3359","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"}],"next":false,"prev":false,"total_page":1},"paged":1,"column_class":"jeg_col_2o3","class":"epic_block_14"};

\n

\"As so many times before when talking about ransomware \u2013 to lock a system with ransomware you need a good degree of control of that system,\" says Martin Jartelius, CSO at Outpost24. \"While this is indeed a financial disaster, and will have a significant impact on many, let us also consider that this means that, at least for a time, threat actors had control of those very same IT systems. Preventive security, as well as segmentation, are critical for those kinds of environments.\"<\/p>\n\n\n\n

\"One thing to note here is that ransomware has to announce itself to be successful,\" adds Tim Erlin, VP at Tripwire. \"In industrial environments, cyber events aren\u2019t always this visible. Increasing visibility into industrial networks becomes more important as attackers continue to target critical infrastructure.\u201d<\/p>\n\n\n\n

Brad Brooks, CEO and President of OneLogin, rightfully concludes: \"This attack represents just how quickly the stakes are escalating on Cybersecurity, with controlling and knowing who has access to your IT systems a board level priority for every company. We are moving from an invisible Cold War that was focused on stealing data to a highly visible hot war that has real implications for physical property and people\u2019s lives.\u201d<\/p>\n","post_title":"Ransomware roundtable | A threat in the pipeline","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"ransomware-roundtable-a-threat-in-the-pipeline","to_ping":"","pinged":"","post_modified":"2021-05-10 18:12:55","post_modified_gmt":"2021-05-10 17:12:55","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=6024","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4871,"post_author":"3","post_date":"2021-02-09 19:22:22","post_date_gmt":"2021-02-09 19:22:22","post_content":"Detectives assigned to the Digital Forensics Unit at Pinellas County Sheriff\u2019s Office are investigating an unlawful computer software intrusion at the City of Oldsmar\u2019s water treatment plant. While the cyber attack was unsuccessful, it does highlight the need for cybersecurity tools in critical infrastructure applications.\n\nOn Friday, February 5, 2021, the Pinellas County Sheriff\u2019s Office was notified by the City of Oldsmar that its computer system had been remotely accessed at 8:00am and 1:30pm by an unknown suspect. According to detectives, the City of Oldsmar\u2019s computer system at the water treatment plant allows for remote access by authorised users to troubleshoot any system problems from other locations.\n\nThe initial intrusion was brief and not cause for concern due to supervisors regularly accessing the system remotely to monitor the system. At 1:30, a plant operator witnessed a second remote access user opening various functions in the system that control the amount of sodium hydroxide in the water. The operator noted the remote access user raised the levels of sodium hydroxide in the water from 100 parts per million to 11,100 parts per million. The operator immediately reduced the levels to their appropriate amount. Sodium hydroxide is used in small amounts to control acidity, but a large amount could have caused major problems in the water.\n\nThe initial investigation revealed that the hacker remotely accessed the treatment plant\u2019s computer for approximately 3 to 5 minutes. Speaking at a press conference about the cyber attack, Sheriff Bob Gualtieri stated: \u201cAt no time was there a significant effect on the water being treated, and more importantly the public was never in danger.\u201d\n\nCommenting on the attack, Andrea Carcano, co-founder at Nozomi Networks stated: \u201cUnfortunately, this attack plays into a troubling trend we\u2019ve been following over the last year. As the pandemic forced critical infrastructure organisations to quickly shift to remote access options to keep systems up and running, we\u2019ve seen threats rise and bad actors reach new lows \u2013 setting their sights on life threatening targets. Fortunately, in this case, operators monitoring Oldsmar\u2019s treatment plant spotted the attack and were able to respond before anyone could be harmed. But it\u2019s a stark reminder that with limited cybersecurity resources and few regulations water utilities are vulnerable to attack. When it comes critical infrastructure, operational resilience must a top priority and advances in AI-powered OT security and network monitoring are available to give operators the network visibility they need to quickly spot trouble and respond before harm is done.\u201d\n\n\u201cThis targeted attack appears to have started by the \u2018bad actor\u2019 getting access to a vulnerable network\/system and working their way through the network trying to find the next weak access point while gathering data and understanding how the organisation operates along the way,\u201d added Niamh Muldoon, Global Data Protection Officer at OneLogin. \u201cIn this instance, understanding the information assets, applying not only MFA but enhanced multi-factor authentication, would have reduced the risk of this unauthorised attack materializing. It\u2019s a critical part of the MFA policy to enforce time limits for end-users and their trusted devices to re-authenticate, requiring them not only to validate themselves but also the identity of the device trying to access critical systems\/applications and the network. Without knowing more of the details, applying enhanced MFA to the execution of critical actions particularly for IT and systems administrators would have reduced the associated risk further. Having logging in place, and understanding logged events would support with the associated monitoring and alerting events. After the event has happened, crisis management is critical for successfully managing the attack response to reduce business impact and consequences, and it appears the Florida agency has done that.\u201d\n\n\u201cWhile this incident will rightfully cause concern, it appears that likelihood of real damage was minimal due to the fail safes in place,\u201d observes Tim Erlin, VP at Tripwire. \u201cThere are real impacts to be worried about, and actions to be taken, but this doesn\u2019t appear to be a sophisticated or novel attack. From a cybersecurity standpoint, we should be particularly concerned about how the attacker was able to authenticate into the remote access software. That entry point should be very well protected, given that it provides access to such obviously sensitive capabilities. Protecting remote access into industrial systems where these types of changes can be made should be a high priority for any industrial environment.\u201d\n\nLocal, State, and Federal investigators are working together to identify those responsible and the investigation is ongoing. Other utility providers have been informed of the intrusion, so they can take their own protective measures.","post_title":"Florida water system cyber attack highlights role of cybersecurity in critical infrastructure","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"florida-water-system-cyber-attack-highlights-role-of-cybersecurity-in-critical-infrastructure","to_ping":"","pinged":"","post_modified":"2021-02-09 19:22:25","post_modified_gmt":"2021-02-09 19:22:25","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4871","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4178,"post_author":"3","post_date":"2020-12-07 14:52:36","post_date_gmt":"2020-12-07 14:52:36","post_content":"Nozomi Networks and Chinook Systems have partnered to provide advanced cybersecurity solutions to protect industrial and critical infrastructure facilities across North America. Under the deal, Chinook will offer Nozomi Networks\u2019 complete portfolio of OT and IoT security solutions.\n\n\u201cFacilities that fully leverage their OT systems deliver tremendous returns when it comes to energy and operational savings, the safety and comfort of occupants and lower total cost of ownership,\u201d said Chinook\u2019s President, Wanda Lenkewich. \u201cAt the same time, the network connectivity that enables these systems, also introduces new and growing cyber threats. Partnering with Nozomi Networks allows Chinook to support clients with an integrated, comprehensive cybersecurity solution that ensures cyber threats are actively discovered, monitored and managed.\u201d\n\n\u201cWe are absolutely delighted to team with Chinook to help industrial and critical infrastructure facilities meet new requirements for secure connectivity across OT, IT and IoT networks,\u201d said Chet Namboodri, Vice President, Worldwide Business Development and Channel Sales at Nozomi. \u201cWe\u2019ve already worked together to deliver on a number of joint customer engagements in both the government and commercial sectors. Partnering with Chinook accelerates our joint efforts to make sure facility-related control and building management systems are safe from cyber threats.\u201d\n\nwww.nozominetworks.com<\/a>\n\nwww.chinooksystems.com<\/a>\n\n ","post_title":"Nozomi Networks and Chinook Systems partner for OT and IoT security solutions","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"nozomi-networks-and-chinook-systems-partner-for-ot-and-iot-security-solutions","to_ping":"","pinged":"","post_modified":"2020-12-07 14:52:40","post_modified_gmt":"2020-12-07 14:52:40","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4178","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4140,"post_author":"3","post_date":"2020-12-03 11:07:21","post_date_gmt":"2020-12-03 11:07:21","post_content":"Civil Nuclear Constabulary (CNC) police officers based at Harwell have launched Project Servator a collaborative community approach to policing. Project Servator aims to disrupt a range of criminal activity, including terrorism, while providing a reassuring presence for the public.\n\nCNC\u2019s officers are experienced and specially trained to spot the tell-tale signs that someone is planning or preparing to commit an illegal act. It works with other police forces, local businesses and the public to protect the Harwell site and the surrounding area and everyone who lives, works or visits there and to make it a difficult place for terrorists and other criminals to operate. Project Servator has been successful in gathering intelligence that has assisted Counter Terrorism Units across the UK in investigating and preventing acts of terror.\n\nProject Servator\u2019s patrols are highly visible and can happen at any time and in any location. Officers will talk to the public and local businesses to let them know what they\u2019re doing and remind them to be vigilant, trust their instincts and report any suspicious or unusual behaviour.\n\n\u201cWe are deploying these additional tactics to further complement the operational activity that exists in and around our Operational Policing Units,\u201d explained Supt Donna Jones, who is leading on the implementation of the project across the Constabulary. \u201cOur aim is to build upon relationships with partners as well as businesses and communities. These tactics are not new but allow us to have a focus on community engagement and encourage people to be our extra eyes and ears. This is not restricted to the Harwell site but also extends to the surrounding area. We are aware of the vast amount of information members of our community have and they are aware of what is out of the ordinary. All we ask is that they report any suspicions to us and we\u2019ll do the rest. The deployments will be unpredictable and our tactics will vary from one deployment to the next. The aim is to work with our local communities to deter any hostile threat.\u201d\n\nwww.gov.uk\/government\/organisations\/civil-nuclear-constabulary<\/a>","post_title":"CNC Harwell launches Project Servator","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"cnc-harwell-launches-project-servator","to_ping":"","pinged":"","post_modified":"2020-12-03 11:07:23","post_modified_gmt":"2020-12-03 11:07:23","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4140","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4102,"post_author":"3","post_date":"2020-11-30 17:30:23","post_date_gmt":"2020-11-30 17:30:23","post_content":"Radiflow and Mitsubishi Electric UK are collaborating to address the needs of IEC62443 cyber security standards in the Critical Infrastructure and Industrial Automation markets. The companys believe that the combination of the automation knowledge and tools of Mitsubishi Electric UK with the cyber security and IEC 62443 compliance skills of Radiflow will provide a holistic view of a client\u2019s risk posture.\n\nRadiflow will also provide Mitsubishi Electric UK customers with a consultancy service for cyber security, which includes the provision of OT security risk assessments, provision of Radiflow intrusion detection software and general advice on alignment with IEC 62443-3. In addition, the solution is intended to help customers to support asset owners in satisfying the requirements of the NIS Directive along with due diligence in alignment with CPNI (Centre for the Protection of National Infrastructure) best practice.\n\n\u201cOur new collaboration with Radiflow provides expertise in the field of OT cyber security which compliments and broadens the services that we offer our customers through the Mitsubishi Electric UK System Service Operation,\u201d said David Bean, Solutions Manager for Mitsubishi Electric UK. \u201cThere is a growing demand for solutions that address the requirements of cyber security in the OT space and we are looking forward to delivering those solutions and building our relationship further with the team at Radiflow.\u201d\n\n\u201cRadiflow sees huge value for OT organisations to have cyber security services and solutions aligned with their automation systems,\u201d added Ilan Barda, Founder and CEO of Radiflow. \u201cBy combining the automation knowledge and tools of Mitsubishi with the OT cyber security skills and tools of Radiflow, we are able to provide a holistic view of an organisation\u2019s OT risk posture.\u201d\n\nwww.radiflow.com<\/a>","post_title":"Radiflow and Mitsubishi Electric UK collaborate on cyber security standards","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"radiflow-and-mitsubishi-electric-uk-collaborate-on-cyber-security-standards","to_ping":"","pinged":"","post_modified":"2020-11-30 17:30:25","post_modified_gmt":"2020-11-30 17:30:25","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4102","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":3359,"post_author":"3","post_date":"2020-10-16 17:11:16","post_date_gmt":"2020-10-16 16:11:16","post_content":"Senstar explains how its products can be applied to protect the full range of upstream, midstream, and downstream facilities in the oil and gas industry.","post_title":"Senstar explains its security solutions for oil and gas","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"senstar-explains-its-security-solutions-for-oil-and-gas","to_ping":"","pinged":"","post_modified":"2020-10-16 17:11:17","post_modified_gmt":"2020-10-16 16:11:17","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=3359","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"}],"next":false,"prev":false,"total_page":1},"paged":1,"column_class":"jeg_col_2o3","class":"epic_block_14"};

\n

US government officials are currently working with Colonial to help it recover while scrambling to avoid more severe fuel supply disruptions should the outage continue. Whether the pipeline stays shut that long in turn depends on how deeply the hackers penetrated Colonial\u2019s network - and how soon cybersecurity experts can pull them out.<\/p>\n\n\n\n

\"As so many times before when talking about ransomware \u2013 to lock a system with ransomware you need a good degree of control of that system,\" says Martin Jartelius, CSO at Outpost24. \"While this is indeed a financial disaster, and will have a significant impact on many, let us also consider that this means that, at least for a time, threat actors had control of those very same IT systems. Preventive security, as well as segmentation, are critical for those kinds of environments.\"<\/p>\n\n\n\n

\"One thing to note here is that ransomware has to announce itself to be successful,\" adds Tim Erlin, VP at Tripwire. \"In industrial environments, cyber events aren\u2019t always this visible. Increasing visibility into industrial networks becomes more important as attackers continue to target critical infrastructure.\u201d<\/p>\n\n\n\n

Brad Brooks, CEO and President of OneLogin, rightfully concludes: \"This attack represents just how quickly the stakes are escalating on Cybersecurity, with controlling and knowing who has access to your IT systems a board level priority for every company. We are moving from an invisible Cold War that was focused on stealing data to a highly visible hot war that has real implications for physical property and people\u2019s lives.\u201d<\/p>\n","post_title":"Ransomware roundtable | A threat in the pipeline","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"ransomware-roundtable-a-threat-in-the-pipeline","to_ping":"","pinged":"","post_modified":"2021-05-10 18:12:55","post_modified_gmt":"2021-05-10 17:12:55","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=6024","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4871,"post_author":"3","post_date":"2021-02-09 19:22:22","post_date_gmt":"2021-02-09 19:22:22","post_content":"Detectives assigned to the Digital Forensics Unit at Pinellas County Sheriff\u2019s Office are investigating an unlawful computer software intrusion at the City of Oldsmar\u2019s water treatment plant. While the cyber attack was unsuccessful, it does highlight the need for cybersecurity tools in critical infrastructure applications.\n\nOn Friday, February 5, 2021, the Pinellas County Sheriff\u2019s Office was notified by the City of Oldsmar that its computer system had been remotely accessed at 8:00am and 1:30pm by an unknown suspect. According to detectives, the City of Oldsmar\u2019s computer system at the water treatment plant allows for remote access by authorised users to troubleshoot any system problems from other locations.\n\nThe initial intrusion was brief and not cause for concern due to supervisors regularly accessing the system remotely to monitor the system. At 1:30, a plant operator witnessed a second remote access user opening various functions in the system that control the amount of sodium hydroxide in the water. The operator noted the remote access user raised the levels of sodium hydroxide in the water from 100 parts per million to 11,100 parts per million. The operator immediately reduced the levels to their appropriate amount. Sodium hydroxide is used in small amounts to control acidity, but a large amount could have caused major problems in the water.\n\nThe initial investigation revealed that the hacker remotely accessed the treatment plant\u2019s computer for approximately 3 to 5 minutes. Speaking at a press conference about the cyber attack, Sheriff Bob Gualtieri stated: \u201cAt no time was there a significant effect on the water being treated, and more importantly the public was never in danger.\u201d\n\nCommenting on the attack, Andrea Carcano, co-founder at Nozomi Networks stated: \u201cUnfortunately, this attack plays into a troubling trend we\u2019ve been following over the last year. As the pandemic forced critical infrastructure organisations to quickly shift to remote access options to keep systems up and running, we\u2019ve seen threats rise and bad actors reach new lows \u2013 setting their sights on life threatening targets. Fortunately, in this case, operators monitoring Oldsmar\u2019s treatment plant spotted the attack and were able to respond before anyone could be harmed. But it\u2019s a stark reminder that with limited cybersecurity resources and few regulations water utilities are vulnerable to attack. When it comes critical infrastructure, operational resilience must a top priority and advances in AI-powered OT security and network monitoring are available to give operators the network visibility they need to quickly spot trouble and respond before harm is done.\u201d\n\n\u201cThis targeted attack appears to have started by the \u2018bad actor\u2019 getting access to a vulnerable network\/system and working their way through the network trying to find the next weak access point while gathering data and understanding how the organisation operates along the way,\u201d added Niamh Muldoon, Global Data Protection Officer at OneLogin. \u201cIn this instance, understanding the information assets, applying not only MFA but enhanced multi-factor authentication, would have reduced the risk of this unauthorised attack materializing. It\u2019s a critical part of the MFA policy to enforce time limits for end-users and their trusted devices to re-authenticate, requiring them not only to validate themselves but also the identity of the device trying to access critical systems\/applications and the network. Without knowing more of the details, applying enhanced MFA to the execution of critical actions particularly for IT and systems administrators would have reduced the associated risk further. Having logging in place, and understanding logged events would support with the associated monitoring and alerting events. After the event has happened, crisis management is critical for successfully managing the attack response to reduce business impact and consequences, and it appears the Florida agency has done that.\u201d\n\n\u201cWhile this incident will rightfully cause concern, it appears that likelihood of real damage was minimal due to the fail safes in place,\u201d observes Tim Erlin, VP at Tripwire. \u201cThere are real impacts to be worried about, and actions to be taken, but this doesn\u2019t appear to be a sophisticated or novel attack. From a cybersecurity standpoint, we should be particularly concerned about how the attacker was able to authenticate into the remote access software. That entry point should be very well protected, given that it provides access to such obviously sensitive capabilities. Protecting remote access into industrial systems where these types of changes can be made should be a high priority for any industrial environment.\u201d\n\nLocal, State, and Federal investigators are working together to identify those responsible and the investigation is ongoing. Other utility providers have been informed of the intrusion, so they can take their own protective measures.","post_title":"Florida water system cyber attack highlights role of cybersecurity in critical infrastructure","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"florida-water-system-cyber-attack-highlights-role-of-cybersecurity-in-critical-infrastructure","to_ping":"","pinged":"","post_modified":"2021-02-09 19:22:25","post_modified_gmt":"2021-02-09 19:22:25","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4871","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4178,"post_author":"3","post_date":"2020-12-07 14:52:36","post_date_gmt":"2020-12-07 14:52:36","post_content":"Nozomi Networks and Chinook Systems have partnered to provide advanced cybersecurity solutions to protect industrial and critical infrastructure facilities across North America. Under the deal, Chinook will offer Nozomi Networks\u2019 complete portfolio of OT and IoT security solutions.\n\n\u201cFacilities that fully leverage their OT systems deliver tremendous returns when it comes to energy and operational savings, the safety and comfort of occupants and lower total cost of ownership,\u201d said Chinook\u2019s President, Wanda Lenkewich. \u201cAt the same time, the network connectivity that enables these systems, also introduces new and growing cyber threats. Partnering with Nozomi Networks allows Chinook to support clients with an integrated, comprehensive cybersecurity solution that ensures cyber threats are actively discovered, monitored and managed.\u201d\n\n\u201cWe are absolutely delighted to team with Chinook to help industrial and critical infrastructure facilities meet new requirements for secure connectivity across OT, IT and IoT networks,\u201d said Chet Namboodri, Vice President, Worldwide Business Development and Channel Sales at Nozomi. \u201cWe\u2019ve already worked together to deliver on a number of joint customer engagements in both the government and commercial sectors. Partnering with Chinook accelerates our joint efforts to make sure facility-related control and building management systems are safe from cyber threats.\u201d\n\nwww.nozominetworks.com<\/a>\n\nwww.chinooksystems.com<\/a>\n\n ","post_title":"Nozomi Networks and Chinook Systems partner for OT and IoT security solutions","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"nozomi-networks-and-chinook-systems-partner-for-ot-and-iot-security-solutions","to_ping":"","pinged":"","post_modified":"2020-12-07 14:52:40","post_modified_gmt":"2020-12-07 14:52:40","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4178","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4140,"post_author":"3","post_date":"2020-12-03 11:07:21","post_date_gmt":"2020-12-03 11:07:21","post_content":"Civil Nuclear Constabulary (CNC) police officers based at Harwell have launched Project Servator a collaborative community approach to policing. Project Servator aims to disrupt a range of criminal activity, including terrorism, while providing a reassuring presence for the public.\n\nCNC\u2019s officers are experienced and specially trained to spot the tell-tale signs that someone is planning or preparing to commit an illegal act. It works with other police forces, local businesses and the public to protect the Harwell site and the surrounding area and everyone who lives, works or visits there and to make it a difficult place for terrorists and other criminals to operate. Project Servator has been successful in gathering intelligence that has assisted Counter Terrorism Units across the UK in investigating and preventing acts of terror.\n\nProject Servator\u2019s patrols are highly visible and can happen at any time and in any location. Officers will talk to the public and local businesses to let them know what they\u2019re doing and remind them to be vigilant, trust their instincts and report any suspicious or unusual behaviour.\n\n\u201cWe are deploying these additional tactics to further complement the operational activity that exists in and around our Operational Policing Units,\u201d explained Supt Donna Jones, who is leading on the implementation of the project across the Constabulary. \u201cOur aim is to build upon relationships with partners as well as businesses and communities. These tactics are not new but allow us to have a focus on community engagement and encourage people to be our extra eyes and ears. This is not restricted to the Harwell site but also extends to the surrounding area. We are aware of the vast amount of information members of our community have and they are aware of what is out of the ordinary. All we ask is that they report any suspicions to us and we\u2019ll do the rest. The deployments will be unpredictable and our tactics will vary from one deployment to the next. The aim is to work with our local communities to deter any hostile threat.\u201d\n\nwww.gov.uk\/government\/organisations\/civil-nuclear-constabulary<\/a>","post_title":"CNC Harwell launches Project Servator","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"cnc-harwell-launches-project-servator","to_ping":"","pinged":"","post_modified":"2020-12-03 11:07:23","post_modified_gmt":"2020-12-03 11:07:23","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4140","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4102,"post_author":"3","post_date":"2020-11-30 17:30:23","post_date_gmt":"2020-11-30 17:30:23","post_content":"Radiflow and Mitsubishi Electric UK are collaborating to address the needs of IEC62443 cyber security standards in the Critical Infrastructure and Industrial Automation markets. The companys believe that the combination of the automation knowledge and tools of Mitsubishi Electric UK with the cyber security and IEC 62443 compliance skills of Radiflow will provide a holistic view of a client\u2019s risk posture.\n\nRadiflow will also provide Mitsubishi Electric UK customers with a consultancy service for cyber security, which includes the provision of OT security risk assessments, provision of Radiflow intrusion detection software and general advice on alignment with IEC 62443-3. In addition, the solution is intended to help customers to support asset owners in satisfying the requirements of the NIS Directive along with due diligence in alignment with CPNI (Centre for the Protection of National Infrastructure) best practice.\n\n\u201cOur new collaboration with Radiflow provides expertise in the field of OT cyber security which compliments and broadens the services that we offer our customers through the Mitsubishi Electric UK System Service Operation,\u201d said David Bean, Solutions Manager for Mitsubishi Electric UK. \u201cThere is a growing demand for solutions that address the requirements of cyber security in the OT space and we are looking forward to delivering those solutions and building our relationship further with the team at Radiflow.\u201d\n\n\u201cRadiflow sees huge value for OT organisations to have cyber security services and solutions aligned with their automation systems,\u201d added Ilan Barda, Founder and CEO of Radiflow. \u201cBy combining the automation knowledge and tools of Mitsubishi with the OT cyber security skills and tools of Radiflow, we are able to provide a holistic view of an organisation\u2019s OT risk posture.\u201d\n\nwww.radiflow.com<\/a>","post_title":"Radiflow and Mitsubishi Electric UK collaborate on cyber security standards","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"radiflow-and-mitsubishi-electric-uk-collaborate-on-cyber-security-standards","to_ping":"","pinged":"","post_modified":"2020-11-30 17:30:25","post_modified_gmt":"2020-11-30 17:30:25","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4102","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":3359,"post_author":"3","post_date":"2020-10-16 17:11:16","post_date_gmt":"2020-10-16 16:11:16","post_content":"Senstar explains how its products can be applied to protect the full range of upstream, midstream, and downstream facilities in the oil and gas industry.","post_title":"Senstar explains its security solutions for oil and gas","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"senstar-explains-its-security-solutions-for-oil-and-gas","to_ping":"","pinged":"","post_modified":"2020-10-16 17:11:17","post_modified_gmt":"2020-10-16 16:11:17","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=3359","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"}],"next":false,"prev":false,"total_page":1},"paged":1,"column_class":"jeg_col_2o3","class":"epic_block_14"};

\n

Taking back control <\/strong><\/p>\n\n\n\n

US government officials are currently working with Colonial to help it recover while scrambling to avoid more severe fuel supply disruptions should the outage continue. Whether the pipeline stays shut that long in turn depends on how deeply the hackers penetrated Colonial\u2019s network - and how soon cybersecurity experts can pull them out.<\/p>\n\n\n\n

\"As so many times before when talking about ransomware \u2013 to lock a system with ransomware you need a good degree of control of that system,\" says Martin Jartelius, CSO at Outpost24. \"While this is indeed a financial disaster, and will have a significant impact on many, let us also consider that this means that, at least for a time, threat actors had control of those very same IT systems. Preventive security, as well as segmentation, are critical for those kinds of environments.\"<\/p>\n\n\n\n

\"One thing to note here is that ransomware has to announce itself to be successful,\" adds Tim Erlin, VP at Tripwire. \"In industrial environments, cyber events aren\u2019t always this visible. Increasing visibility into industrial networks becomes more important as attackers continue to target critical infrastructure.\u201d<\/p>\n\n\n\n

Brad Brooks, CEO and President of OneLogin, rightfully concludes: \"This attack represents just how quickly the stakes are escalating on Cybersecurity, with controlling and knowing who has access to your IT systems a board level priority for every company. We are moving from an invisible Cold War that was focused on stealing data to a highly visible hot war that has real implications for physical property and people\u2019s lives.\u201d<\/p>\n","post_title":"Ransomware roundtable | A threat in the pipeline","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"ransomware-roundtable-a-threat-in-the-pipeline","to_ping":"","pinged":"","post_modified":"2021-05-10 18:12:55","post_modified_gmt":"2021-05-10 17:12:55","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=6024","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4871,"post_author":"3","post_date":"2021-02-09 19:22:22","post_date_gmt":"2021-02-09 19:22:22","post_content":"Detectives assigned to the Digital Forensics Unit at Pinellas County Sheriff\u2019s Office are investigating an unlawful computer software intrusion at the City of Oldsmar\u2019s water treatment plant. While the cyber attack was unsuccessful, it does highlight the need for cybersecurity tools in critical infrastructure applications.\n\nOn Friday, February 5, 2021, the Pinellas County Sheriff\u2019s Office was notified by the City of Oldsmar that its computer system had been remotely accessed at 8:00am and 1:30pm by an unknown suspect. According to detectives, the City of Oldsmar\u2019s computer system at the water treatment plant allows for remote access by authorised users to troubleshoot any system problems from other locations.\n\nThe initial intrusion was brief and not cause for concern due to supervisors regularly accessing the system remotely to monitor the system. At 1:30, a plant operator witnessed a second remote access user opening various functions in the system that control the amount of sodium hydroxide in the water. The operator noted the remote access user raised the levels of sodium hydroxide in the water from 100 parts per million to 11,100 parts per million. The operator immediately reduced the levels to their appropriate amount. Sodium hydroxide is used in small amounts to control acidity, but a large amount could have caused major problems in the water.\n\nThe initial investigation revealed that the hacker remotely accessed the treatment plant\u2019s computer for approximately 3 to 5 minutes. Speaking at a press conference about the cyber attack, Sheriff Bob Gualtieri stated: \u201cAt no time was there a significant effect on the water being treated, and more importantly the public was never in danger.\u201d\n\nCommenting on the attack, Andrea Carcano, co-founder at Nozomi Networks stated: \u201cUnfortunately, this attack plays into a troubling trend we\u2019ve been following over the last year. As the pandemic forced critical infrastructure organisations to quickly shift to remote access options to keep systems up and running, we\u2019ve seen threats rise and bad actors reach new lows \u2013 setting their sights on life threatening targets. Fortunately, in this case, operators monitoring Oldsmar\u2019s treatment plant spotted the attack and were able to respond before anyone could be harmed. But it\u2019s a stark reminder that with limited cybersecurity resources and few regulations water utilities are vulnerable to attack. When it comes critical infrastructure, operational resilience must a top priority and advances in AI-powered OT security and network monitoring are available to give operators the network visibility they need to quickly spot trouble and respond before harm is done.\u201d\n\n\u201cThis targeted attack appears to have started by the \u2018bad actor\u2019 getting access to a vulnerable network\/system and working their way through the network trying to find the next weak access point while gathering data and understanding how the organisation operates along the way,\u201d added Niamh Muldoon, Global Data Protection Officer at OneLogin. \u201cIn this instance, understanding the information assets, applying not only MFA but enhanced multi-factor authentication, would have reduced the risk of this unauthorised attack materializing. It\u2019s a critical part of the MFA policy to enforce time limits for end-users and their trusted devices to re-authenticate, requiring them not only to validate themselves but also the identity of the device trying to access critical systems\/applications and the network. Without knowing more of the details, applying enhanced MFA to the execution of critical actions particularly for IT and systems administrators would have reduced the associated risk further. Having logging in place, and understanding logged events would support with the associated monitoring and alerting events. After the event has happened, crisis management is critical for successfully managing the attack response to reduce business impact and consequences, and it appears the Florida agency has done that.\u201d\n\n\u201cWhile this incident will rightfully cause concern, it appears that likelihood of real damage was minimal due to the fail safes in place,\u201d observes Tim Erlin, VP at Tripwire. \u201cThere are real impacts to be worried about, and actions to be taken, but this doesn\u2019t appear to be a sophisticated or novel attack. From a cybersecurity standpoint, we should be particularly concerned about how the attacker was able to authenticate into the remote access software. That entry point should be very well protected, given that it provides access to such obviously sensitive capabilities. Protecting remote access into industrial systems where these types of changes can be made should be a high priority for any industrial environment.\u201d\n\nLocal, State, and Federal investigators are working together to identify those responsible and the investigation is ongoing. Other utility providers have been informed of the intrusion, so they can take their own protective measures.","post_title":"Florida water system cyber attack highlights role of cybersecurity in critical infrastructure","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"florida-water-system-cyber-attack-highlights-role-of-cybersecurity-in-critical-infrastructure","to_ping":"","pinged":"","post_modified":"2021-02-09 19:22:25","post_modified_gmt":"2021-02-09 19:22:25","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4871","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4178,"post_author":"3","post_date":"2020-12-07 14:52:36","post_date_gmt":"2020-12-07 14:52:36","post_content":"Nozomi Networks and Chinook Systems have partnered to provide advanced cybersecurity solutions to protect industrial and critical infrastructure facilities across North America. Under the deal, Chinook will offer Nozomi Networks\u2019 complete portfolio of OT and IoT security solutions.\n\n\u201cFacilities that fully leverage their OT systems deliver tremendous returns when it comes to energy and operational savings, the safety and comfort of occupants and lower total cost of ownership,\u201d said Chinook\u2019s President, Wanda Lenkewich. \u201cAt the same time, the network connectivity that enables these systems, also introduces new and growing cyber threats. Partnering with Nozomi Networks allows Chinook to support clients with an integrated, comprehensive cybersecurity solution that ensures cyber threats are actively discovered, monitored and managed.\u201d\n\n\u201cWe are absolutely delighted to team with Chinook to help industrial and critical infrastructure facilities meet new requirements for secure connectivity across OT, IT and IoT networks,\u201d said Chet Namboodri, Vice President, Worldwide Business Development and Channel Sales at Nozomi. \u201cWe\u2019ve already worked together to deliver on a number of joint customer engagements in both the government and commercial sectors. Partnering with Chinook accelerates our joint efforts to make sure facility-related control and building management systems are safe from cyber threats.\u201d\n\nwww.nozominetworks.com<\/a>\n\nwww.chinooksystems.com<\/a>\n\n ","post_title":"Nozomi Networks and Chinook Systems partner for OT and IoT security solutions","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"nozomi-networks-and-chinook-systems-partner-for-ot-and-iot-security-solutions","to_ping":"","pinged":"","post_modified":"2020-12-07 14:52:40","post_modified_gmt":"2020-12-07 14:52:40","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4178","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4140,"post_author":"3","post_date":"2020-12-03 11:07:21","post_date_gmt":"2020-12-03 11:07:21","post_content":"Civil Nuclear Constabulary (CNC) police officers based at Harwell have launched Project Servator a collaborative community approach to policing. Project Servator aims to disrupt a range of criminal activity, including terrorism, while providing a reassuring presence for the public.\n\nCNC\u2019s officers are experienced and specially trained to spot the tell-tale signs that someone is planning or preparing to commit an illegal act. It works with other police forces, local businesses and the public to protect the Harwell site and the surrounding area and everyone who lives, works or visits there and to make it a difficult place for terrorists and other criminals to operate. Project Servator has been successful in gathering intelligence that has assisted Counter Terrorism Units across the UK in investigating and preventing acts of terror.\n\nProject Servator\u2019s patrols are highly visible and can happen at any time and in any location. Officers will talk to the public and local businesses to let them know what they\u2019re doing and remind them to be vigilant, trust their instincts and report any suspicious or unusual behaviour.\n\n\u201cWe are deploying these additional tactics to further complement the operational activity that exists in and around our Operational Policing Units,\u201d explained Supt Donna Jones, who is leading on the implementation of the project across the Constabulary. \u201cOur aim is to build upon relationships with partners as well as businesses and communities. These tactics are not new but allow us to have a focus on community engagement and encourage people to be our extra eyes and ears. This is not restricted to the Harwell site but also extends to the surrounding area. We are aware of the vast amount of information members of our community have and they are aware of what is out of the ordinary. All we ask is that they report any suspicions to us and we\u2019ll do the rest. The deployments will be unpredictable and our tactics will vary from one deployment to the next. The aim is to work with our local communities to deter any hostile threat.\u201d\n\nwww.gov.uk\/government\/organisations\/civil-nuclear-constabulary<\/a>","post_title":"CNC Harwell launches Project Servator","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"cnc-harwell-launches-project-servator","to_ping":"","pinged":"","post_modified":"2020-12-03 11:07:23","post_modified_gmt":"2020-12-03 11:07:23","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4140","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4102,"post_author":"3","post_date":"2020-11-30 17:30:23","post_date_gmt":"2020-11-30 17:30:23","post_content":"Radiflow and Mitsubishi Electric UK are collaborating to address the needs of IEC62443 cyber security standards in the Critical Infrastructure and Industrial Automation markets. The companys believe that the combination of the automation knowledge and tools of Mitsubishi Electric UK with the cyber security and IEC 62443 compliance skills of Radiflow will provide a holistic view of a client\u2019s risk posture.\n\nRadiflow will also provide Mitsubishi Electric UK customers with a consultancy service for cyber security, which includes the provision of OT security risk assessments, provision of Radiflow intrusion detection software and general advice on alignment with IEC 62443-3. In addition, the solution is intended to help customers to support asset owners in satisfying the requirements of the NIS Directive along with due diligence in alignment with CPNI (Centre for the Protection of National Infrastructure) best practice.\n\n\u201cOur new collaboration with Radiflow provides expertise in the field of OT cyber security which compliments and broadens the services that we offer our customers through the Mitsubishi Electric UK System Service Operation,\u201d said David Bean, Solutions Manager for Mitsubishi Electric UK. \u201cThere is a growing demand for solutions that address the requirements of cyber security in the OT space and we are looking forward to delivering those solutions and building our relationship further with the team at Radiflow.\u201d\n\n\u201cRadiflow sees huge value for OT organisations to have cyber security services and solutions aligned with their automation systems,\u201d added Ilan Barda, Founder and CEO of Radiflow. \u201cBy combining the automation knowledge and tools of Mitsubishi with the OT cyber security skills and tools of Radiflow, we are able to provide a holistic view of an organisation\u2019s OT risk posture.\u201d\n\nwww.radiflow.com<\/a>","post_title":"Radiflow and Mitsubishi Electric UK collaborate on cyber security standards","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"radiflow-and-mitsubishi-electric-uk-collaborate-on-cyber-security-standards","to_ping":"","pinged":"","post_modified":"2020-11-30 17:30:25","post_modified_gmt":"2020-11-30 17:30:25","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4102","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":3359,"post_author":"3","post_date":"2020-10-16 17:11:16","post_date_gmt":"2020-10-16 16:11:16","post_content":"Senstar explains how its products can be applied to protect the full range of upstream, midstream, and downstream facilities in the oil and gas industry.","post_title":"Senstar explains its security solutions for oil and gas","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"senstar-explains-its-security-solutions-for-oil-and-gas","to_ping":"","pinged":"","post_modified":"2020-10-16 17:11:17","post_modified_gmt":"2020-10-16 16:11:17","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=3359","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"}],"next":false,"prev":false,"total_page":1},"paged":1,"column_class":"jeg_col_2o3","class":"epic_block_14"};

\n

\"While this is indeed a financial disaster, and will have a significant impact on many, let us also consider that this means that, at least for a time, threat actors had control of those very same IT systems.\"<\/p>Martin Jartelius, CSO, Outpost24<\/cite><\/blockquote><\/figure>\n\n\n\n

Taking back control <\/strong><\/p>\n\n\n\n

US government officials are currently working with Colonial to help it recover while scrambling to avoid more severe fuel supply disruptions should the outage continue. Whether the pipeline stays shut that long in turn depends on how deeply the hackers penetrated Colonial\u2019s network - and how soon cybersecurity experts can pull them out.<\/p>\n\n\n\n

\"As so many times before when talking about ransomware \u2013 to lock a system with ransomware you need a good degree of control of that system,\" says Martin Jartelius, CSO at Outpost24. \"While this is indeed a financial disaster, and will have a significant impact on many, let us also consider that this means that, at least for a time, threat actors had control of those very same IT systems. Preventive security, as well as segmentation, are critical for those kinds of environments.\"<\/p>\n\n\n\n

\"One thing to note here is that ransomware has to announce itself to be successful,\" adds Tim Erlin, VP at Tripwire. \"In industrial environments, cyber events aren\u2019t always this visible. Increasing visibility into industrial networks becomes more important as attackers continue to target critical infrastructure.\u201d<\/p>\n\n\n\n

Brad Brooks, CEO and President of OneLogin, rightfully concludes: \"This attack represents just how quickly the stakes are escalating on Cybersecurity, with controlling and knowing who has access to your IT systems a board level priority for every company. We are moving from an invisible Cold War that was focused on stealing data to a highly visible hot war that has real implications for physical property and people\u2019s lives.\u201d<\/p>\n","post_title":"Ransomware roundtable | A threat in the pipeline","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"ransomware-roundtable-a-threat-in-the-pipeline","to_ping":"","pinged":"","post_modified":"2021-05-10 18:12:55","post_modified_gmt":"2021-05-10 17:12:55","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=6024","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4871,"post_author":"3","post_date":"2021-02-09 19:22:22","post_date_gmt":"2021-02-09 19:22:22","post_content":"Detectives assigned to the Digital Forensics Unit at Pinellas County Sheriff\u2019s Office are investigating an unlawful computer software intrusion at the City of Oldsmar\u2019s water treatment plant. While the cyber attack was unsuccessful, it does highlight the need for cybersecurity tools in critical infrastructure applications.\n\nOn Friday, February 5, 2021, the Pinellas County Sheriff\u2019s Office was notified by the City of Oldsmar that its computer system had been remotely accessed at 8:00am and 1:30pm by an unknown suspect. According to detectives, the City of Oldsmar\u2019s computer system at the water treatment plant allows for remote access by authorised users to troubleshoot any system problems from other locations.\n\nThe initial intrusion was brief and not cause for concern due to supervisors regularly accessing the system remotely to monitor the system. At 1:30, a plant operator witnessed a second remote access user opening various functions in the system that control the amount of sodium hydroxide in the water. The operator noted the remote access user raised the levels of sodium hydroxide in the water from 100 parts per million to 11,100 parts per million. The operator immediately reduced the levels to their appropriate amount. Sodium hydroxide is used in small amounts to control acidity, but a large amount could have caused major problems in the water.\n\nThe initial investigation revealed that the hacker remotely accessed the treatment plant\u2019s computer for approximately 3 to 5 minutes. Speaking at a press conference about the cyber attack, Sheriff Bob Gualtieri stated: \u201cAt no time was there a significant effect on the water being treated, and more importantly the public was never in danger.\u201d\n\nCommenting on the attack, Andrea Carcano, co-founder at Nozomi Networks stated: \u201cUnfortunately, this attack plays into a troubling trend we\u2019ve been following over the last year. As the pandemic forced critical infrastructure organisations to quickly shift to remote access options to keep systems up and running, we\u2019ve seen threats rise and bad actors reach new lows \u2013 setting their sights on life threatening targets. Fortunately, in this case, operators monitoring Oldsmar\u2019s treatment plant spotted the attack and were able to respond before anyone could be harmed. But it\u2019s a stark reminder that with limited cybersecurity resources and few regulations water utilities are vulnerable to attack. When it comes critical infrastructure, operational resilience must a top priority and advances in AI-powered OT security and network monitoring are available to give operators the network visibility they need to quickly spot trouble and respond before harm is done.\u201d\n\n\u201cThis targeted attack appears to have started by the \u2018bad actor\u2019 getting access to a vulnerable network\/system and working their way through the network trying to find the next weak access point while gathering data and understanding how the organisation operates along the way,\u201d added Niamh Muldoon, Global Data Protection Officer at OneLogin. \u201cIn this instance, understanding the information assets, applying not only MFA but enhanced multi-factor authentication, would have reduced the risk of this unauthorised attack materializing. It\u2019s a critical part of the MFA policy to enforce time limits for end-users and their trusted devices to re-authenticate, requiring them not only to validate themselves but also the identity of the device trying to access critical systems\/applications and the network. Without knowing more of the details, applying enhanced MFA to the execution of critical actions particularly for IT and systems administrators would have reduced the associated risk further. Having logging in place, and understanding logged events would support with the associated monitoring and alerting events. After the event has happened, crisis management is critical for successfully managing the attack response to reduce business impact and consequences, and it appears the Florida agency has done that.\u201d\n\n\u201cWhile this incident will rightfully cause concern, it appears that likelihood of real damage was minimal due to the fail safes in place,\u201d observes Tim Erlin, VP at Tripwire. \u201cThere are real impacts to be worried about, and actions to be taken, but this doesn\u2019t appear to be a sophisticated or novel attack. From a cybersecurity standpoint, we should be particularly concerned about how the attacker was able to authenticate into the remote access software. That entry point should be very well protected, given that it provides access to such obviously sensitive capabilities. Protecting remote access into industrial systems where these types of changes can be made should be a high priority for any industrial environment.\u201d\n\nLocal, State, and Federal investigators are working together to identify those responsible and the investigation is ongoing. Other utility providers have been informed of the intrusion, so they can take their own protective measures.","post_title":"Florida water system cyber attack highlights role of cybersecurity in critical infrastructure","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"florida-water-system-cyber-attack-highlights-role-of-cybersecurity-in-critical-infrastructure","to_ping":"","pinged":"","post_modified":"2021-02-09 19:22:25","post_modified_gmt":"2021-02-09 19:22:25","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4871","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4178,"post_author":"3","post_date":"2020-12-07 14:52:36","post_date_gmt":"2020-12-07 14:52:36","post_content":"Nozomi Networks and Chinook Systems have partnered to provide advanced cybersecurity solutions to protect industrial and critical infrastructure facilities across North America. Under the deal, Chinook will offer Nozomi Networks\u2019 complete portfolio of OT and IoT security solutions.\n\n\u201cFacilities that fully leverage their OT systems deliver tremendous returns when it comes to energy and operational savings, the safety and comfort of occupants and lower total cost of ownership,\u201d said Chinook\u2019s President, Wanda Lenkewich. \u201cAt the same time, the network connectivity that enables these systems, also introduces new and growing cyber threats. Partnering with Nozomi Networks allows Chinook to support clients with an integrated, comprehensive cybersecurity solution that ensures cyber threats are actively discovered, monitored and managed.\u201d\n\n\u201cWe are absolutely delighted to team with Chinook to help industrial and critical infrastructure facilities meet new requirements for secure connectivity across OT, IT and IoT networks,\u201d said Chet Namboodri, Vice President, Worldwide Business Development and Channel Sales at Nozomi. \u201cWe\u2019ve already worked together to deliver on a number of joint customer engagements in both the government and commercial sectors. Partnering with Chinook accelerates our joint efforts to make sure facility-related control and building management systems are safe from cyber threats.\u201d\n\nwww.nozominetworks.com<\/a>\n\nwww.chinooksystems.com<\/a>\n\n ","post_title":"Nozomi Networks and Chinook Systems partner for OT and IoT security solutions","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"nozomi-networks-and-chinook-systems-partner-for-ot-and-iot-security-solutions","to_ping":"","pinged":"","post_modified":"2020-12-07 14:52:40","post_modified_gmt":"2020-12-07 14:52:40","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4178","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4140,"post_author":"3","post_date":"2020-12-03 11:07:21","post_date_gmt":"2020-12-03 11:07:21","post_content":"Civil Nuclear Constabulary (CNC) police officers based at Harwell have launched Project Servator a collaborative community approach to policing. Project Servator aims to disrupt a range of criminal activity, including terrorism, while providing a reassuring presence for the public.\n\nCNC\u2019s officers are experienced and specially trained to spot the tell-tale signs that someone is planning or preparing to commit an illegal act. It works with other police forces, local businesses and the public to protect the Harwell site and the surrounding area and everyone who lives, works or visits there and to make it a difficult place for terrorists and other criminals to operate. Project Servator has been successful in gathering intelligence that has assisted Counter Terrorism Units across the UK in investigating and preventing acts of terror.\n\nProject Servator\u2019s patrols are highly visible and can happen at any time and in any location. Officers will talk to the public and local businesses to let them know what they\u2019re doing and remind them to be vigilant, trust their instincts and report any suspicious or unusual behaviour.\n\n\u201cWe are deploying these additional tactics to further complement the operational activity that exists in and around our Operational Policing Units,\u201d explained Supt Donna Jones, who is leading on the implementation of the project across the Constabulary. \u201cOur aim is to build upon relationships with partners as well as businesses and communities. These tactics are not new but allow us to have a focus on community engagement and encourage people to be our extra eyes and ears. This is not restricted to the Harwell site but also extends to the surrounding area. We are aware of the vast amount of information members of our community have and they are aware of what is out of the ordinary. All we ask is that they report any suspicions to us and we\u2019ll do the rest. The deployments will be unpredictable and our tactics will vary from one deployment to the next. The aim is to work with our local communities to deter any hostile threat.\u201d\n\nwww.gov.uk\/government\/organisations\/civil-nuclear-constabulary<\/a>","post_title":"CNC Harwell launches Project Servator","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"cnc-harwell-launches-project-servator","to_ping":"","pinged":"","post_modified":"2020-12-03 11:07:23","post_modified_gmt":"2020-12-03 11:07:23","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4140","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4102,"post_author":"3","post_date":"2020-11-30 17:30:23","post_date_gmt":"2020-11-30 17:30:23","post_content":"Radiflow and Mitsubishi Electric UK are collaborating to address the needs of IEC62443 cyber security standards in the Critical Infrastructure and Industrial Automation markets. The companys believe that the combination of the automation knowledge and tools of Mitsubishi Electric UK with the cyber security and IEC 62443 compliance skills of Radiflow will provide a holistic view of a client\u2019s risk posture.\n\nRadiflow will also provide Mitsubishi Electric UK customers with a consultancy service for cyber security, which includes the provision of OT security risk assessments, provision of Radiflow intrusion detection software and general advice on alignment with IEC 62443-3. In addition, the solution is intended to help customers to support asset owners in satisfying the requirements of the NIS Directive along with due diligence in alignment with CPNI (Centre for the Protection of National Infrastructure) best practice.\n\n\u201cOur new collaboration with Radiflow provides expertise in the field of OT cyber security which compliments and broadens the services that we offer our customers through the Mitsubishi Electric UK System Service Operation,\u201d said David Bean, Solutions Manager for Mitsubishi Electric UK. \u201cThere is a growing demand for solutions that address the requirements of cyber security in the OT space and we are looking forward to delivering those solutions and building our relationship further with the team at Radiflow.\u201d\n\n\u201cRadiflow sees huge value for OT organisations to have cyber security services and solutions aligned with their automation systems,\u201d added Ilan Barda, Founder and CEO of Radiflow. \u201cBy combining the automation knowledge and tools of Mitsubishi with the OT cyber security skills and tools of Radiflow, we are able to provide a holistic view of an organisation\u2019s OT risk posture.\u201d\n\nwww.radiflow.com<\/a>","post_title":"Radiflow and Mitsubishi Electric UK collaborate on cyber security standards","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"radiflow-and-mitsubishi-electric-uk-collaborate-on-cyber-security-standards","to_ping":"","pinged":"","post_modified":"2020-11-30 17:30:25","post_modified_gmt":"2020-11-30 17:30:25","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4102","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":3359,"post_author":"3","post_date":"2020-10-16 17:11:16","post_date_gmt":"2020-10-16 16:11:16","post_content":"Senstar explains how its products can be applied to protect the full range of upstream, midstream, and downstream facilities in the oil and gas industry.","post_title":"Senstar explains its security solutions for oil and gas","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"senstar-explains-its-security-solutions-for-oil-and-gas","to_ping":"","pinged":"","post_modified":"2020-10-16 17:11:17","post_modified_gmt":"2020-10-16 16:11:17","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=3359","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"}],"next":false,"prev":false,"total_page":1},"paged":1,"column_class":"jeg_col_2o3","class":"epic_block_14"};

\n

\"While the age of the software has limited impact on its serviceability, threat models and defensive protections need to keep pace with new threats \u2013 something that can only be done if all weaknesses present in each component are known and accounted for. After all, if a criminal can identify your weaknesses faster than you can, luck is rarely on your side.\u201d<\/p>\n\n\n\n

\"While this is indeed a financial disaster, and will have a significant impact on many, let us also consider that this means that, at least for a time, threat actors had control of those very same IT systems.\"<\/p>Martin Jartelius, CSO, Outpost24<\/cite><\/blockquote><\/figure>\n\n\n\n

Taking back control <\/strong><\/p>\n\n\n\n

US government officials are currently working with Colonial to help it recover while scrambling to avoid more severe fuel supply disruptions should the outage continue. Whether the pipeline stays shut that long in turn depends on how deeply the hackers penetrated Colonial\u2019s network - and how soon cybersecurity experts can pull them out.<\/p>\n\n\n\n

\"As so many times before when talking about ransomware \u2013 to lock a system with ransomware you need a good degree of control of that system,\" says Martin Jartelius, CSO at Outpost24. \"While this is indeed a financial disaster, and will have a significant impact on many, let us also consider that this means that, at least for a time, threat actors had control of those very same IT systems. Preventive security, as well as segmentation, are critical for those kinds of environments.\"<\/p>\n\n\n\n

\"One thing to note here is that ransomware has to announce itself to be successful,\" adds Tim Erlin, VP at Tripwire. \"In industrial environments, cyber events aren\u2019t always this visible. Increasing visibility into industrial networks becomes more important as attackers continue to target critical infrastructure.\u201d<\/p>\n\n\n\n

Brad Brooks, CEO and President of OneLogin, rightfully concludes: \"This attack represents just how quickly the stakes are escalating on Cybersecurity, with controlling and knowing who has access to your IT systems a board level priority for every company. We are moving from an invisible Cold War that was focused on stealing data to a highly visible hot war that has real implications for physical property and people\u2019s lives.\u201d<\/p>\n","post_title":"Ransomware roundtable | A threat in the pipeline","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"ransomware-roundtable-a-threat-in-the-pipeline","to_ping":"","pinged":"","post_modified":"2021-05-10 18:12:55","post_modified_gmt":"2021-05-10 17:12:55","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=6024","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4871,"post_author":"3","post_date":"2021-02-09 19:22:22","post_date_gmt":"2021-02-09 19:22:22","post_content":"Detectives assigned to the Digital Forensics Unit at Pinellas County Sheriff\u2019s Office are investigating an unlawful computer software intrusion at the City of Oldsmar\u2019s water treatment plant. While the cyber attack was unsuccessful, it does highlight the need for cybersecurity tools in critical infrastructure applications.\n\nOn Friday, February 5, 2021, the Pinellas County Sheriff\u2019s Office was notified by the City of Oldsmar that its computer system had been remotely accessed at 8:00am and 1:30pm by an unknown suspect. According to detectives, the City of Oldsmar\u2019s computer system at the water treatment plant allows for remote access by authorised users to troubleshoot any system problems from other locations.\n\nThe initial intrusion was brief and not cause for concern due to supervisors regularly accessing the system remotely to monitor the system. At 1:30, a plant operator witnessed a second remote access user opening various functions in the system that control the amount of sodium hydroxide in the water. The operator noted the remote access user raised the levels of sodium hydroxide in the water from 100 parts per million to 11,100 parts per million. The operator immediately reduced the levels to their appropriate amount. Sodium hydroxide is used in small amounts to control acidity, but a large amount could have caused major problems in the water.\n\nThe initial investigation revealed that the hacker remotely accessed the treatment plant\u2019s computer for approximately 3 to 5 minutes. Speaking at a press conference about the cyber attack, Sheriff Bob Gualtieri stated: \u201cAt no time was there a significant effect on the water being treated, and more importantly the public was never in danger.\u201d\n\nCommenting on the attack, Andrea Carcano, co-founder at Nozomi Networks stated: \u201cUnfortunately, this attack plays into a troubling trend we\u2019ve been following over the last year. As the pandemic forced critical infrastructure organisations to quickly shift to remote access options to keep systems up and running, we\u2019ve seen threats rise and bad actors reach new lows \u2013 setting their sights on life threatening targets. Fortunately, in this case, operators monitoring Oldsmar\u2019s treatment plant spotted the attack and were able to respond before anyone could be harmed. But it\u2019s a stark reminder that with limited cybersecurity resources and few regulations water utilities are vulnerable to attack. When it comes critical infrastructure, operational resilience must a top priority and advances in AI-powered OT security and network monitoring are available to give operators the network visibility they need to quickly spot trouble and respond before harm is done.\u201d\n\n\u201cThis targeted attack appears to have started by the \u2018bad actor\u2019 getting access to a vulnerable network\/system and working their way through the network trying to find the next weak access point while gathering data and understanding how the organisation operates along the way,\u201d added Niamh Muldoon, Global Data Protection Officer at OneLogin. \u201cIn this instance, understanding the information assets, applying not only MFA but enhanced multi-factor authentication, would have reduced the risk of this unauthorised attack materializing. It\u2019s a critical part of the MFA policy to enforce time limits for end-users and their trusted devices to re-authenticate, requiring them not only to validate themselves but also the identity of the device trying to access critical systems\/applications and the network. Without knowing more of the details, applying enhanced MFA to the execution of critical actions particularly for IT and systems administrators would have reduced the associated risk further. Having logging in place, and understanding logged events would support with the associated monitoring and alerting events. After the event has happened, crisis management is critical for successfully managing the attack response to reduce business impact and consequences, and it appears the Florida agency has done that.\u201d\n\n\u201cWhile this incident will rightfully cause concern, it appears that likelihood of real damage was minimal due to the fail safes in place,\u201d observes Tim Erlin, VP at Tripwire. \u201cThere are real impacts to be worried about, and actions to be taken, but this doesn\u2019t appear to be a sophisticated or novel attack. From a cybersecurity standpoint, we should be particularly concerned about how the attacker was able to authenticate into the remote access software. That entry point should be very well protected, given that it provides access to such obviously sensitive capabilities. Protecting remote access into industrial systems where these types of changes can be made should be a high priority for any industrial environment.\u201d\n\nLocal, State, and Federal investigators are working together to identify those responsible and the investigation is ongoing. Other utility providers have been informed of the intrusion, so they can take their own protective measures.","post_title":"Florida water system cyber attack highlights role of cybersecurity in critical infrastructure","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"florida-water-system-cyber-attack-highlights-role-of-cybersecurity-in-critical-infrastructure","to_ping":"","pinged":"","post_modified":"2021-02-09 19:22:25","post_modified_gmt":"2021-02-09 19:22:25","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4871","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4178,"post_author":"3","post_date":"2020-12-07 14:52:36","post_date_gmt":"2020-12-07 14:52:36","post_content":"Nozomi Networks and Chinook Systems have partnered to provide advanced cybersecurity solutions to protect industrial and critical infrastructure facilities across North America. Under the deal, Chinook will offer Nozomi Networks\u2019 complete portfolio of OT and IoT security solutions.\n\n\u201cFacilities that fully leverage their OT systems deliver tremendous returns when it comes to energy and operational savings, the safety and comfort of occupants and lower total cost of ownership,\u201d said Chinook\u2019s President, Wanda Lenkewich. \u201cAt the same time, the network connectivity that enables these systems, also introduces new and growing cyber threats. Partnering with Nozomi Networks allows Chinook to support clients with an integrated, comprehensive cybersecurity solution that ensures cyber threats are actively discovered, monitored and managed.\u201d\n\n\u201cWe are absolutely delighted to team with Chinook to help industrial and critical infrastructure facilities meet new requirements for secure connectivity across OT, IT and IoT networks,\u201d said Chet Namboodri, Vice President, Worldwide Business Development and Channel Sales at Nozomi. \u201cWe\u2019ve already worked together to deliver on a number of joint customer engagements in both the government and commercial sectors. Partnering with Chinook accelerates our joint efforts to make sure facility-related control and building management systems are safe from cyber threats.\u201d\n\nwww.nozominetworks.com<\/a>\n\nwww.chinooksystems.com<\/a>\n\n ","post_title":"Nozomi Networks and Chinook Systems partner for OT and IoT security solutions","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"nozomi-networks-and-chinook-systems-partner-for-ot-and-iot-security-solutions","to_ping":"","pinged":"","post_modified":"2020-12-07 14:52:40","post_modified_gmt":"2020-12-07 14:52:40","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4178","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4140,"post_author":"3","post_date":"2020-12-03 11:07:21","post_date_gmt":"2020-12-03 11:07:21","post_content":"Civil Nuclear Constabulary (CNC) police officers based at Harwell have launched Project Servator a collaborative community approach to policing. Project Servator aims to disrupt a range of criminal activity, including terrorism, while providing a reassuring presence for the public.\n\nCNC\u2019s officers are experienced and specially trained to spot the tell-tale signs that someone is planning or preparing to commit an illegal act. It works with other police forces, local businesses and the public to protect the Harwell site and the surrounding area and everyone who lives, works or visits there and to make it a difficult place for terrorists and other criminals to operate. Project Servator has been successful in gathering intelligence that has assisted Counter Terrorism Units across the UK in investigating and preventing acts of terror.\n\nProject Servator\u2019s patrols are highly visible and can happen at any time and in any location. Officers will talk to the public and local businesses to let them know what they\u2019re doing and remind them to be vigilant, trust their instincts and report any suspicious or unusual behaviour.\n\n\u201cWe are deploying these additional tactics to further complement the operational activity that exists in and around our Operational Policing Units,\u201d explained Supt Donna Jones, who is leading on the implementation of the project across the Constabulary. \u201cOur aim is to build upon relationships with partners as well as businesses and communities. These tactics are not new but allow us to have a focus on community engagement and encourage people to be our extra eyes and ears. This is not restricted to the Harwell site but also extends to the surrounding area. We are aware of the vast amount of information members of our community have and they are aware of what is out of the ordinary. All we ask is that they report any suspicions to us and we\u2019ll do the rest. The deployments will be unpredictable and our tactics will vary from one deployment to the next. The aim is to work with our local communities to deter any hostile threat.\u201d\n\nwww.gov.uk\/government\/organisations\/civil-nuclear-constabulary<\/a>","post_title":"CNC Harwell launches Project Servator","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"cnc-harwell-launches-project-servator","to_ping":"","pinged":"","post_modified":"2020-12-03 11:07:23","post_modified_gmt":"2020-12-03 11:07:23","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4140","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4102,"post_author":"3","post_date":"2020-11-30 17:30:23","post_date_gmt":"2020-11-30 17:30:23","post_content":"Radiflow and Mitsubishi Electric UK are collaborating to address the needs of IEC62443 cyber security standards in the Critical Infrastructure and Industrial Automation markets. The companys believe that the combination of the automation knowledge and tools of Mitsubishi Electric UK with the cyber security and IEC 62443 compliance skills of Radiflow will provide a holistic view of a client\u2019s risk posture.\n\nRadiflow will also provide Mitsubishi Electric UK customers with a consultancy service for cyber security, which includes the provision of OT security risk assessments, provision of Radiflow intrusion detection software and general advice on alignment with IEC 62443-3. In addition, the solution is intended to help customers to support asset owners in satisfying the requirements of the NIS Directive along with due diligence in alignment with CPNI (Centre for the Protection of National Infrastructure) best practice.\n\n\u201cOur new collaboration with Radiflow provides expertise in the field of OT cyber security which compliments and broadens the services that we offer our customers through the Mitsubishi Electric UK System Service Operation,\u201d said David Bean, Solutions Manager for Mitsubishi Electric UK. \u201cThere is a growing demand for solutions that address the requirements of cyber security in the OT space and we are looking forward to delivering those solutions and building our relationship further with the team at Radiflow.\u201d\n\n\u201cRadiflow sees huge value for OT organisations to have cyber security services and solutions aligned with their automation systems,\u201d added Ilan Barda, Founder and CEO of Radiflow. \u201cBy combining the automation knowledge and tools of Mitsubishi with the OT cyber security skills and tools of Radiflow, we are able to provide a holistic view of an organisation\u2019s OT risk posture.\u201d\n\nwww.radiflow.com<\/a>","post_title":"Radiflow and Mitsubishi Electric UK collaborate on cyber security standards","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"radiflow-and-mitsubishi-electric-uk-collaborate-on-cyber-security-standards","to_ping":"","pinged":"","post_modified":"2020-11-30 17:30:25","post_modified_gmt":"2020-11-30 17:30:25","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4102","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":3359,"post_author":"3","post_date":"2020-10-16 17:11:16","post_date_gmt":"2020-10-16 16:11:16","post_content":"Senstar explains how its products can be applied to protect the full range of upstream, midstream, and downstream facilities in the oil and gas industry.","post_title":"Senstar explains its security solutions for oil and gas","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"senstar-explains-its-security-solutions-for-oil-and-gas","to_ping":"","pinged":"","post_modified":"2020-10-16 17:11:17","post_modified_gmt":"2020-10-16 16:11:17","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=3359","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"}],"next":false,"prev":false,"total_page":1},"paged":1,"column_class":"jeg_col_2o3","class":"epic_block_14"};

\n

\"An effort like the one impacting Colonial Pipeline is likely the result of multiple weaknesses in process and cyber-defences that were ultimately successfully exploited. With the age of some industrial software systems far exceeding that of commercial software, it\u2019s likely that older software wasn\u2019t designed to limit exposure to modern threats like ransomware attacks. <\/p>\n\n\n\n

\"While the age of the software has limited impact on its serviceability, threat models and defensive protections need to keep pace with new threats \u2013 something that can only be done if all weaknesses present in each component are known and accounted for. After all, if a criminal can identify your weaknesses faster than you can, luck is rarely on your side.\u201d<\/p>\n\n\n\n

\"While this is indeed a financial disaster, and will have a significant impact on many, let us also consider that this means that, at least for a time, threat actors had control of those very same IT systems.\"<\/p>Martin Jartelius, CSO, Outpost24<\/cite><\/blockquote><\/figure>\n\n\n\n

Taking back control <\/strong><\/p>\n\n\n\n

US government officials are currently working with Colonial to help it recover while scrambling to avoid more severe fuel supply disruptions should the outage continue. Whether the pipeline stays shut that long in turn depends on how deeply the hackers penetrated Colonial\u2019s network - and how soon cybersecurity experts can pull them out.<\/p>\n\n\n\n

\"As so many times before when talking about ransomware \u2013 to lock a system with ransomware you need a good degree of control of that system,\" says Martin Jartelius, CSO at Outpost24. \"While this is indeed a financial disaster, and will have a significant impact on many, let us also consider that this means that, at least for a time, threat actors had control of those very same IT systems. Preventive security, as well as segmentation, are critical for those kinds of environments.\"<\/p>\n\n\n\n

\"One thing to note here is that ransomware has to announce itself to be successful,\" adds Tim Erlin, VP at Tripwire. \"In industrial environments, cyber events aren\u2019t always this visible. Increasing visibility into industrial networks becomes more important as attackers continue to target critical infrastructure.\u201d<\/p>\n\n\n\n

Brad Brooks, CEO and President of OneLogin, rightfully concludes: \"This attack represents just how quickly the stakes are escalating on Cybersecurity, with controlling and knowing who has access to your IT systems a board level priority for every company. We are moving from an invisible Cold War that was focused on stealing data to a highly visible hot war that has real implications for physical property and people\u2019s lives.\u201d<\/p>\n","post_title":"Ransomware roundtable | A threat in the pipeline","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"ransomware-roundtable-a-threat-in-the-pipeline","to_ping":"","pinged":"","post_modified":"2021-05-10 18:12:55","post_modified_gmt":"2021-05-10 17:12:55","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=6024","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4871,"post_author":"3","post_date":"2021-02-09 19:22:22","post_date_gmt":"2021-02-09 19:22:22","post_content":"Detectives assigned to the Digital Forensics Unit at Pinellas County Sheriff\u2019s Office are investigating an unlawful computer software intrusion at the City of Oldsmar\u2019s water treatment plant. While the cyber attack was unsuccessful, it does highlight the need for cybersecurity tools in critical infrastructure applications.\n\nOn Friday, February 5, 2021, the Pinellas County Sheriff\u2019s Office was notified by the City of Oldsmar that its computer system had been remotely accessed at 8:00am and 1:30pm by an unknown suspect. According to detectives, the City of Oldsmar\u2019s computer system at the water treatment plant allows for remote access by authorised users to troubleshoot any system problems from other locations.\n\nThe initial intrusion was brief and not cause for concern due to supervisors regularly accessing the system remotely to monitor the system. At 1:30, a plant operator witnessed a second remote access user opening various functions in the system that control the amount of sodium hydroxide in the water. The operator noted the remote access user raised the levels of sodium hydroxide in the water from 100 parts per million to 11,100 parts per million. The operator immediately reduced the levels to their appropriate amount. Sodium hydroxide is used in small amounts to control acidity, but a large amount could have caused major problems in the water.\n\nThe initial investigation revealed that the hacker remotely accessed the treatment plant\u2019s computer for approximately 3 to 5 minutes. Speaking at a press conference about the cyber attack, Sheriff Bob Gualtieri stated: \u201cAt no time was there a significant effect on the water being treated, and more importantly the public was never in danger.\u201d\n\nCommenting on the attack, Andrea Carcano, co-founder at Nozomi Networks stated: \u201cUnfortunately, this attack plays into a troubling trend we\u2019ve been following over the last year. As the pandemic forced critical infrastructure organisations to quickly shift to remote access options to keep systems up and running, we\u2019ve seen threats rise and bad actors reach new lows \u2013 setting their sights on life threatening targets. Fortunately, in this case, operators monitoring Oldsmar\u2019s treatment plant spotted the attack and were able to respond before anyone could be harmed. But it\u2019s a stark reminder that with limited cybersecurity resources and few regulations water utilities are vulnerable to attack. When it comes critical infrastructure, operational resilience must a top priority and advances in AI-powered OT security and network monitoring are available to give operators the network visibility they need to quickly spot trouble and respond before harm is done.\u201d\n\n\u201cThis targeted attack appears to have started by the \u2018bad actor\u2019 getting access to a vulnerable network\/system and working their way through the network trying to find the next weak access point while gathering data and understanding how the organisation operates along the way,\u201d added Niamh Muldoon, Global Data Protection Officer at OneLogin. \u201cIn this instance, understanding the information assets, applying not only MFA but enhanced multi-factor authentication, would have reduced the risk of this unauthorised attack materializing. It\u2019s a critical part of the MFA policy to enforce time limits for end-users and their trusted devices to re-authenticate, requiring them not only to validate themselves but also the identity of the device trying to access critical systems\/applications and the network. Without knowing more of the details, applying enhanced MFA to the execution of critical actions particularly for IT and systems administrators would have reduced the associated risk further. Having logging in place, and understanding logged events would support with the associated monitoring and alerting events. After the event has happened, crisis management is critical for successfully managing the attack response to reduce business impact and consequences, and it appears the Florida agency has done that.\u201d\n\n\u201cWhile this incident will rightfully cause concern, it appears that likelihood of real damage was minimal due to the fail safes in place,\u201d observes Tim Erlin, VP at Tripwire. \u201cThere are real impacts to be worried about, and actions to be taken, but this doesn\u2019t appear to be a sophisticated or novel attack. From a cybersecurity standpoint, we should be particularly concerned about how the attacker was able to authenticate into the remote access software. That entry point should be very well protected, given that it provides access to such obviously sensitive capabilities. Protecting remote access into industrial systems where these types of changes can be made should be a high priority for any industrial environment.\u201d\n\nLocal, State, and Federal investigators are working together to identify those responsible and the investigation is ongoing. Other utility providers have been informed of the intrusion, so they can take their own protective measures.","post_title":"Florida water system cyber attack highlights role of cybersecurity in critical infrastructure","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"florida-water-system-cyber-attack-highlights-role-of-cybersecurity-in-critical-infrastructure","to_ping":"","pinged":"","post_modified":"2021-02-09 19:22:25","post_modified_gmt":"2021-02-09 19:22:25","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4871","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4178,"post_author":"3","post_date":"2020-12-07 14:52:36","post_date_gmt":"2020-12-07 14:52:36","post_content":"Nozomi Networks and Chinook Systems have partnered to provide advanced cybersecurity solutions to protect industrial and critical infrastructure facilities across North America. Under the deal, Chinook will offer Nozomi Networks\u2019 complete portfolio of OT and IoT security solutions.\n\n\u201cFacilities that fully leverage their OT systems deliver tremendous returns when it comes to energy and operational savings, the safety and comfort of occupants and lower total cost of ownership,\u201d said Chinook\u2019s President, Wanda Lenkewich. \u201cAt the same time, the network connectivity that enables these systems, also introduces new and growing cyber threats. Partnering with Nozomi Networks allows Chinook to support clients with an integrated, comprehensive cybersecurity solution that ensures cyber threats are actively discovered, monitored and managed.\u201d\n\n\u201cWe are absolutely delighted to team with Chinook to help industrial and critical infrastructure facilities meet new requirements for secure connectivity across OT, IT and IoT networks,\u201d said Chet Namboodri, Vice President, Worldwide Business Development and Channel Sales at Nozomi. \u201cWe\u2019ve already worked together to deliver on a number of joint customer engagements in both the government and commercial sectors. Partnering with Chinook accelerates our joint efforts to make sure facility-related control and building management systems are safe from cyber threats.\u201d\n\nwww.nozominetworks.com<\/a>\n\nwww.chinooksystems.com<\/a>\n\n ","post_title":"Nozomi Networks and Chinook Systems partner for OT and IoT security solutions","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"nozomi-networks-and-chinook-systems-partner-for-ot-and-iot-security-solutions","to_ping":"","pinged":"","post_modified":"2020-12-07 14:52:40","post_modified_gmt":"2020-12-07 14:52:40","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4178","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4140,"post_author":"3","post_date":"2020-12-03 11:07:21","post_date_gmt":"2020-12-03 11:07:21","post_content":"Civil Nuclear Constabulary (CNC) police officers based at Harwell have launched Project Servator a collaborative community approach to policing. Project Servator aims to disrupt a range of criminal activity, including terrorism, while providing a reassuring presence for the public.\n\nCNC\u2019s officers are experienced and specially trained to spot the tell-tale signs that someone is planning or preparing to commit an illegal act. It works with other police forces, local businesses and the public to protect the Harwell site and the surrounding area and everyone who lives, works or visits there and to make it a difficult place for terrorists and other criminals to operate. Project Servator has been successful in gathering intelligence that has assisted Counter Terrorism Units across the UK in investigating and preventing acts of terror.\n\nProject Servator\u2019s patrols are highly visible and can happen at any time and in any location. Officers will talk to the public and local businesses to let them know what they\u2019re doing and remind them to be vigilant, trust their instincts and report any suspicious or unusual behaviour.\n\n\u201cWe are deploying these additional tactics to further complement the operational activity that exists in and around our Operational Policing Units,\u201d explained Supt Donna Jones, who is leading on the implementation of the project across the Constabulary. \u201cOur aim is to build upon relationships with partners as well as businesses and communities. These tactics are not new but allow us to have a focus on community engagement and encourage people to be our extra eyes and ears. This is not restricted to the Harwell site but also extends to the surrounding area. We are aware of the vast amount of information members of our community have and they are aware of what is out of the ordinary. All we ask is that they report any suspicions to us and we\u2019ll do the rest. The deployments will be unpredictable and our tactics will vary from one deployment to the next. The aim is to work with our local communities to deter any hostile threat.\u201d\n\nwww.gov.uk\/government\/organisations\/civil-nuclear-constabulary<\/a>","post_title":"CNC Harwell launches Project Servator","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"cnc-harwell-launches-project-servator","to_ping":"","pinged":"","post_modified":"2020-12-03 11:07:23","post_modified_gmt":"2020-12-03 11:07:23","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4140","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4102,"post_author":"3","post_date":"2020-11-30 17:30:23","post_date_gmt":"2020-11-30 17:30:23","post_content":"Radiflow and Mitsubishi Electric UK are collaborating to address the needs of IEC62443 cyber security standards in the Critical Infrastructure and Industrial Automation markets. The companys believe that the combination of the automation knowledge and tools of Mitsubishi Electric UK with the cyber security and IEC 62443 compliance skills of Radiflow will provide a holistic view of a client\u2019s risk posture.\n\nRadiflow will also provide Mitsubishi Electric UK customers with a consultancy service for cyber security, which includes the provision of OT security risk assessments, provision of Radiflow intrusion detection software and general advice on alignment with IEC 62443-3. In addition, the solution is intended to help customers to support asset owners in satisfying the requirements of the NIS Directive along with due diligence in alignment with CPNI (Centre for the Protection of National Infrastructure) best practice.\n\n\u201cOur new collaboration with Radiflow provides expertise in the field of OT cyber security which compliments and broadens the services that we offer our customers through the Mitsubishi Electric UK System Service Operation,\u201d said David Bean, Solutions Manager for Mitsubishi Electric UK. \u201cThere is a growing demand for solutions that address the requirements of cyber security in the OT space and we are looking forward to delivering those solutions and building our relationship further with the team at Radiflow.\u201d\n\n\u201cRadiflow sees huge value for OT organisations to have cyber security services and solutions aligned with their automation systems,\u201d added Ilan Barda, Founder and CEO of Radiflow. \u201cBy combining the automation knowledge and tools of Mitsubishi with the OT cyber security skills and tools of Radiflow, we are able to provide a holistic view of an organisation\u2019s OT risk posture.\u201d\n\nwww.radiflow.com<\/a>","post_title":"Radiflow and Mitsubishi Electric UK collaborate on cyber security standards","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"radiflow-and-mitsubishi-electric-uk-collaborate-on-cyber-security-standards","to_ping":"","pinged":"","post_modified":"2020-11-30 17:30:25","post_modified_gmt":"2020-11-30 17:30:25","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4102","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":3359,"post_author":"3","post_date":"2020-10-16 17:11:16","post_date_gmt":"2020-10-16 16:11:16","post_content":"Senstar explains how its products can be applied to protect the full range of upstream, midstream, and downstream facilities in the oil and gas industry.","post_title":"Senstar explains its security solutions for oil and gas","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"senstar-explains-its-security-solutions-for-oil-and-gas","to_ping":"","pinged":"","post_modified":"2020-10-16 17:11:17","post_modified_gmt":"2020-10-16 16:11:17","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=3359","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"}],"next":false,"prev":false,"total_page":1},"paged":1,"column_class":"jeg_col_2o3","class":"epic_block_14"};

\n

Mackey agrees, stating: \"Avoiding becoming a victim of ransomware requires organisations to have a comprehensive cybersecurity plan in place that fully captures the risks of each software component, its role and lifecycle, and its deployment configuration and usage assumptions. Armed with this basic information, and an exhaustive inventory, it becomes possible to determine how each component might play a role in an attempted ransomware attack. <\/p>\n\n\n\n

\"An effort like the one impacting Colonial Pipeline is likely the result of multiple weaknesses in process and cyber-defences that were ultimately successfully exploited. With the age of some industrial software systems far exceeding that of commercial software, it\u2019s likely that older software wasn\u2019t designed to limit exposure to modern threats like ransomware attacks. <\/p>\n\n\n\n

\"While the age of the software has limited impact on its serviceability, threat models and defensive protections need to keep pace with new threats \u2013 something that can only be done if all weaknesses present in each component are known and accounted for. After all, if a criminal can identify your weaknesses faster than you can, luck is rarely on your side.\u201d<\/p>\n\n\n\n

\"While this is indeed a financial disaster, and will have a significant impact on many, let us also consider that this means that, at least for a time, threat actors had control of those very same IT systems.\"<\/p>Martin Jartelius, CSO, Outpost24<\/cite><\/blockquote><\/figure>\n\n\n\n

Taking back control <\/strong><\/p>\n\n\n\n

US government officials are currently working with Colonial to help it recover while scrambling to avoid more severe fuel supply disruptions should the outage continue. Whether the pipeline stays shut that long in turn depends on how deeply the hackers penetrated Colonial\u2019s network - and how soon cybersecurity experts can pull them out.<\/p>\n\n\n\n

\"As so many times before when talking about ransomware \u2013 to lock a system with ransomware you need a good degree of control of that system,\" says Martin Jartelius, CSO at Outpost24. \"While this is indeed a financial disaster, and will have a significant impact on many, let us also consider that this means that, at least for a time, threat actors had control of those very same IT systems. Preventive security, as well as segmentation, are critical for those kinds of environments.\"<\/p>\n\n\n\n

\"One thing to note here is that ransomware has to announce itself to be successful,\" adds Tim Erlin, VP at Tripwire. \"In industrial environments, cyber events aren\u2019t always this visible. Increasing visibility into industrial networks becomes more important as attackers continue to target critical infrastructure.\u201d<\/p>\n\n\n\n

Brad Brooks, CEO and President of OneLogin, rightfully concludes: \"This attack represents just how quickly the stakes are escalating on Cybersecurity, with controlling and knowing who has access to your IT systems a board level priority for every company. We are moving from an invisible Cold War that was focused on stealing data to a highly visible hot war that has real implications for physical property and people\u2019s lives.\u201d<\/p>\n","post_title":"Ransomware roundtable | A threat in the pipeline","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"ransomware-roundtable-a-threat-in-the-pipeline","to_ping":"","pinged":"","post_modified":"2021-05-10 18:12:55","post_modified_gmt":"2021-05-10 17:12:55","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=6024","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4871,"post_author":"3","post_date":"2021-02-09 19:22:22","post_date_gmt":"2021-02-09 19:22:22","post_content":"Detectives assigned to the Digital Forensics Unit at Pinellas County Sheriff\u2019s Office are investigating an unlawful computer software intrusion at the City of Oldsmar\u2019s water treatment plant. While the cyber attack was unsuccessful, it does highlight the need for cybersecurity tools in critical infrastructure applications.\n\nOn Friday, February 5, 2021, the Pinellas County Sheriff\u2019s Office was notified by the City of Oldsmar that its computer system had been remotely accessed at 8:00am and 1:30pm by an unknown suspect. According to detectives, the City of Oldsmar\u2019s computer system at the water treatment plant allows for remote access by authorised users to troubleshoot any system problems from other locations.\n\nThe initial intrusion was brief and not cause for concern due to supervisors regularly accessing the system remotely to monitor the system. At 1:30, a plant operator witnessed a second remote access user opening various functions in the system that control the amount of sodium hydroxide in the water. The operator noted the remote access user raised the levels of sodium hydroxide in the water from 100 parts per million to 11,100 parts per million. The operator immediately reduced the levels to their appropriate amount. Sodium hydroxide is used in small amounts to control acidity, but a large amount could have caused major problems in the water.\n\nThe initial investigation revealed that the hacker remotely accessed the treatment plant\u2019s computer for approximately 3 to 5 minutes. Speaking at a press conference about the cyber attack, Sheriff Bob Gualtieri stated: \u201cAt no time was there a significant effect on the water being treated, and more importantly the public was never in danger.\u201d\n\nCommenting on the attack, Andrea Carcano, co-founder at Nozomi Networks stated: \u201cUnfortunately, this attack plays into a troubling trend we\u2019ve been following over the last year. As the pandemic forced critical infrastructure organisations to quickly shift to remote access options to keep systems up and running, we\u2019ve seen threats rise and bad actors reach new lows \u2013 setting their sights on life threatening targets. Fortunately, in this case, operators monitoring Oldsmar\u2019s treatment plant spotted the attack and were able to respond before anyone could be harmed. But it\u2019s a stark reminder that with limited cybersecurity resources and few regulations water utilities are vulnerable to attack. When it comes critical infrastructure, operational resilience must a top priority and advances in AI-powered OT security and network monitoring are available to give operators the network visibility they need to quickly spot trouble and respond before harm is done.\u201d\n\n\u201cThis targeted attack appears to have started by the \u2018bad actor\u2019 getting access to a vulnerable network\/system and working their way through the network trying to find the next weak access point while gathering data and understanding how the organisation operates along the way,\u201d added Niamh Muldoon, Global Data Protection Officer at OneLogin. \u201cIn this instance, understanding the information assets, applying not only MFA but enhanced multi-factor authentication, would have reduced the risk of this unauthorised attack materializing. It\u2019s a critical part of the MFA policy to enforce time limits for end-users and their trusted devices to re-authenticate, requiring them not only to validate themselves but also the identity of the device trying to access critical systems\/applications and the network. Without knowing more of the details, applying enhanced MFA to the execution of critical actions particularly for IT and systems administrators would have reduced the associated risk further. Having logging in place, and understanding logged events would support with the associated monitoring and alerting events. After the event has happened, crisis management is critical for successfully managing the attack response to reduce business impact and consequences, and it appears the Florida agency has done that.\u201d\n\n\u201cWhile this incident will rightfully cause concern, it appears that likelihood of real damage was minimal due to the fail safes in place,\u201d observes Tim Erlin, VP at Tripwire. \u201cThere are real impacts to be worried about, and actions to be taken, but this doesn\u2019t appear to be a sophisticated or novel attack. From a cybersecurity standpoint, we should be particularly concerned about how the attacker was able to authenticate into the remote access software. That entry point should be very well protected, given that it provides access to such obviously sensitive capabilities. Protecting remote access into industrial systems where these types of changes can be made should be a high priority for any industrial environment.\u201d\n\nLocal, State, and Federal investigators are working together to identify those responsible and the investigation is ongoing. Other utility providers have been informed of the intrusion, so they can take their own protective measures.","post_title":"Florida water system cyber attack highlights role of cybersecurity in critical infrastructure","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"florida-water-system-cyber-attack-highlights-role-of-cybersecurity-in-critical-infrastructure","to_ping":"","pinged":"","post_modified":"2021-02-09 19:22:25","post_modified_gmt":"2021-02-09 19:22:25","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4871","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4178,"post_author":"3","post_date":"2020-12-07 14:52:36","post_date_gmt":"2020-12-07 14:52:36","post_content":"Nozomi Networks and Chinook Systems have partnered to provide advanced cybersecurity solutions to protect industrial and critical infrastructure facilities across North America. Under the deal, Chinook will offer Nozomi Networks\u2019 complete portfolio of OT and IoT security solutions.\n\n\u201cFacilities that fully leverage their OT systems deliver tremendous returns when it comes to energy and operational savings, the safety and comfort of occupants and lower total cost of ownership,\u201d said Chinook\u2019s President, Wanda Lenkewich. \u201cAt the same time, the network connectivity that enables these systems, also introduces new and growing cyber threats. Partnering with Nozomi Networks allows Chinook to support clients with an integrated, comprehensive cybersecurity solution that ensures cyber threats are actively discovered, monitored and managed.\u201d\n\n\u201cWe are absolutely delighted to team with Chinook to help industrial and critical infrastructure facilities meet new requirements for secure connectivity across OT, IT and IoT networks,\u201d said Chet Namboodri, Vice President, Worldwide Business Development and Channel Sales at Nozomi. \u201cWe\u2019ve already worked together to deliver on a number of joint customer engagements in both the government and commercial sectors. Partnering with Chinook accelerates our joint efforts to make sure facility-related control and building management systems are safe from cyber threats.\u201d\n\nwww.nozominetworks.com<\/a>\n\nwww.chinooksystems.com<\/a>\n\n ","post_title":"Nozomi Networks and Chinook Systems partner for OT and IoT security solutions","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"nozomi-networks-and-chinook-systems-partner-for-ot-and-iot-security-solutions","to_ping":"","pinged":"","post_modified":"2020-12-07 14:52:40","post_modified_gmt":"2020-12-07 14:52:40","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4178","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4140,"post_author":"3","post_date":"2020-12-03 11:07:21","post_date_gmt":"2020-12-03 11:07:21","post_content":"Civil Nuclear Constabulary (CNC) police officers based at Harwell have launched Project Servator a collaborative community approach to policing. Project Servator aims to disrupt a range of criminal activity, including terrorism, while providing a reassuring presence for the public.\n\nCNC\u2019s officers are experienced and specially trained to spot the tell-tale signs that someone is planning or preparing to commit an illegal act. It works with other police forces, local businesses and the public to protect the Harwell site and the surrounding area and everyone who lives, works or visits there and to make it a difficult place for terrorists and other criminals to operate. Project Servator has been successful in gathering intelligence that has assisted Counter Terrorism Units across the UK in investigating and preventing acts of terror.\n\nProject Servator\u2019s patrols are highly visible and can happen at any time and in any location. Officers will talk to the public and local businesses to let them know what they\u2019re doing and remind them to be vigilant, trust their instincts and report any suspicious or unusual behaviour.\n\n\u201cWe are deploying these additional tactics to further complement the operational activity that exists in and around our Operational Policing Units,\u201d explained Supt Donna Jones, who is leading on the implementation of the project across the Constabulary. \u201cOur aim is to build upon relationships with partners as well as businesses and communities. These tactics are not new but allow us to have a focus on community engagement and encourage people to be our extra eyes and ears. This is not restricted to the Harwell site but also extends to the surrounding area. We are aware of the vast amount of information members of our community have and they are aware of what is out of the ordinary. All we ask is that they report any suspicions to us and we\u2019ll do the rest. The deployments will be unpredictable and our tactics will vary from one deployment to the next. The aim is to work with our local communities to deter any hostile threat.\u201d\n\nwww.gov.uk\/government\/organisations\/civil-nuclear-constabulary<\/a>","post_title":"CNC Harwell launches Project Servator","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"cnc-harwell-launches-project-servator","to_ping":"","pinged":"","post_modified":"2020-12-03 11:07:23","post_modified_gmt":"2020-12-03 11:07:23","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4140","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4102,"post_author":"3","post_date":"2020-11-30 17:30:23","post_date_gmt":"2020-11-30 17:30:23","post_content":"Radiflow and Mitsubishi Electric UK are collaborating to address the needs of IEC62443 cyber security standards in the Critical Infrastructure and Industrial Automation markets. The companys believe that the combination of the automation knowledge and tools of Mitsubishi Electric UK with the cyber security and IEC 62443 compliance skills of Radiflow will provide a holistic view of a client\u2019s risk posture.\n\nRadiflow will also provide Mitsubishi Electric UK customers with a consultancy service for cyber security, which includes the provision of OT security risk assessments, provision of Radiflow intrusion detection software and general advice on alignment with IEC 62443-3. In addition, the solution is intended to help customers to support asset owners in satisfying the requirements of the NIS Directive along with due diligence in alignment with CPNI (Centre for the Protection of National Infrastructure) best practice.\n\n\u201cOur new collaboration with Radiflow provides expertise in the field of OT cyber security which compliments and broadens the services that we offer our customers through the Mitsubishi Electric UK System Service Operation,\u201d said David Bean, Solutions Manager for Mitsubishi Electric UK. \u201cThere is a growing demand for solutions that address the requirements of cyber security in the OT space and we are looking forward to delivering those solutions and building our relationship further with the team at Radiflow.\u201d\n\n\u201cRadiflow sees huge value for OT organisations to have cyber security services and solutions aligned with their automation systems,\u201d added Ilan Barda, Founder and CEO of Radiflow. \u201cBy combining the automation knowledge and tools of Mitsubishi with the OT cyber security skills and tools of Radiflow, we are able to provide a holistic view of an organisation\u2019s OT risk posture.\u201d\n\nwww.radiflow.com<\/a>","post_title":"Radiflow and Mitsubishi Electric UK collaborate on cyber security standards","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"radiflow-and-mitsubishi-electric-uk-collaborate-on-cyber-security-standards","to_ping":"","pinged":"","post_modified":"2020-11-30 17:30:25","post_modified_gmt":"2020-11-30 17:30:25","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4102","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":3359,"post_author":"3","post_date":"2020-10-16 17:11:16","post_date_gmt":"2020-10-16 16:11:16","post_content":"Senstar explains how its products can be applied to protect the full range of upstream, midstream, and downstream facilities in the oil and gas industry.","post_title":"Senstar explains its security solutions for oil and gas","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"senstar-explains-its-security-solutions-for-oil-and-gas","to_ping":"","pinged":"","post_modified":"2020-10-16 17:11:17","post_modified_gmt":"2020-10-16 16:11:17","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=3359","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"}],"next":false,"prev":false,"total_page":1},"paged":1,"column_class":"jeg_col_2o3","class":"epic_block_14"};

\n

\"If the public and private sectors can work together to solve complex cybersecurity issues, and at the same time accurately identify the threat actors and bring them to account for their actions, it will go a long way in reversing the adversary advantage and enable defenders to retake the high ground. There is also another significant opportunity here as well to cooperate on a global scale to develop extradition laws that enable cyber crimes and cyber espionage to be prosecuted more effectively.\u201d<\/p>\n\n\n\n

Mackey agrees, stating: \"Avoiding becoming a victim of ransomware requires organisations to have a comprehensive cybersecurity plan in place that fully captures the risks of each software component, its role and lifecycle, and its deployment configuration and usage assumptions. Armed with this basic information, and an exhaustive inventory, it becomes possible to determine how each component might play a role in an attempted ransomware attack. <\/p>\n\n\n\n

\"An effort like the one impacting Colonial Pipeline is likely the result of multiple weaknesses in process and cyber-defences that were ultimately successfully exploited. With the age of some industrial software systems far exceeding that of commercial software, it\u2019s likely that older software wasn\u2019t designed to limit exposure to modern threats like ransomware attacks. <\/p>\n\n\n\n

\"While the age of the software has limited impact on its serviceability, threat models and defensive protections need to keep pace with new threats \u2013 something that can only be done if all weaknesses present in each component are known and accounted for. After all, if a criminal can identify your weaknesses faster than you can, luck is rarely on your side.\u201d<\/p>\n\n\n\n

\"While this is indeed a financial disaster, and will have a significant impact on many, let us also consider that this means that, at least for a time, threat actors had control of those very same IT systems.\"<\/p>Martin Jartelius, CSO, Outpost24<\/cite><\/blockquote><\/figure>\n\n\n\n

Taking back control <\/strong><\/p>\n\n\n\n

US government officials are currently working with Colonial to help it recover while scrambling to avoid more severe fuel supply disruptions should the outage continue. Whether the pipeline stays shut that long in turn depends on how deeply the hackers penetrated Colonial\u2019s network - and how soon cybersecurity experts can pull them out.<\/p>\n\n\n\n

\"As so many times before when talking about ransomware \u2013 to lock a system with ransomware you need a good degree of control of that system,\" says Martin Jartelius, CSO at Outpost24. \"While this is indeed a financial disaster, and will have a significant impact on many, let us also consider that this means that, at least for a time, threat actors had control of those very same IT systems. Preventive security, as well as segmentation, are critical for those kinds of environments.\"<\/p>\n\n\n\n

\"One thing to note here is that ransomware has to announce itself to be successful,\" adds Tim Erlin, VP at Tripwire. \"In industrial environments, cyber events aren\u2019t always this visible. Increasing visibility into industrial networks becomes more important as attackers continue to target critical infrastructure.\u201d<\/p>\n\n\n\n

Brad Brooks, CEO and President of OneLogin, rightfully concludes: \"This attack represents just how quickly the stakes are escalating on Cybersecurity, with controlling and knowing who has access to your IT systems a board level priority for every company. We are moving from an invisible Cold War that was focused on stealing data to a highly visible hot war that has real implications for physical property and people\u2019s lives.\u201d<\/p>\n","post_title":"Ransomware roundtable | A threat in the pipeline","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"ransomware-roundtable-a-threat-in-the-pipeline","to_ping":"","pinged":"","post_modified":"2021-05-10 18:12:55","post_modified_gmt":"2021-05-10 17:12:55","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=6024","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4871,"post_author":"3","post_date":"2021-02-09 19:22:22","post_date_gmt":"2021-02-09 19:22:22","post_content":"Detectives assigned to the Digital Forensics Unit at Pinellas County Sheriff\u2019s Office are investigating an unlawful computer software intrusion at the City of Oldsmar\u2019s water treatment plant. While the cyber attack was unsuccessful, it does highlight the need for cybersecurity tools in critical infrastructure applications.\n\nOn Friday, February 5, 2021, the Pinellas County Sheriff\u2019s Office was notified by the City of Oldsmar that its computer system had been remotely accessed at 8:00am and 1:30pm by an unknown suspect. According to detectives, the City of Oldsmar\u2019s computer system at the water treatment plant allows for remote access by authorised users to troubleshoot any system problems from other locations.\n\nThe initial intrusion was brief and not cause for concern due to supervisors regularly accessing the system remotely to monitor the system. At 1:30, a plant operator witnessed a second remote access user opening various functions in the system that control the amount of sodium hydroxide in the water. The operator noted the remote access user raised the levels of sodium hydroxide in the water from 100 parts per million to 11,100 parts per million. The operator immediately reduced the levels to their appropriate amount. Sodium hydroxide is used in small amounts to control acidity, but a large amount could have caused major problems in the water.\n\nThe initial investigation revealed that the hacker remotely accessed the treatment plant\u2019s computer for approximately 3 to 5 minutes. Speaking at a press conference about the cyber attack, Sheriff Bob Gualtieri stated: \u201cAt no time was there a significant effect on the water being treated, and more importantly the public was never in danger.\u201d\n\nCommenting on the attack, Andrea Carcano, co-founder at Nozomi Networks stated: \u201cUnfortunately, this attack plays into a troubling trend we\u2019ve been following over the last year. As the pandemic forced critical infrastructure organisations to quickly shift to remote access options to keep systems up and running, we\u2019ve seen threats rise and bad actors reach new lows \u2013 setting their sights on life threatening targets. Fortunately, in this case, operators monitoring Oldsmar\u2019s treatment plant spotted the attack and were able to respond before anyone could be harmed. But it\u2019s a stark reminder that with limited cybersecurity resources and few regulations water utilities are vulnerable to attack. When it comes critical infrastructure, operational resilience must a top priority and advances in AI-powered OT security and network monitoring are available to give operators the network visibility they need to quickly spot trouble and respond before harm is done.\u201d\n\n\u201cThis targeted attack appears to have started by the \u2018bad actor\u2019 getting access to a vulnerable network\/system and working their way through the network trying to find the next weak access point while gathering data and understanding how the organisation operates along the way,\u201d added Niamh Muldoon, Global Data Protection Officer at OneLogin. \u201cIn this instance, understanding the information assets, applying not only MFA but enhanced multi-factor authentication, would have reduced the risk of this unauthorised attack materializing. It\u2019s a critical part of the MFA policy to enforce time limits for end-users and their trusted devices to re-authenticate, requiring them not only to validate themselves but also the identity of the device trying to access critical systems\/applications and the network. Without knowing more of the details, applying enhanced MFA to the execution of critical actions particularly for IT and systems administrators would have reduced the associated risk further. Having logging in place, and understanding logged events would support with the associated monitoring and alerting events. After the event has happened, crisis management is critical for successfully managing the attack response to reduce business impact and consequences, and it appears the Florida agency has done that.\u201d\n\n\u201cWhile this incident will rightfully cause concern, it appears that likelihood of real damage was minimal due to the fail safes in place,\u201d observes Tim Erlin, VP at Tripwire. \u201cThere are real impacts to be worried about, and actions to be taken, but this doesn\u2019t appear to be a sophisticated or novel attack. From a cybersecurity standpoint, we should be particularly concerned about how the attacker was able to authenticate into the remote access software. That entry point should be very well protected, given that it provides access to such obviously sensitive capabilities. Protecting remote access into industrial systems where these types of changes can be made should be a high priority for any industrial environment.\u201d\n\nLocal, State, and Federal investigators are working together to identify those responsible and the investigation is ongoing. Other utility providers have been informed of the intrusion, so they can take their own protective measures.","post_title":"Florida water system cyber attack highlights role of cybersecurity in critical infrastructure","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"florida-water-system-cyber-attack-highlights-role-of-cybersecurity-in-critical-infrastructure","to_ping":"","pinged":"","post_modified":"2021-02-09 19:22:25","post_modified_gmt":"2021-02-09 19:22:25","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4871","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4178,"post_author":"3","post_date":"2020-12-07 14:52:36","post_date_gmt":"2020-12-07 14:52:36","post_content":"Nozomi Networks and Chinook Systems have partnered to provide advanced cybersecurity solutions to protect industrial and critical infrastructure facilities across North America. Under the deal, Chinook will offer Nozomi Networks\u2019 complete portfolio of OT and IoT security solutions.\n\n\u201cFacilities that fully leverage their OT systems deliver tremendous returns when it comes to energy and operational savings, the safety and comfort of occupants and lower total cost of ownership,\u201d said Chinook\u2019s President, Wanda Lenkewich. \u201cAt the same time, the network connectivity that enables these systems, also introduces new and growing cyber threats. Partnering with Nozomi Networks allows Chinook to support clients with an integrated, comprehensive cybersecurity solution that ensures cyber threats are actively discovered, monitored and managed.\u201d\n\n\u201cWe are absolutely delighted to team with Chinook to help industrial and critical infrastructure facilities meet new requirements for secure connectivity across OT, IT and IoT networks,\u201d said Chet Namboodri, Vice President, Worldwide Business Development and Channel Sales at Nozomi. \u201cWe\u2019ve already worked together to deliver on a number of joint customer engagements in both the government and commercial sectors. Partnering with Chinook accelerates our joint efforts to make sure facility-related control and building management systems are safe from cyber threats.\u201d\n\nwww.nozominetworks.com<\/a>\n\nwww.chinooksystems.com<\/a>\n\n ","post_title":"Nozomi Networks and Chinook Systems partner for OT and IoT security solutions","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"nozomi-networks-and-chinook-systems-partner-for-ot-and-iot-security-solutions","to_ping":"","pinged":"","post_modified":"2020-12-07 14:52:40","post_modified_gmt":"2020-12-07 14:52:40","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4178","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4140,"post_author":"3","post_date":"2020-12-03 11:07:21","post_date_gmt":"2020-12-03 11:07:21","post_content":"Civil Nuclear Constabulary (CNC) police officers based at Harwell have launched Project Servator a collaborative community approach to policing. Project Servator aims to disrupt a range of criminal activity, including terrorism, while providing a reassuring presence for the public.\n\nCNC\u2019s officers are experienced and specially trained to spot the tell-tale signs that someone is planning or preparing to commit an illegal act. It works with other police forces, local businesses and the public to protect the Harwell site and the surrounding area and everyone who lives, works or visits there and to make it a difficult place for terrorists and other criminals to operate. Project Servator has been successful in gathering intelligence that has assisted Counter Terrorism Units across the UK in investigating and preventing acts of terror.\n\nProject Servator\u2019s patrols are highly visible and can happen at any time and in any location. Officers will talk to the public and local businesses to let them know what they\u2019re doing and remind them to be vigilant, trust their instincts and report any suspicious or unusual behaviour.\n\n\u201cWe are deploying these additional tactics to further complement the operational activity that exists in and around our Operational Policing Units,\u201d explained Supt Donna Jones, who is leading on the implementation of the project across the Constabulary. \u201cOur aim is to build upon relationships with partners as well as businesses and communities. These tactics are not new but allow us to have a focus on community engagement and encourage people to be our extra eyes and ears. This is not restricted to the Harwell site but also extends to the surrounding area. We are aware of the vast amount of information members of our community have and they are aware of what is out of the ordinary. All we ask is that they report any suspicions to us and we\u2019ll do the rest. The deployments will be unpredictable and our tactics will vary from one deployment to the next. The aim is to work with our local communities to deter any hostile threat.\u201d\n\nwww.gov.uk\/government\/organisations\/civil-nuclear-constabulary<\/a>","post_title":"CNC Harwell launches Project Servator","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"cnc-harwell-launches-project-servator","to_ping":"","pinged":"","post_modified":"2020-12-03 11:07:23","post_modified_gmt":"2020-12-03 11:07:23","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4140","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4102,"post_author":"3","post_date":"2020-11-30 17:30:23","post_date_gmt":"2020-11-30 17:30:23","post_content":"Radiflow and Mitsubishi Electric UK are collaborating to address the needs of IEC62443 cyber security standards in the Critical Infrastructure and Industrial Automation markets. The companys believe that the combination of the automation knowledge and tools of Mitsubishi Electric UK with the cyber security and IEC 62443 compliance skills of Radiflow will provide a holistic view of a client\u2019s risk posture.\n\nRadiflow will also provide Mitsubishi Electric UK customers with a consultancy service for cyber security, which includes the provision of OT security risk assessments, provision of Radiflow intrusion detection software and general advice on alignment with IEC 62443-3. In addition, the solution is intended to help customers to support asset owners in satisfying the requirements of the NIS Directive along with due diligence in alignment with CPNI (Centre for the Protection of National Infrastructure) best practice.\n\n\u201cOur new collaboration with Radiflow provides expertise in the field of OT cyber security which compliments and broadens the services that we offer our customers through the Mitsubishi Electric UK System Service Operation,\u201d said David Bean, Solutions Manager for Mitsubishi Electric UK. \u201cThere is a growing demand for solutions that address the requirements of cyber security in the OT space and we are looking forward to delivering those solutions and building our relationship further with the team at Radiflow.\u201d\n\n\u201cRadiflow sees huge value for OT organisations to have cyber security services and solutions aligned with their automation systems,\u201d added Ilan Barda, Founder and CEO of Radiflow. \u201cBy combining the automation knowledge and tools of Mitsubishi with the OT cyber security skills and tools of Radiflow, we are able to provide a holistic view of an organisation\u2019s OT risk posture.\u201d\n\nwww.radiflow.com<\/a>","post_title":"Radiflow and Mitsubishi Electric UK collaborate on cyber security standards","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"radiflow-and-mitsubishi-electric-uk-collaborate-on-cyber-security-standards","to_ping":"","pinged":"","post_modified":"2020-11-30 17:30:25","post_modified_gmt":"2020-11-30 17:30:25","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4102","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":3359,"post_author":"3","post_date":"2020-10-16 17:11:16","post_date_gmt":"2020-10-16 16:11:16","post_content":"Senstar explains how its products can be applied to protect the full range of upstream, midstream, and downstream facilities in the oil and gas industry.","post_title":"Senstar explains its security solutions for oil and gas","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"senstar-explains-its-security-solutions-for-oil-and-gas","to_ping":"","pinged":"","post_modified":"2020-10-16 17:11:17","post_modified_gmt":"2020-10-16 16:11:17","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=3359","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"}],"next":false,"prev":false,"total_page":1},"paged":1,"column_class":"jeg_col_2o3","class":"epic_block_14"};

\n

Lior Div, CEO and Co-founder of Cybereason also comments: \"The SolarWinds<\/a> and Microsoft Exchange Server<\/a> attacks were unparalleled in their scope, successfully infiltrating and compromising virtually every US government agency and a wide array of medium and large private sector companies. The Colonial Pipeline attack reinforces the need to update legacy systems running today\u2019s critical infrastructure networks.<\/p>\n\n\n\n

\"If the public and private sectors can work together to solve complex cybersecurity issues, and at the same time accurately identify the threat actors and bring them to account for their actions, it will go a long way in reversing the adversary advantage and enable defenders to retake the high ground. There is also another significant opportunity here as well to cooperate on a global scale to develop extradition laws that enable cyber crimes and cyber espionage to be prosecuted more effectively.\u201d<\/p>\n\n\n\n

Mackey agrees, stating: \"Avoiding becoming a victim of ransomware requires organisations to have a comprehensive cybersecurity plan in place that fully captures the risks of each software component, its role and lifecycle, and its deployment configuration and usage assumptions. Armed with this basic information, and an exhaustive inventory, it becomes possible to determine how each component might play a role in an attempted ransomware attack. <\/p>\n\n\n\n

\"An effort like the one impacting Colonial Pipeline is likely the result of multiple weaknesses in process and cyber-defences that were ultimately successfully exploited. With the age of some industrial software systems far exceeding that of commercial software, it\u2019s likely that older software wasn\u2019t designed to limit exposure to modern threats like ransomware attacks. <\/p>\n\n\n\n

\"While the age of the software has limited impact on its serviceability, threat models and defensive protections need to keep pace with new threats \u2013 something that can only be done if all weaknesses present in each component are known and accounted for. After all, if a criminal can identify your weaknesses faster than you can, luck is rarely on your side.\u201d<\/p>\n\n\n\n

\"While this is indeed a financial disaster, and will have a significant impact on many, let us also consider that this means that, at least for a time, threat actors had control of those very same IT systems.\"<\/p>Martin Jartelius, CSO, Outpost24<\/cite><\/blockquote><\/figure>\n\n\n\n

Taking back control <\/strong><\/p>\n\n\n\n

US government officials are currently working with Colonial to help it recover while scrambling to avoid more severe fuel supply disruptions should the outage continue. Whether the pipeline stays shut that long in turn depends on how deeply the hackers penetrated Colonial\u2019s network - and how soon cybersecurity experts can pull them out.<\/p>\n\n\n\n

\"As so many times before when talking about ransomware \u2013 to lock a system with ransomware you need a good degree of control of that system,\" says Martin Jartelius, CSO at Outpost24. \"While this is indeed a financial disaster, and will have a significant impact on many, let us also consider that this means that, at least for a time, threat actors had control of those very same IT systems. Preventive security, as well as segmentation, are critical for those kinds of environments.\"<\/p>\n\n\n\n

\"One thing to note here is that ransomware has to announce itself to be successful,\" adds Tim Erlin, VP at Tripwire. \"In industrial environments, cyber events aren\u2019t always this visible. Increasing visibility into industrial networks becomes more important as attackers continue to target critical infrastructure.\u201d<\/p>\n\n\n\n

Brad Brooks, CEO and President of OneLogin, rightfully concludes: \"This attack represents just how quickly the stakes are escalating on Cybersecurity, with controlling and knowing who has access to your IT systems a board level priority for every company. We are moving from an invisible Cold War that was focused on stealing data to a highly visible hot war that has real implications for physical property and people\u2019s lives.\u201d<\/p>\n","post_title":"Ransomware roundtable | A threat in the pipeline","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"ransomware-roundtable-a-threat-in-the-pipeline","to_ping":"","pinged":"","post_modified":"2021-05-10 18:12:55","post_modified_gmt":"2021-05-10 17:12:55","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=6024","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4871,"post_author":"3","post_date":"2021-02-09 19:22:22","post_date_gmt":"2021-02-09 19:22:22","post_content":"Detectives assigned to the Digital Forensics Unit at Pinellas County Sheriff\u2019s Office are investigating an unlawful computer software intrusion at the City of Oldsmar\u2019s water treatment plant. While the cyber attack was unsuccessful, it does highlight the need for cybersecurity tools in critical infrastructure applications.\n\nOn Friday, February 5, 2021, the Pinellas County Sheriff\u2019s Office was notified by the City of Oldsmar that its computer system had been remotely accessed at 8:00am and 1:30pm by an unknown suspect. According to detectives, the City of Oldsmar\u2019s computer system at the water treatment plant allows for remote access by authorised users to troubleshoot any system problems from other locations.\n\nThe initial intrusion was brief and not cause for concern due to supervisors regularly accessing the system remotely to monitor the system. At 1:30, a plant operator witnessed a second remote access user opening various functions in the system that control the amount of sodium hydroxide in the water. The operator noted the remote access user raised the levels of sodium hydroxide in the water from 100 parts per million to 11,100 parts per million. The operator immediately reduced the levels to their appropriate amount. Sodium hydroxide is used in small amounts to control acidity, but a large amount could have caused major problems in the water.\n\nThe initial investigation revealed that the hacker remotely accessed the treatment plant\u2019s computer for approximately 3 to 5 minutes. Speaking at a press conference about the cyber attack, Sheriff Bob Gualtieri stated: \u201cAt no time was there a significant effect on the water being treated, and more importantly the public was never in danger.\u201d\n\nCommenting on the attack, Andrea Carcano, co-founder at Nozomi Networks stated: \u201cUnfortunately, this attack plays into a troubling trend we\u2019ve been following over the last year. As the pandemic forced critical infrastructure organisations to quickly shift to remote access options to keep systems up and running, we\u2019ve seen threats rise and bad actors reach new lows \u2013 setting their sights on life threatening targets. Fortunately, in this case, operators monitoring Oldsmar\u2019s treatment plant spotted the attack and were able to respond before anyone could be harmed. But it\u2019s a stark reminder that with limited cybersecurity resources and few regulations water utilities are vulnerable to attack. When it comes critical infrastructure, operational resilience must a top priority and advances in AI-powered OT security and network monitoring are available to give operators the network visibility they need to quickly spot trouble and respond before harm is done.\u201d\n\n\u201cThis targeted attack appears to have started by the \u2018bad actor\u2019 getting access to a vulnerable network\/system and working their way through the network trying to find the next weak access point while gathering data and understanding how the organisation operates along the way,\u201d added Niamh Muldoon, Global Data Protection Officer at OneLogin. \u201cIn this instance, understanding the information assets, applying not only MFA but enhanced multi-factor authentication, would have reduced the risk of this unauthorised attack materializing. It\u2019s a critical part of the MFA policy to enforce time limits for end-users and their trusted devices to re-authenticate, requiring them not only to validate themselves but also the identity of the device trying to access critical systems\/applications and the network. Without knowing more of the details, applying enhanced MFA to the execution of critical actions particularly for IT and systems administrators would have reduced the associated risk further. Having logging in place, and understanding logged events would support with the associated monitoring and alerting events. After the event has happened, crisis management is critical for successfully managing the attack response to reduce business impact and consequences, and it appears the Florida agency has done that.\u201d\n\n\u201cWhile this incident will rightfully cause concern, it appears that likelihood of real damage was minimal due to the fail safes in place,\u201d observes Tim Erlin, VP at Tripwire. \u201cThere are real impacts to be worried about, and actions to be taken, but this doesn\u2019t appear to be a sophisticated or novel attack. From a cybersecurity standpoint, we should be particularly concerned about how the attacker was able to authenticate into the remote access software. That entry point should be very well protected, given that it provides access to such obviously sensitive capabilities. Protecting remote access into industrial systems where these types of changes can be made should be a high priority for any industrial environment.\u201d\n\nLocal, State, and Federal investigators are working together to identify those responsible and the investigation is ongoing. Other utility providers have been informed of the intrusion, so they can take their own protective measures.","post_title":"Florida water system cyber attack highlights role of cybersecurity in critical infrastructure","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"florida-water-system-cyber-attack-highlights-role-of-cybersecurity-in-critical-infrastructure","to_ping":"","pinged":"","post_modified":"2021-02-09 19:22:25","post_modified_gmt":"2021-02-09 19:22:25","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4871","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4178,"post_author":"3","post_date":"2020-12-07 14:52:36","post_date_gmt":"2020-12-07 14:52:36","post_content":"Nozomi Networks and Chinook Systems have partnered to provide advanced cybersecurity solutions to protect industrial and critical infrastructure facilities across North America. Under the deal, Chinook will offer Nozomi Networks\u2019 complete portfolio of OT and IoT security solutions.\n\n\u201cFacilities that fully leverage their OT systems deliver tremendous returns when it comes to energy and operational savings, the safety and comfort of occupants and lower total cost of ownership,\u201d said Chinook\u2019s President, Wanda Lenkewich. \u201cAt the same time, the network connectivity that enables these systems, also introduces new and growing cyber threats. Partnering with Nozomi Networks allows Chinook to support clients with an integrated, comprehensive cybersecurity solution that ensures cyber threats are actively discovered, monitored and managed.\u201d\n\n\u201cWe are absolutely delighted to team with Chinook to help industrial and critical infrastructure facilities meet new requirements for secure connectivity across OT, IT and IoT networks,\u201d said Chet Namboodri, Vice President, Worldwide Business Development and Channel Sales at Nozomi. \u201cWe\u2019ve already worked together to deliver on a number of joint customer engagements in both the government and commercial sectors. Partnering with Chinook accelerates our joint efforts to make sure facility-related control and building management systems are safe from cyber threats.\u201d\n\nwww.nozominetworks.com<\/a>\n\nwww.chinooksystems.com<\/a>\n\n ","post_title":"Nozomi Networks and Chinook Systems partner for OT and IoT security solutions","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"nozomi-networks-and-chinook-systems-partner-for-ot-and-iot-security-solutions","to_ping":"","pinged":"","post_modified":"2020-12-07 14:52:40","post_modified_gmt":"2020-12-07 14:52:40","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4178","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4140,"post_author":"3","post_date":"2020-12-03 11:07:21","post_date_gmt":"2020-12-03 11:07:21","post_content":"Civil Nuclear Constabulary (CNC) police officers based at Harwell have launched Project Servator a collaborative community approach to policing. Project Servator aims to disrupt a range of criminal activity, including terrorism, while providing a reassuring presence for the public.\n\nCNC\u2019s officers are experienced and specially trained to spot the tell-tale signs that someone is planning or preparing to commit an illegal act. It works with other police forces, local businesses and the public to protect the Harwell site and the surrounding area and everyone who lives, works or visits there and to make it a difficult place for terrorists and other criminals to operate. Project Servator has been successful in gathering intelligence that has assisted Counter Terrorism Units across the UK in investigating and preventing acts of terror.\n\nProject Servator\u2019s patrols are highly visible and can happen at any time and in any location. Officers will talk to the public and local businesses to let them know what they\u2019re doing and remind them to be vigilant, trust their instincts and report any suspicious or unusual behaviour.\n\n\u201cWe are deploying these additional tactics to further complement the operational activity that exists in and around our Operational Policing Units,\u201d explained Supt Donna Jones, who is leading on the implementation of the project across the Constabulary. \u201cOur aim is to build upon relationships with partners as well as businesses and communities. These tactics are not new but allow us to have a focus on community engagement and encourage people to be our extra eyes and ears. This is not restricted to the Harwell site but also extends to the surrounding area. We are aware of the vast amount of information members of our community have and they are aware of what is out of the ordinary. All we ask is that they report any suspicions to us and we\u2019ll do the rest. The deployments will be unpredictable and our tactics will vary from one deployment to the next. The aim is to work with our local communities to deter any hostile threat.\u201d\n\nwww.gov.uk\/government\/organisations\/civil-nuclear-constabulary<\/a>","post_title":"CNC Harwell launches Project Servator","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"cnc-harwell-launches-project-servator","to_ping":"","pinged":"","post_modified":"2020-12-03 11:07:23","post_modified_gmt":"2020-12-03 11:07:23","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4140","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4102,"post_author":"3","post_date":"2020-11-30 17:30:23","post_date_gmt":"2020-11-30 17:30:23","post_content":"Radiflow and Mitsubishi Electric UK are collaborating to address the needs of IEC62443 cyber security standards in the Critical Infrastructure and Industrial Automation markets. The companys believe that the combination of the automation knowledge and tools of Mitsubishi Electric UK with the cyber security and IEC 62443 compliance skills of Radiflow will provide a holistic view of a client\u2019s risk posture.\n\nRadiflow will also provide Mitsubishi Electric UK customers with a consultancy service for cyber security, which includes the provision of OT security risk assessments, provision of Radiflow intrusion detection software and general advice on alignment with IEC 62443-3. In addition, the solution is intended to help customers to support asset owners in satisfying the requirements of the NIS Directive along with due diligence in alignment with CPNI (Centre for the Protection of National Infrastructure) best practice.\n\n\u201cOur new collaboration with Radiflow provides expertise in the field of OT cyber security which compliments and broadens the services that we offer our customers through the Mitsubishi Electric UK System Service Operation,\u201d said David Bean, Solutions Manager for Mitsubishi Electric UK. \u201cThere is a growing demand for solutions that address the requirements of cyber security in the OT space and we are looking forward to delivering those solutions and building our relationship further with the team at Radiflow.\u201d\n\n\u201cRadiflow sees huge value for OT organisations to have cyber security services and solutions aligned with their automation systems,\u201d added Ilan Barda, Founder and CEO of Radiflow. \u201cBy combining the automation knowledge and tools of Mitsubishi with the OT cyber security skills and tools of Radiflow, we are able to provide a holistic view of an organisation\u2019s OT risk posture.\u201d\n\nwww.radiflow.com<\/a>","post_title":"Radiflow and Mitsubishi Electric UK collaborate on cyber security standards","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"radiflow-and-mitsubishi-electric-uk-collaborate-on-cyber-security-standards","to_ping":"","pinged":"","post_modified":"2020-11-30 17:30:25","post_modified_gmt":"2020-11-30 17:30:25","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4102","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":3359,"post_author":"3","post_date":"2020-10-16 17:11:16","post_date_gmt":"2020-10-16 16:11:16","post_content":"Senstar explains how its products can be applied to protect the full range of upstream, midstream, and downstream facilities in the oil and gas industry.","post_title":"Senstar explains its security solutions for oil and gas","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"senstar-explains-its-security-solutions-for-oil-and-gas","to_ping":"","pinged":"","post_modified":"2020-10-16 17:11:17","post_modified_gmt":"2020-10-16 16:11:17","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=3359","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"}],"next":false,"prev":false,"total_page":1},"paged":1,"column_class":"jeg_col_2o3","class":"epic_block_14"};

\n

\u201cThese \u2018Cyber Physical\u2019 attacks are a big deal, because they demonstrate just how fragile the provision of critical services are into society,\" says Andy Norton European Cyber Risk Officer at Armis. \"A few weeks ago a water treatment plant<\/a> was compromised leading to the potential for poisoning of the water. Now, 45% of the US oil energy provision has been switched off to the East coast. Prolonged shortages in critical services lead to civil unrest, economic pressures, and a general lack of confidence in public administration.\" <\/p>\n\n\n\n

Lior Div, CEO and Co-founder of Cybereason also comments: \"The SolarWinds<\/a> and Microsoft Exchange Server<\/a> attacks were unparalleled in their scope, successfully infiltrating and compromising virtually every US government agency and a wide array of medium and large private sector companies. The Colonial Pipeline attack reinforces the need to update legacy systems running today\u2019s critical infrastructure networks.<\/p>\n\n\n\n

\"If the public and private sectors can work together to solve complex cybersecurity issues, and at the same time accurately identify the threat actors and bring them to account for their actions, it will go a long way in reversing the adversary advantage and enable defenders to retake the high ground. There is also another significant opportunity here as well to cooperate on a global scale to develop extradition laws that enable cyber crimes and cyber espionage to be prosecuted more effectively.\u201d<\/p>\n\n\n\n

Mackey agrees, stating: \"Avoiding becoming a victim of ransomware requires organisations to have a comprehensive cybersecurity plan in place that fully captures the risks of each software component, its role and lifecycle, and its deployment configuration and usage assumptions. Armed with this basic information, and an exhaustive inventory, it becomes possible to determine how each component might play a role in an attempted ransomware attack. <\/p>\n\n\n\n

\"An effort like the one impacting Colonial Pipeline is likely the result of multiple weaknesses in process and cyber-defences that were ultimately successfully exploited. With the age of some industrial software systems far exceeding that of commercial software, it\u2019s likely that older software wasn\u2019t designed to limit exposure to modern threats like ransomware attacks. <\/p>\n\n\n\n

\"While the age of the software has limited impact on its serviceability, threat models and defensive protections need to keep pace with new threats \u2013 something that can only be done if all weaknesses present in each component are known and accounted for. After all, if a criminal can identify your weaknesses faster than you can, luck is rarely on your side.\u201d<\/p>\n\n\n\n

\"While this is indeed a financial disaster, and will have a significant impact on many, let us also consider that this means that, at least for a time, threat actors had control of those very same IT systems.\"<\/p>Martin Jartelius, CSO, Outpost24<\/cite><\/blockquote><\/figure>\n\n\n\n

Taking back control <\/strong><\/p>\n\n\n\n

US government officials are currently working with Colonial to help it recover while scrambling to avoid more severe fuel supply disruptions should the outage continue. Whether the pipeline stays shut that long in turn depends on how deeply the hackers penetrated Colonial\u2019s network - and how soon cybersecurity experts can pull them out.<\/p>\n\n\n\n

\"As so many times before when talking about ransomware \u2013 to lock a system with ransomware you need a good degree of control of that system,\" says Martin Jartelius, CSO at Outpost24. \"While this is indeed a financial disaster, and will have a significant impact on many, let us also consider that this means that, at least for a time, threat actors had control of those very same IT systems. Preventive security, as well as segmentation, are critical for those kinds of environments.\"<\/p>\n\n\n\n

\"One thing to note here is that ransomware has to announce itself to be successful,\" adds Tim Erlin, VP at Tripwire. \"In industrial environments, cyber events aren\u2019t always this visible. Increasing visibility into industrial networks becomes more important as attackers continue to target critical infrastructure.\u201d<\/p>\n\n\n\n

Brad Brooks, CEO and President of OneLogin, rightfully concludes: \"This attack represents just how quickly the stakes are escalating on Cybersecurity, with controlling and knowing who has access to your IT systems a board level priority for every company. We are moving from an invisible Cold War that was focused on stealing data to a highly visible hot war that has real implications for physical property and people\u2019s lives.\u201d<\/p>\n","post_title":"Ransomware roundtable | A threat in the pipeline","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"ransomware-roundtable-a-threat-in-the-pipeline","to_ping":"","pinged":"","post_modified":"2021-05-10 18:12:55","post_modified_gmt":"2021-05-10 17:12:55","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=6024","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4871,"post_author":"3","post_date":"2021-02-09 19:22:22","post_date_gmt":"2021-02-09 19:22:22","post_content":"Detectives assigned to the Digital Forensics Unit at Pinellas County Sheriff\u2019s Office are investigating an unlawful computer software intrusion at the City of Oldsmar\u2019s water treatment plant. While the cyber attack was unsuccessful, it does highlight the need for cybersecurity tools in critical infrastructure applications.\n\nOn Friday, February 5, 2021, the Pinellas County Sheriff\u2019s Office was notified by the City of Oldsmar that its computer system had been remotely accessed at 8:00am and 1:30pm by an unknown suspect. According to detectives, the City of Oldsmar\u2019s computer system at the water treatment plant allows for remote access by authorised users to troubleshoot any system problems from other locations.\n\nThe initial intrusion was brief and not cause for concern due to supervisors regularly accessing the system remotely to monitor the system. At 1:30, a plant operator witnessed a second remote access user opening various functions in the system that control the amount of sodium hydroxide in the water. The operator noted the remote access user raised the levels of sodium hydroxide in the water from 100 parts per million to 11,100 parts per million. The operator immediately reduced the levels to their appropriate amount. Sodium hydroxide is used in small amounts to control acidity, but a large amount could have caused major problems in the water.\n\nThe initial investigation revealed that the hacker remotely accessed the treatment plant\u2019s computer for approximately 3 to 5 minutes. Speaking at a press conference about the cyber attack, Sheriff Bob Gualtieri stated: \u201cAt no time was there a significant effect on the water being treated, and more importantly the public was never in danger.\u201d\n\nCommenting on the attack, Andrea Carcano, co-founder at Nozomi Networks stated: \u201cUnfortunately, this attack plays into a troubling trend we\u2019ve been following over the last year. As the pandemic forced critical infrastructure organisations to quickly shift to remote access options to keep systems up and running, we\u2019ve seen threats rise and bad actors reach new lows \u2013 setting their sights on life threatening targets. Fortunately, in this case, operators monitoring Oldsmar\u2019s treatment plant spotted the attack and were able to respond before anyone could be harmed. But it\u2019s a stark reminder that with limited cybersecurity resources and few regulations water utilities are vulnerable to attack. When it comes critical infrastructure, operational resilience must a top priority and advances in AI-powered OT security and network monitoring are available to give operators the network visibility they need to quickly spot trouble and respond before harm is done.\u201d\n\n\u201cThis targeted attack appears to have started by the \u2018bad actor\u2019 getting access to a vulnerable network\/system and working their way through the network trying to find the next weak access point while gathering data and understanding how the organisation operates along the way,\u201d added Niamh Muldoon, Global Data Protection Officer at OneLogin. \u201cIn this instance, understanding the information assets, applying not only MFA but enhanced multi-factor authentication, would have reduced the risk of this unauthorised attack materializing. It\u2019s a critical part of the MFA policy to enforce time limits for end-users and their trusted devices to re-authenticate, requiring them not only to validate themselves but also the identity of the device trying to access critical systems\/applications and the network. Without knowing more of the details, applying enhanced MFA to the execution of critical actions particularly for IT and systems administrators would have reduced the associated risk further. Having logging in place, and understanding logged events would support with the associated monitoring and alerting events. After the event has happened, crisis management is critical for successfully managing the attack response to reduce business impact and consequences, and it appears the Florida agency has done that.\u201d\n\n\u201cWhile this incident will rightfully cause concern, it appears that likelihood of real damage was minimal due to the fail safes in place,\u201d observes Tim Erlin, VP at Tripwire. \u201cThere are real impacts to be worried about, and actions to be taken, but this doesn\u2019t appear to be a sophisticated or novel attack. From a cybersecurity standpoint, we should be particularly concerned about how the attacker was able to authenticate into the remote access software. That entry point should be very well protected, given that it provides access to such obviously sensitive capabilities. Protecting remote access into industrial systems where these types of changes can be made should be a high priority for any industrial environment.\u201d\n\nLocal, State, and Federal investigators are working together to identify those responsible and the investigation is ongoing. Other utility providers have been informed of the intrusion, so they can take their own protective measures.","post_title":"Florida water system cyber attack highlights role of cybersecurity in critical infrastructure","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"florida-water-system-cyber-attack-highlights-role-of-cybersecurity-in-critical-infrastructure","to_ping":"","pinged":"","post_modified":"2021-02-09 19:22:25","post_modified_gmt":"2021-02-09 19:22:25","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4871","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4178,"post_author":"3","post_date":"2020-12-07 14:52:36","post_date_gmt":"2020-12-07 14:52:36","post_content":"Nozomi Networks and Chinook Systems have partnered to provide advanced cybersecurity solutions to protect industrial and critical infrastructure facilities across North America. Under the deal, Chinook will offer Nozomi Networks\u2019 complete portfolio of OT and IoT security solutions.\n\n\u201cFacilities that fully leverage their OT systems deliver tremendous returns when it comes to energy and operational savings, the safety and comfort of occupants and lower total cost of ownership,\u201d said Chinook\u2019s President, Wanda Lenkewich. \u201cAt the same time, the network connectivity that enables these systems, also introduces new and growing cyber threats. Partnering with Nozomi Networks allows Chinook to support clients with an integrated, comprehensive cybersecurity solution that ensures cyber threats are actively discovered, monitored and managed.\u201d\n\n\u201cWe are absolutely delighted to team with Chinook to help industrial and critical infrastructure facilities meet new requirements for secure connectivity across OT, IT and IoT networks,\u201d said Chet Namboodri, Vice President, Worldwide Business Development and Channel Sales at Nozomi. \u201cWe\u2019ve already worked together to deliver on a number of joint customer engagements in both the government and commercial sectors. Partnering with Chinook accelerates our joint efforts to make sure facility-related control and building management systems are safe from cyber threats.\u201d\n\nwww.nozominetworks.com<\/a>\n\nwww.chinooksystems.com<\/a>\n\n ","post_title":"Nozomi Networks and Chinook Systems partner for OT and IoT security solutions","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"nozomi-networks-and-chinook-systems-partner-for-ot-and-iot-security-solutions","to_ping":"","pinged":"","post_modified":"2020-12-07 14:52:40","post_modified_gmt":"2020-12-07 14:52:40","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4178","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4140,"post_author":"3","post_date":"2020-12-03 11:07:21","post_date_gmt":"2020-12-03 11:07:21","post_content":"Civil Nuclear Constabulary (CNC) police officers based at Harwell have launched Project Servator a collaborative community approach to policing. Project Servator aims to disrupt a range of criminal activity, including terrorism, while providing a reassuring presence for the public.\n\nCNC\u2019s officers are experienced and specially trained to spot the tell-tale signs that someone is planning or preparing to commit an illegal act. It works with other police forces, local businesses and the public to protect the Harwell site and the surrounding area and everyone who lives, works or visits there and to make it a difficult place for terrorists and other criminals to operate. Project Servator has been successful in gathering intelligence that has assisted Counter Terrorism Units across the UK in investigating and preventing acts of terror.\n\nProject Servator\u2019s patrols are highly visible and can happen at any time and in any location. Officers will talk to the public and local businesses to let them know what they\u2019re doing and remind them to be vigilant, trust their instincts and report any suspicious or unusual behaviour.\n\n\u201cWe are deploying these additional tactics to further complement the operational activity that exists in and around our Operational Policing Units,\u201d explained Supt Donna Jones, who is leading on the implementation of the project across the Constabulary. \u201cOur aim is to build upon relationships with partners as well as businesses and communities. These tactics are not new but allow us to have a focus on community engagement and encourage people to be our extra eyes and ears. This is not restricted to the Harwell site but also extends to the surrounding area. We are aware of the vast amount of information members of our community have and they are aware of what is out of the ordinary. All we ask is that they report any suspicions to us and we\u2019ll do the rest. The deployments will be unpredictable and our tactics will vary from one deployment to the next. The aim is to work with our local communities to deter any hostile threat.\u201d\n\nwww.gov.uk\/government\/organisations\/civil-nuclear-constabulary<\/a>","post_title":"CNC Harwell launches Project Servator","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"cnc-harwell-launches-project-servator","to_ping":"","pinged":"","post_modified":"2020-12-03 11:07:23","post_modified_gmt":"2020-12-03 11:07:23","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4140","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4102,"post_author":"3","post_date":"2020-11-30 17:30:23","post_date_gmt":"2020-11-30 17:30:23","post_content":"Radiflow and Mitsubishi Electric UK are collaborating to address the needs of IEC62443 cyber security standards in the Critical Infrastructure and Industrial Automation markets. The companys believe that the combination of the automation knowledge and tools of Mitsubishi Electric UK with the cyber security and IEC 62443 compliance skills of Radiflow will provide a holistic view of a client\u2019s risk posture.\n\nRadiflow will also provide Mitsubishi Electric UK customers with a consultancy service for cyber security, which includes the provision of OT security risk assessments, provision of Radiflow intrusion detection software and general advice on alignment with IEC 62443-3. In addition, the solution is intended to help customers to support asset owners in satisfying the requirements of the NIS Directive along with due diligence in alignment with CPNI (Centre for the Protection of National Infrastructure) best practice.\n\n\u201cOur new collaboration with Radiflow provides expertise in the field of OT cyber security which compliments and broadens the services that we offer our customers through the Mitsubishi Electric UK System Service Operation,\u201d said David Bean, Solutions Manager for Mitsubishi Electric UK. \u201cThere is a growing demand for solutions that address the requirements of cyber security in the OT space and we are looking forward to delivering those solutions and building our relationship further with the team at Radiflow.\u201d\n\n\u201cRadiflow sees huge value for OT organisations to have cyber security services and solutions aligned with their automation systems,\u201d added Ilan Barda, Founder and CEO of Radiflow. \u201cBy combining the automation knowledge and tools of Mitsubishi with the OT cyber security skills and tools of Radiflow, we are able to provide a holistic view of an organisation\u2019s OT risk posture.\u201d\n\nwww.radiflow.com<\/a>","post_title":"Radiflow and Mitsubishi Electric UK collaborate on cyber security standards","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"radiflow-and-mitsubishi-electric-uk-collaborate-on-cyber-security-standards","to_ping":"","pinged":"","post_modified":"2020-11-30 17:30:25","post_modified_gmt":"2020-11-30 17:30:25","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4102","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":3359,"post_author":"3","post_date":"2020-10-16 17:11:16","post_date_gmt":"2020-10-16 16:11:16","post_content":"Senstar explains how its products can be applied to protect the full range of upstream, midstream, and downstream facilities in the oil and gas industry.","post_title":"Senstar explains its security solutions for oil and gas","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"senstar-explains-its-security-solutions-for-oil-and-gas","to_ping":"","pinged":"","post_modified":"2020-10-16 17:11:17","post_modified_gmt":"2020-10-16 16:11:17","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=3359","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"}],"next":false,"prev":false,"total_page":1},"paged":1,"column_class":"jeg_col_2o3","class":"epic_block_14"};

\n

Remaining critical <\/strong><\/p>\n\n\n\n

\u201cThese \u2018Cyber Physical\u2019 attacks are a big deal, because they demonstrate just how fragile the provision of critical services are into society,\" says Andy Norton European Cyber Risk Officer at Armis. \"A few weeks ago a water treatment plant<\/a> was compromised leading to the potential for poisoning of the water. Now, 45% of the US oil energy provision has been switched off to the East coast. Prolonged shortages in critical services lead to civil unrest, economic pressures, and a general lack of confidence in public administration.\" <\/p>\n\n\n\n

Lior Div, CEO and Co-founder of Cybereason also comments: \"The SolarWinds<\/a> and Microsoft Exchange Server<\/a> attacks were unparalleled in their scope, successfully infiltrating and compromising virtually every US government agency and a wide array of medium and large private sector companies. The Colonial Pipeline attack reinforces the need to update legacy systems running today\u2019s critical infrastructure networks.<\/p>\n\n\n\n

\"If the public and private sectors can work together to solve complex cybersecurity issues, and at the same time accurately identify the threat actors and bring them to account for their actions, it will go a long way in reversing the adversary advantage and enable defenders to retake the high ground. There is also another significant opportunity here as well to cooperate on a global scale to develop extradition laws that enable cyber crimes and cyber espionage to be prosecuted more effectively.\u201d<\/p>\n\n\n\n

Mackey agrees, stating: \"Avoiding becoming a victim of ransomware requires organisations to have a comprehensive cybersecurity plan in place that fully captures the risks of each software component, its role and lifecycle, and its deployment configuration and usage assumptions. Armed with this basic information, and an exhaustive inventory, it becomes possible to determine how each component might play a role in an attempted ransomware attack. <\/p>\n\n\n\n

\"An effort like the one impacting Colonial Pipeline is likely the result of multiple weaknesses in process and cyber-defences that were ultimately successfully exploited. With the age of some industrial software systems far exceeding that of commercial software, it\u2019s likely that older software wasn\u2019t designed to limit exposure to modern threats like ransomware attacks. <\/p>\n\n\n\n

\"While the age of the software has limited impact on its serviceability, threat models and defensive protections need to keep pace with new threats \u2013 something that can only be done if all weaknesses present in each component are known and accounted for. After all, if a criminal can identify your weaknesses faster than you can, luck is rarely on your side.\u201d<\/p>\n\n\n\n

\"While this is indeed a financial disaster, and will have a significant impact on many, let us also consider that this means that, at least for a time, threat actors had control of those very same IT systems.\"<\/p>Martin Jartelius, CSO, Outpost24<\/cite><\/blockquote><\/figure>\n\n\n\n

Taking back control <\/strong><\/p>\n\n\n\n

US government officials are currently working with Colonial to help it recover while scrambling to avoid more severe fuel supply disruptions should the outage continue. Whether the pipeline stays shut that long in turn depends on how deeply the hackers penetrated Colonial\u2019s network - and how soon cybersecurity experts can pull them out.<\/p>\n\n\n\n

\"As so many times before when talking about ransomware \u2013 to lock a system with ransomware you need a good degree of control of that system,\" says Martin Jartelius, CSO at Outpost24. \"While this is indeed a financial disaster, and will have a significant impact on many, let us also consider that this means that, at least for a time, threat actors had control of those very same IT systems. Preventive security, as well as segmentation, are critical for those kinds of environments.\"<\/p>\n\n\n\n

\"One thing to note here is that ransomware has to announce itself to be successful,\" adds Tim Erlin, VP at Tripwire. \"In industrial environments, cyber events aren\u2019t always this visible. Increasing visibility into industrial networks becomes more important as attackers continue to target critical infrastructure.\u201d<\/p>\n\n\n\n

Brad Brooks, CEO and President of OneLogin, rightfully concludes: \"This attack represents just how quickly the stakes are escalating on Cybersecurity, with controlling and knowing who has access to your IT systems a board level priority for every company. We are moving from an invisible Cold War that was focused on stealing data to a highly visible hot war that has real implications for physical property and people\u2019s lives.\u201d<\/p>\n","post_title":"Ransomware roundtable | A threat in the pipeline","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"ransomware-roundtable-a-threat-in-the-pipeline","to_ping":"","pinged":"","post_modified":"2021-05-10 18:12:55","post_modified_gmt":"2021-05-10 17:12:55","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=6024","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4871,"post_author":"3","post_date":"2021-02-09 19:22:22","post_date_gmt":"2021-02-09 19:22:22","post_content":"Detectives assigned to the Digital Forensics Unit at Pinellas County Sheriff\u2019s Office are investigating an unlawful computer software intrusion at the City of Oldsmar\u2019s water treatment plant. While the cyber attack was unsuccessful, it does highlight the need for cybersecurity tools in critical infrastructure applications.\n\nOn Friday, February 5, 2021, the Pinellas County Sheriff\u2019s Office was notified by the City of Oldsmar that its computer system had been remotely accessed at 8:00am and 1:30pm by an unknown suspect. According to detectives, the City of Oldsmar\u2019s computer system at the water treatment plant allows for remote access by authorised users to troubleshoot any system problems from other locations.\n\nThe initial intrusion was brief and not cause for concern due to supervisors regularly accessing the system remotely to monitor the system. At 1:30, a plant operator witnessed a second remote access user opening various functions in the system that control the amount of sodium hydroxide in the water. The operator noted the remote access user raised the levels of sodium hydroxide in the water from 100 parts per million to 11,100 parts per million. The operator immediately reduced the levels to their appropriate amount. Sodium hydroxide is used in small amounts to control acidity, but a large amount could have caused major problems in the water.\n\nThe initial investigation revealed that the hacker remotely accessed the treatment plant\u2019s computer for approximately 3 to 5 minutes. Speaking at a press conference about the cyber attack, Sheriff Bob Gualtieri stated: \u201cAt no time was there a significant effect on the water being treated, and more importantly the public was never in danger.\u201d\n\nCommenting on the attack, Andrea Carcano, co-founder at Nozomi Networks stated: \u201cUnfortunately, this attack plays into a troubling trend we\u2019ve been following over the last year. As the pandemic forced critical infrastructure organisations to quickly shift to remote access options to keep systems up and running, we\u2019ve seen threats rise and bad actors reach new lows \u2013 setting their sights on life threatening targets. Fortunately, in this case, operators monitoring Oldsmar\u2019s treatment plant spotted the attack and were able to respond before anyone could be harmed. But it\u2019s a stark reminder that with limited cybersecurity resources and few regulations water utilities are vulnerable to attack. When it comes critical infrastructure, operational resilience must a top priority and advances in AI-powered OT security and network monitoring are available to give operators the network visibility they need to quickly spot trouble and respond before harm is done.\u201d\n\n\u201cThis targeted attack appears to have started by the \u2018bad actor\u2019 getting access to a vulnerable network\/system and working their way through the network trying to find the next weak access point while gathering data and understanding how the organisation operates along the way,\u201d added Niamh Muldoon, Global Data Protection Officer at OneLogin. \u201cIn this instance, understanding the information assets, applying not only MFA but enhanced multi-factor authentication, would have reduced the risk of this unauthorised attack materializing. It\u2019s a critical part of the MFA policy to enforce time limits for end-users and their trusted devices to re-authenticate, requiring them not only to validate themselves but also the identity of the device trying to access critical systems\/applications and the network. Without knowing more of the details, applying enhanced MFA to the execution of critical actions particularly for IT and systems administrators would have reduced the associated risk further. Having logging in place, and understanding logged events would support with the associated monitoring and alerting events. After the event has happened, crisis management is critical for successfully managing the attack response to reduce business impact and consequences, and it appears the Florida agency has done that.\u201d\n\n\u201cWhile this incident will rightfully cause concern, it appears that likelihood of real damage was minimal due to the fail safes in place,\u201d observes Tim Erlin, VP at Tripwire. \u201cThere are real impacts to be worried about, and actions to be taken, but this doesn\u2019t appear to be a sophisticated or novel attack. From a cybersecurity standpoint, we should be particularly concerned about how the attacker was able to authenticate into the remote access software. That entry point should be very well protected, given that it provides access to such obviously sensitive capabilities. Protecting remote access into industrial systems where these types of changes can be made should be a high priority for any industrial environment.\u201d\n\nLocal, State, and Federal investigators are working together to identify those responsible and the investigation is ongoing. Other utility providers have been informed of the intrusion, so they can take their own protective measures.","post_title":"Florida water system cyber attack highlights role of cybersecurity in critical infrastructure","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"florida-water-system-cyber-attack-highlights-role-of-cybersecurity-in-critical-infrastructure","to_ping":"","pinged":"","post_modified":"2021-02-09 19:22:25","post_modified_gmt":"2021-02-09 19:22:25","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4871","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4178,"post_author":"3","post_date":"2020-12-07 14:52:36","post_date_gmt":"2020-12-07 14:52:36","post_content":"Nozomi Networks and Chinook Systems have partnered to provide advanced cybersecurity solutions to protect industrial and critical infrastructure facilities across North America. Under the deal, Chinook will offer Nozomi Networks\u2019 complete portfolio of OT and IoT security solutions.\n\n\u201cFacilities that fully leverage their OT systems deliver tremendous returns when it comes to energy and operational savings, the safety and comfort of occupants and lower total cost of ownership,\u201d said Chinook\u2019s President, Wanda Lenkewich. \u201cAt the same time, the network connectivity that enables these systems, also introduces new and growing cyber threats. Partnering with Nozomi Networks allows Chinook to support clients with an integrated, comprehensive cybersecurity solution that ensures cyber threats are actively discovered, monitored and managed.\u201d\n\n\u201cWe are absolutely delighted to team with Chinook to help industrial and critical infrastructure facilities meet new requirements for secure connectivity across OT, IT and IoT networks,\u201d said Chet Namboodri, Vice President, Worldwide Business Development and Channel Sales at Nozomi. \u201cWe\u2019ve already worked together to deliver on a number of joint customer engagements in both the government and commercial sectors. Partnering with Chinook accelerates our joint efforts to make sure facility-related control and building management systems are safe from cyber threats.\u201d\n\nwww.nozominetworks.com<\/a>\n\nwww.chinooksystems.com<\/a>\n\n ","post_title":"Nozomi Networks and Chinook Systems partner for OT and IoT security solutions","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"nozomi-networks-and-chinook-systems-partner-for-ot-and-iot-security-solutions","to_ping":"","pinged":"","post_modified":"2020-12-07 14:52:40","post_modified_gmt":"2020-12-07 14:52:40","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4178","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4140,"post_author":"3","post_date":"2020-12-03 11:07:21","post_date_gmt":"2020-12-03 11:07:21","post_content":"Civil Nuclear Constabulary (CNC) police officers based at Harwell have launched Project Servator a collaborative community approach to policing. Project Servator aims to disrupt a range of criminal activity, including terrorism, while providing a reassuring presence for the public.\n\nCNC\u2019s officers are experienced and specially trained to spot the tell-tale signs that someone is planning or preparing to commit an illegal act. It works with other police forces, local businesses and the public to protect the Harwell site and the surrounding area and everyone who lives, works or visits there and to make it a difficult place for terrorists and other criminals to operate. Project Servator has been successful in gathering intelligence that has assisted Counter Terrorism Units across the UK in investigating and preventing acts of terror.\n\nProject Servator\u2019s patrols are highly visible and can happen at any time and in any location. Officers will talk to the public and local businesses to let them know what they\u2019re doing and remind them to be vigilant, trust their instincts and report any suspicious or unusual behaviour.\n\n\u201cWe are deploying these additional tactics to further complement the operational activity that exists in and around our Operational Policing Units,\u201d explained Supt Donna Jones, who is leading on the implementation of the project across the Constabulary. \u201cOur aim is to build upon relationships with partners as well as businesses and communities. These tactics are not new but allow us to have a focus on community engagement and encourage people to be our extra eyes and ears. This is not restricted to the Harwell site but also extends to the surrounding area. We are aware of the vast amount of information members of our community have and they are aware of what is out of the ordinary. All we ask is that they report any suspicions to us and we\u2019ll do the rest. The deployments will be unpredictable and our tactics will vary from one deployment to the next. The aim is to work with our local communities to deter any hostile threat.\u201d\n\nwww.gov.uk\/government\/organisations\/civil-nuclear-constabulary<\/a>","post_title":"CNC Harwell launches Project Servator","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"cnc-harwell-launches-project-servator","to_ping":"","pinged":"","post_modified":"2020-12-03 11:07:23","post_modified_gmt":"2020-12-03 11:07:23","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4140","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4102,"post_author":"3","post_date":"2020-11-30 17:30:23","post_date_gmt":"2020-11-30 17:30:23","post_content":"Radiflow and Mitsubishi Electric UK are collaborating to address the needs of IEC62443 cyber security standards in the Critical Infrastructure and Industrial Automation markets. The companys believe that the combination of the automation knowledge and tools of Mitsubishi Electric UK with the cyber security and IEC 62443 compliance skills of Radiflow will provide a holistic view of a client\u2019s risk posture.\n\nRadiflow will also provide Mitsubishi Electric UK customers with a consultancy service for cyber security, which includes the provision of OT security risk assessments, provision of Radiflow intrusion detection software and general advice on alignment with IEC 62443-3. In addition, the solution is intended to help customers to support asset owners in satisfying the requirements of the NIS Directive along with due diligence in alignment with CPNI (Centre for the Protection of National Infrastructure) best practice.\n\n\u201cOur new collaboration with Radiflow provides expertise in the field of OT cyber security which compliments and broadens the services that we offer our customers through the Mitsubishi Electric UK System Service Operation,\u201d said David Bean, Solutions Manager for Mitsubishi Electric UK. \u201cThere is a growing demand for solutions that address the requirements of cyber security in the OT space and we are looking forward to delivering those solutions and building our relationship further with the team at Radiflow.\u201d\n\n\u201cRadiflow sees huge value for OT organisations to have cyber security services and solutions aligned with their automation systems,\u201d added Ilan Barda, Founder and CEO of Radiflow. \u201cBy combining the automation knowledge and tools of Mitsubishi with the OT cyber security skills and tools of Radiflow, we are able to provide a holistic view of an organisation\u2019s OT risk posture.\u201d\n\nwww.radiflow.com<\/a>","post_title":"Radiflow and Mitsubishi Electric UK collaborate on cyber security standards","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"radiflow-and-mitsubishi-electric-uk-collaborate-on-cyber-security-standards","to_ping":"","pinged":"","post_modified":"2020-11-30 17:30:25","post_modified_gmt":"2020-11-30 17:30:25","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4102","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":3359,"post_author":"3","post_date":"2020-10-16 17:11:16","post_date_gmt":"2020-10-16 16:11:16","post_content":"Senstar explains how its products can be applied to protect the full range of upstream, midstream, and downstream facilities in the oil and gas industry.","post_title":"Senstar explains its security solutions for oil and gas","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"senstar-explains-its-security-solutions-for-oil-and-gas","to_ping":"","pinged":"","post_modified":"2020-10-16 17:11:17","post_modified_gmt":"2020-10-16 16:11:17","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=3359","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"}],"next":false,"prev":false,"total_page":1},"paged":1,"column_class":"jeg_col_2o3","class":"epic_block_14"};

\n

\"The Colonial Pipeline attack reinforces the need to update legacy systems running today\u2019s critical infrastructure networks...\"<\/p>Lior Div, CEO and Co-founder, Cybereason<\/cite><\/blockquote><\/figure>\n\n\n\n

Remaining critical <\/strong><\/p>\n\n\n\n

\u201cThese \u2018Cyber Physical\u2019 attacks are a big deal, because they demonstrate just how fragile the provision of critical services are into society,\" says Andy Norton European Cyber Risk Officer at Armis. \"A few weeks ago a water treatment plant<\/a> was compromised leading to the potential for poisoning of the water. Now, 45% of the US oil energy provision has been switched off to the East coast. Prolonged shortages in critical services lead to civil unrest, economic pressures, and a general lack of confidence in public administration.\" <\/p>\n\n\n\n

Lior Div, CEO and Co-founder of Cybereason also comments: \"The SolarWinds<\/a> and Microsoft Exchange Server<\/a> attacks were unparalleled in their scope, successfully infiltrating and compromising virtually every US government agency and a wide array of medium and large private sector companies. The Colonial Pipeline attack reinforces the need to update legacy systems running today\u2019s critical infrastructure networks.<\/p>\n\n\n\n

\"If the public and private sectors can work together to solve complex cybersecurity issues, and at the same time accurately identify the threat actors and bring them to account for their actions, it will go a long way in reversing the adversary advantage and enable defenders to retake the high ground. There is also another significant opportunity here as well to cooperate on a global scale to develop extradition laws that enable cyber crimes and cyber espionage to be prosecuted more effectively.\u201d<\/p>\n\n\n\n

Mackey agrees, stating: \"Avoiding becoming a victim of ransomware requires organisations to have a comprehensive cybersecurity plan in place that fully captures the risks of each software component, its role and lifecycle, and its deployment configuration and usage assumptions. Armed with this basic information, and an exhaustive inventory, it becomes possible to determine how each component might play a role in an attempted ransomware attack. <\/p>\n\n\n\n

\"An effort like the one impacting Colonial Pipeline is likely the result of multiple weaknesses in process and cyber-defences that were ultimately successfully exploited. With the age of some industrial software systems far exceeding that of commercial software, it\u2019s likely that older software wasn\u2019t designed to limit exposure to modern threats like ransomware attacks. <\/p>\n\n\n\n

\"While the age of the software has limited impact on its serviceability, threat models and defensive protections need to keep pace with new threats \u2013 something that can only be done if all weaknesses present in each component are known and accounted for. After all, if a criminal can identify your weaknesses faster than you can, luck is rarely on your side.\u201d<\/p>\n\n\n\n

\"While this is indeed a financial disaster, and will have a significant impact on many, let us also consider that this means that, at least for a time, threat actors had control of those very same IT systems.\"<\/p>Martin Jartelius, CSO, Outpost24<\/cite><\/blockquote><\/figure>\n\n\n\n

Taking back control <\/strong><\/p>\n\n\n\n

US government officials are currently working with Colonial to help it recover while scrambling to avoid more severe fuel supply disruptions should the outage continue. Whether the pipeline stays shut that long in turn depends on how deeply the hackers penetrated Colonial\u2019s network - and how soon cybersecurity experts can pull them out.<\/p>\n\n\n\n

\"As so many times before when talking about ransomware \u2013 to lock a system with ransomware you need a good degree of control of that system,\" says Martin Jartelius, CSO at Outpost24. \"While this is indeed a financial disaster, and will have a significant impact on many, let us also consider that this means that, at least for a time, threat actors had control of those very same IT systems. Preventive security, as well as segmentation, are critical for those kinds of environments.\"<\/p>\n\n\n\n

\"One thing to note here is that ransomware has to announce itself to be successful,\" adds Tim Erlin, VP at Tripwire. \"In industrial environments, cyber events aren\u2019t always this visible. Increasing visibility into industrial networks becomes more important as attackers continue to target critical infrastructure.\u201d<\/p>\n\n\n\n

Brad Brooks, CEO and President of OneLogin, rightfully concludes: \"This attack represents just how quickly the stakes are escalating on Cybersecurity, with controlling and knowing who has access to your IT systems a board level priority for every company. We are moving from an invisible Cold War that was focused on stealing data to a highly visible hot war that has real implications for physical property and people\u2019s lives.\u201d<\/p>\n","post_title":"Ransomware roundtable | A threat in the pipeline","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"ransomware-roundtable-a-threat-in-the-pipeline","to_ping":"","pinged":"","post_modified":"2021-05-10 18:12:55","post_modified_gmt":"2021-05-10 17:12:55","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=6024","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4871,"post_author":"3","post_date":"2021-02-09 19:22:22","post_date_gmt":"2021-02-09 19:22:22","post_content":"Detectives assigned to the Digital Forensics Unit at Pinellas County Sheriff\u2019s Office are investigating an unlawful computer software intrusion at the City of Oldsmar\u2019s water treatment plant. While the cyber attack was unsuccessful, it does highlight the need for cybersecurity tools in critical infrastructure applications.\n\nOn Friday, February 5, 2021, the Pinellas County Sheriff\u2019s Office was notified by the City of Oldsmar that its computer system had been remotely accessed at 8:00am and 1:30pm by an unknown suspect. According to detectives, the City of Oldsmar\u2019s computer system at the water treatment plant allows for remote access by authorised users to troubleshoot any system problems from other locations.\n\nThe initial intrusion was brief and not cause for concern due to supervisors regularly accessing the system remotely to monitor the system. At 1:30, a plant operator witnessed a second remote access user opening various functions in the system that control the amount of sodium hydroxide in the water. The operator noted the remote access user raised the levels of sodium hydroxide in the water from 100 parts per million to 11,100 parts per million. The operator immediately reduced the levels to their appropriate amount. Sodium hydroxide is used in small amounts to control acidity, but a large amount could have caused major problems in the water.\n\nThe initial investigation revealed that the hacker remotely accessed the treatment plant\u2019s computer for approximately 3 to 5 minutes. Speaking at a press conference about the cyber attack, Sheriff Bob Gualtieri stated: \u201cAt no time was there a significant effect on the water being treated, and more importantly the public was never in danger.\u201d\n\nCommenting on the attack, Andrea Carcano, co-founder at Nozomi Networks stated: \u201cUnfortunately, this attack plays into a troubling trend we\u2019ve been following over the last year. As the pandemic forced critical infrastructure organisations to quickly shift to remote access options to keep systems up and running, we\u2019ve seen threats rise and bad actors reach new lows \u2013 setting their sights on life threatening targets. Fortunately, in this case, operators monitoring Oldsmar\u2019s treatment plant spotted the attack and were able to respond before anyone could be harmed. But it\u2019s a stark reminder that with limited cybersecurity resources and few regulations water utilities are vulnerable to attack. When it comes critical infrastructure, operational resilience must a top priority and advances in AI-powered OT security and network monitoring are available to give operators the network visibility they need to quickly spot trouble and respond before harm is done.\u201d\n\n\u201cThis targeted attack appears to have started by the \u2018bad actor\u2019 getting access to a vulnerable network\/system and working their way through the network trying to find the next weak access point while gathering data and understanding how the organisation operates along the way,\u201d added Niamh Muldoon, Global Data Protection Officer at OneLogin. \u201cIn this instance, understanding the information assets, applying not only MFA but enhanced multi-factor authentication, would have reduced the risk of this unauthorised attack materializing. It\u2019s a critical part of the MFA policy to enforce time limits for end-users and their trusted devices to re-authenticate, requiring them not only to validate themselves but also the identity of the device trying to access critical systems\/applications and the network. Without knowing more of the details, applying enhanced MFA to the execution of critical actions particularly for IT and systems administrators would have reduced the associated risk further. Having logging in place, and understanding logged events would support with the associated monitoring and alerting events. After the event has happened, crisis management is critical for successfully managing the attack response to reduce business impact and consequences, and it appears the Florida agency has done that.\u201d\n\n\u201cWhile this incident will rightfully cause concern, it appears that likelihood of real damage was minimal due to the fail safes in place,\u201d observes Tim Erlin, VP at Tripwire. \u201cThere are real impacts to be worried about, and actions to be taken, but this doesn\u2019t appear to be a sophisticated or novel attack. From a cybersecurity standpoint, we should be particularly concerned about how the attacker was able to authenticate into the remote access software. That entry point should be very well protected, given that it provides access to such obviously sensitive capabilities. Protecting remote access into industrial systems where these types of changes can be made should be a high priority for any industrial environment.\u201d\n\nLocal, State, and Federal investigators are working together to identify those responsible and the investigation is ongoing. Other utility providers have been informed of the intrusion, so they can take their own protective measures.","post_title":"Florida water system cyber attack highlights role of cybersecurity in critical infrastructure","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"florida-water-system-cyber-attack-highlights-role-of-cybersecurity-in-critical-infrastructure","to_ping":"","pinged":"","post_modified":"2021-02-09 19:22:25","post_modified_gmt":"2021-02-09 19:22:25","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4871","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4178,"post_author":"3","post_date":"2020-12-07 14:52:36","post_date_gmt":"2020-12-07 14:52:36","post_content":"Nozomi Networks and Chinook Systems have partnered to provide advanced cybersecurity solutions to protect industrial and critical infrastructure facilities across North America. Under the deal, Chinook will offer Nozomi Networks\u2019 complete portfolio of OT and IoT security solutions.\n\n\u201cFacilities that fully leverage their OT systems deliver tremendous returns when it comes to energy and operational savings, the safety and comfort of occupants and lower total cost of ownership,\u201d said Chinook\u2019s President, Wanda Lenkewich. \u201cAt the same time, the network connectivity that enables these systems, also introduces new and growing cyber threats. Partnering with Nozomi Networks allows Chinook to support clients with an integrated, comprehensive cybersecurity solution that ensures cyber threats are actively discovered, monitored and managed.\u201d\n\n\u201cWe are absolutely delighted to team with Chinook to help industrial and critical infrastructure facilities meet new requirements for secure connectivity across OT, IT and IoT networks,\u201d said Chet Namboodri, Vice President, Worldwide Business Development and Channel Sales at Nozomi. \u201cWe\u2019ve already worked together to deliver on a number of joint customer engagements in both the government and commercial sectors. Partnering with Chinook accelerates our joint efforts to make sure facility-related control and building management systems are safe from cyber threats.\u201d\n\nwww.nozominetworks.com<\/a>\n\nwww.chinooksystems.com<\/a>\n\n ","post_title":"Nozomi Networks and Chinook Systems partner for OT and IoT security solutions","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"nozomi-networks-and-chinook-systems-partner-for-ot-and-iot-security-solutions","to_ping":"","pinged":"","post_modified":"2020-12-07 14:52:40","post_modified_gmt":"2020-12-07 14:52:40","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4178","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4140,"post_author":"3","post_date":"2020-12-03 11:07:21","post_date_gmt":"2020-12-03 11:07:21","post_content":"Civil Nuclear Constabulary (CNC) police officers based at Harwell have launched Project Servator a collaborative community approach to policing. Project Servator aims to disrupt a range of criminal activity, including terrorism, while providing a reassuring presence for the public.\n\nCNC\u2019s officers are experienced and specially trained to spot the tell-tale signs that someone is planning or preparing to commit an illegal act. It works with other police forces, local businesses and the public to protect the Harwell site and the surrounding area and everyone who lives, works or visits there and to make it a difficult place for terrorists and other criminals to operate. Project Servator has been successful in gathering intelligence that has assisted Counter Terrorism Units across the UK in investigating and preventing acts of terror.\n\nProject Servator\u2019s patrols are highly visible and can happen at any time and in any location. Officers will talk to the public and local businesses to let them know what they\u2019re doing and remind them to be vigilant, trust their instincts and report any suspicious or unusual behaviour.\n\n\u201cWe are deploying these additional tactics to further complement the operational activity that exists in and around our Operational Policing Units,\u201d explained Supt Donna Jones, who is leading on the implementation of the project across the Constabulary. \u201cOur aim is to build upon relationships with partners as well as businesses and communities. These tactics are not new but allow us to have a focus on community engagement and encourage people to be our extra eyes and ears. This is not restricted to the Harwell site but also extends to the surrounding area. We are aware of the vast amount of information members of our community have and they are aware of what is out of the ordinary. All we ask is that they report any suspicions to us and we\u2019ll do the rest. The deployments will be unpredictable and our tactics will vary from one deployment to the next. The aim is to work with our local communities to deter any hostile threat.\u201d\n\nwww.gov.uk\/government\/organisations\/civil-nuclear-constabulary<\/a>","post_title":"CNC Harwell launches Project Servator","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"cnc-harwell-launches-project-servator","to_ping":"","pinged":"","post_modified":"2020-12-03 11:07:23","post_modified_gmt":"2020-12-03 11:07:23","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4140","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4102,"post_author":"3","post_date":"2020-11-30 17:30:23","post_date_gmt":"2020-11-30 17:30:23","post_content":"Radiflow and Mitsubishi Electric UK are collaborating to address the needs of IEC62443 cyber security standards in the Critical Infrastructure and Industrial Automation markets. The companys believe that the combination of the automation knowledge and tools of Mitsubishi Electric UK with the cyber security and IEC 62443 compliance skills of Radiflow will provide a holistic view of a client\u2019s risk posture.\n\nRadiflow will also provide Mitsubishi Electric UK customers with a consultancy service for cyber security, which includes the provision of OT security risk assessments, provision of Radiflow intrusion detection software and general advice on alignment with IEC 62443-3. In addition, the solution is intended to help customers to support asset owners in satisfying the requirements of the NIS Directive along with due diligence in alignment with CPNI (Centre for the Protection of National Infrastructure) best practice.\n\n\u201cOur new collaboration with Radiflow provides expertise in the field of OT cyber security which compliments and broadens the services that we offer our customers through the Mitsubishi Electric UK System Service Operation,\u201d said David Bean, Solutions Manager for Mitsubishi Electric UK. \u201cThere is a growing demand for solutions that address the requirements of cyber security in the OT space and we are looking forward to delivering those solutions and building our relationship further with the team at Radiflow.\u201d\n\n\u201cRadiflow sees huge value for OT organisations to have cyber security services and solutions aligned with their automation systems,\u201d added Ilan Barda, Founder and CEO of Radiflow. \u201cBy combining the automation knowledge and tools of Mitsubishi with the OT cyber security skills and tools of Radiflow, we are able to provide a holistic view of an organisation\u2019s OT risk posture.\u201d\n\nwww.radiflow.com<\/a>","post_title":"Radiflow and Mitsubishi Electric UK collaborate on cyber security standards","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"radiflow-and-mitsubishi-electric-uk-collaborate-on-cyber-security-standards","to_ping":"","pinged":"","post_modified":"2020-11-30 17:30:25","post_modified_gmt":"2020-11-30 17:30:25","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4102","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":3359,"post_author":"3","post_date":"2020-10-16 17:11:16","post_date_gmt":"2020-10-16 16:11:16","post_content":"Senstar explains how its products can be applied to protect the full range of upstream, midstream, and downstream facilities in the oil and gas industry.","post_title":"Senstar explains its security solutions for oil and gas","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"senstar-explains-its-security-solutions-for-oil-and-gas","to_ping":"","pinged":"","post_modified":"2020-10-16 17:11:17","post_modified_gmt":"2020-10-16 16:11:17","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=3359","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"}],"next":false,"prev":false,"total_page":1},"paged":1,"column_class":"jeg_col_2o3","class":"epic_block_14"};

\n

\"While Colonial Pipeline is a US operation, attacks are global in scope. And despite warnings from officials like the US Treasury Department highlighting how ransomware payments are used to fund future criminal activities, victims are often faced with the difficult decision of whether to pay the ransom.\"<\/p>\n\n\n\n

\"The Colonial Pipeline attack reinforces the need to update legacy systems running today\u2019s critical infrastructure networks...\"<\/p>Lior Div, CEO and Co-founder, Cybereason<\/cite><\/blockquote><\/figure>\n\n\n\n

Remaining critical <\/strong><\/p>\n\n\n\n

\u201cThese \u2018Cyber Physical\u2019 attacks are a big deal, because they demonstrate just how fragile the provision of critical services are into society,\" says Andy Norton European Cyber Risk Officer at Armis. \"A few weeks ago a water treatment plant<\/a> was compromised leading to the potential for poisoning of the water. Now, 45% of the US oil energy provision has been switched off to the East coast. Prolonged shortages in critical services lead to civil unrest, economic pressures, and a general lack of confidence in public administration.\" <\/p>\n\n\n\n

Lior Div, CEO and Co-founder of Cybereason also comments: \"The SolarWinds<\/a> and Microsoft Exchange Server<\/a> attacks were unparalleled in their scope, successfully infiltrating and compromising virtually every US government agency and a wide array of medium and large private sector companies. The Colonial Pipeline attack reinforces the need to update legacy systems running today\u2019s critical infrastructure networks.<\/p>\n\n\n\n

\"If the public and private sectors can work together to solve complex cybersecurity issues, and at the same time accurately identify the threat actors and bring them to account for their actions, it will go a long way in reversing the adversary advantage and enable defenders to retake the high ground. There is also another significant opportunity here as well to cooperate on a global scale to develop extradition laws that enable cyber crimes and cyber espionage to be prosecuted more effectively.\u201d<\/p>\n\n\n\n

Mackey agrees, stating: \"Avoiding becoming a victim of ransomware requires organisations to have a comprehensive cybersecurity plan in place that fully captures the risks of each software component, its role and lifecycle, and its deployment configuration and usage assumptions. Armed with this basic information, and an exhaustive inventory, it becomes possible to determine how each component might play a role in an attempted ransomware attack. <\/p>\n\n\n\n

\"An effort like the one impacting Colonial Pipeline is likely the result of multiple weaknesses in process and cyber-defences that were ultimately successfully exploited. With the age of some industrial software systems far exceeding that of commercial software, it\u2019s likely that older software wasn\u2019t designed to limit exposure to modern threats like ransomware attacks. <\/p>\n\n\n\n

\"While the age of the software has limited impact on its serviceability, threat models and defensive protections need to keep pace with new threats \u2013 something that can only be done if all weaknesses present in each component are known and accounted for. After all, if a criminal can identify your weaknesses faster than you can, luck is rarely on your side.\u201d<\/p>\n\n\n\n

\"While this is indeed a financial disaster, and will have a significant impact on many, let us also consider that this means that, at least for a time, threat actors had control of those very same IT systems.\"<\/p>Martin Jartelius, CSO, Outpost24<\/cite><\/blockquote><\/figure>\n\n\n\n

Taking back control <\/strong><\/p>\n\n\n\n

US government officials are currently working with Colonial to help it recover while scrambling to avoid more severe fuel supply disruptions should the outage continue. Whether the pipeline stays shut that long in turn depends on how deeply the hackers penetrated Colonial\u2019s network - and how soon cybersecurity experts can pull them out.<\/p>\n\n\n\n

\"As so many times before when talking about ransomware \u2013 to lock a system with ransomware you need a good degree of control of that system,\" says Martin Jartelius, CSO at Outpost24. \"While this is indeed a financial disaster, and will have a significant impact on many, let us also consider that this means that, at least for a time, threat actors had control of those very same IT systems. Preventive security, as well as segmentation, are critical for those kinds of environments.\"<\/p>\n\n\n\n

\"One thing to note here is that ransomware has to announce itself to be successful,\" adds Tim Erlin, VP at Tripwire. \"In industrial environments, cyber events aren\u2019t always this visible. Increasing visibility into industrial networks becomes more important as attackers continue to target critical infrastructure.\u201d<\/p>\n\n\n\n

Brad Brooks, CEO and President of OneLogin, rightfully concludes: \"This attack represents just how quickly the stakes are escalating on Cybersecurity, with controlling and knowing who has access to your IT systems a board level priority for every company. We are moving from an invisible Cold War that was focused on stealing data to a highly visible hot war that has real implications for physical property and people\u2019s lives.\u201d<\/p>\n","post_title":"Ransomware roundtable | A threat in the pipeline","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"ransomware-roundtable-a-threat-in-the-pipeline","to_ping":"","pinged":"","post_modified":"2021-05-10 18:12:55","post_modified_gmt":"2021-05-10 17:12:55","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=6024","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4871,"post_author":"3","post_date":"2021-02-09 19:22:22","post_date_gmt":"2021-02-09 19:22:22","post_content":"Detectives assigned to the Digital Forensics Unit at Pinellas County Sheriff\u2019s Office are investigating an unlawful computer software intrusion at the City of Oldsmar\u2019s water treatment plant. While the cyber attack was unsuccessful, it does highlight the need for cybersecurity tools in critical infrastructure applications.\n\nOn Friday, February 5, 2021, the Pinellas County Sheriff\u2019s Office was notified by the City of Oldsmar that its computer system had been remotely accessed at 8:00am and 1:30pm by an unknown suspect. According to detectives, the City of Oldsmar\u2019s computer system at the water treatment plant allows for remote access by authorised users to troubleshoot any system problems from other locations.\n\nThe initial intrusion was brief and not cause for concern due to supervisors regularly accessing the system remotely to monitor the system. At 1:30, a plant operator witnessed a second remote access user opening various functions in the system that control the amount of sodium hydroxide in the water. The operator noted the remote access user raised the levels of sodium hydroxide in the water from 100 parts per million to 11,100 parts per million. The operator immediately reduced the levels to their appropriate amount. Sodium hydroxide is used in small amounts to control acidity, but a large amount could have caused major problems in the water.\n\nThe initial investigation revealed that the hacker remotely accessed the treatment plant\u2019s computer for approximately 3 to 5 minutes. Speaking at a press conference about the cyber attack, Sheriff Bob Gualtieri stated: \u201cAt no time was there a significant effect on the water being treated, and more importantly the public was never in danger.\u201d\n\nCommenting on the attack, Andrea Carcano, co-founder at Nozomi Networks stated: \u201cUnfortunately, this attack plays into a troubling trend we\u2019ve been following over the last year. As the pandemic forced critical infrastructure organisations to quickly shift to remote access options to keep systems up and running, we\u2019ve seen threats rise and bad actors reach new lows \u2013 setting their sights on life threatening targets. Fortunately, in this case, operators monitoring Oldsmar\u2019s treatment plant spotted the attack and were able to respond before anyone could be harmed. But it\u2019s a stark reminder that with limited cybersecurity resources and few regulations water utilities are vulnerable to attack. When it comes critical infrastructure, operational resilience must a top priority and advances in AI-powered OT security and network monitoring are available to give operators the network visibility they need to quickly spot trouble and respond before harm is done.\u201d\n\n\u201cThis targeted attack appears to have started by the \u2018bad actor\u2019 getting access to a vulnerable network\/system and working their way through the network trying to find the next weak access point while gathering data and understanding how the organisation operates along the way,\u201d added Niamh Muldoon, Global Data Protection Officer at OneLogin. \u201cIn this instance, understanding the information assets, applying not only MFA but enhanced multi-factor authentication, would have reduced the risk of this unauthorised attack materializing. It\u2019s a critical part of the MFA policy to enforce time limits for end-users and their trusted devices to re-authenticate, requiring them not only to validate themselves but also the identity of the device trying to access critical systems\/applications and the network. Without knowing more of the details, applying enhanced MFA to the execution of critical actions particularly for IT and systems administrators would have reduced the associated risk further. Having logging in place, and understanding logged events would support with the associated monitoring and alerting events. After the event has happened, crisis management is critical for successfully managing the attack response to reduce business impact and consequences, and it appears the Florida agency has done that.\u201d\n\n\u201cWhile this incident will rightfully cause concern, it appears that likelihood of real damage was minimal due to the fail safes in place,\u201d observes Tim Erlin, VP at Tripwire. \u201cThere are real impacts to be worried about, and actions to be taken, but this doesn\u2019t appear to be a sophisticated or novel attack. From a cybersecurity standpoint, we should be particularly concerned about how the attacker was able to authenticate into the remote access software. That entry point should be very well protected, given that it provides access to such obviously sensitive capabilities. Protecting remote access into industrial systems where these types of changes can be made should be a high priority for any industrial environment.\u201d\n\nLocal, State, and Federal investigators are working together to identify those responsible and the investigation is ongoing. Other utility providers have been informed of the intrusion, so they can take their own protective measures.","post_title":"Florida water system cyber attack highlights role of cybersecurity in critical infrastructure","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"florida-water-system-cyber-attack-highlights-role-of-cybersecurity-in-critical-infrastructure","to_ping":"","pinged":"","post_modified":"2021-02-09 19:22:25","post_modified_gmt":"2021-02-09 19:22:25","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4871","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4178,"post_author":"3","post_date":"2020-12-07 14:52:36","post_date_gmt":"2020-12-07 14:52:36","post_content":"Nozomi Networks and Chinook Systems have partnered to provide advanced cybersecurity solutions to protect industrial and critical infrastructure facilities across North America. Under the deal, Chinook will offer Nozomi Networks\u2019 complete portfolio of OT and IoT security solutions.\n\n\u201cFacilities that fully leverage their OT systems deliver tremendous returns when it comes to energy and operational savings, the safety and comfort of occupants and lower total cost of ownership,\u201d said Chinook\u2019s President, Wanda Lenkewich. \u201cAt the same time, the network connectivity that enables these systems, also introduces new and growing cyber threats. Partnering with Nozomi Networks allows Chinook to support clients with an integrated, comprehensive cybersecurity solution that ensures cyber threats are actively discovered, monitored and managed.\u201d\n\n\u201cWe are absolutely delighted to team with Chinook to help industrial and critical infrastructure facilities meet new requirements for secure connectivity across OT, IT and IoT networks,\u201d said Chet Namboodri, Vice President, Worldwide Business Development and Channel Sales at Nozomi. \u201cWe\u2019ve already worked together to deliver on a number of joint customer engagements in both the government and commercial sectors. Partnering with Chinook accelerates our joint efforts to make sure facility-related control and building management systems are safe from cyber threats.\u201d\n\nwww.nozominetworks.com<\/a>\n\nwww.chinooksystems.com<\/a>\n\n ","post_title":"Nozomi Networks and Chinook Systems partner for OT and IoT security solutions","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"nozomi-networks-and-chinook-systems-partner-for-ot-and-iot-security-solutions","to_ping":"","pinged":"","post_modified":"2020-12-07 14:52:40","post_modified_gmt":"2020-12-07 14:52:40","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4178","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4140,"post_author":"3","post_date":"2020-12-03 11:07:21","post_date_gmt":"2020-12-03 11:07:21","post_content":"Civil Nuclear Constabulary (CNC) police officers based at Harwell have launched Project Servator a collaborative community approach to policing. Project Servator aims to disrupt a range of criminal activity, including terrorism, while providing a reassuring presence for the public.\n\nCNC\u2019s officers are experienced and specially trained to spot the tell-tale signs that someone is planning or preparing to commit an illegal act. It works with other police forces, local businesses and the public to protect the Harwell site and the surrounding area and everyone who lives, works or visits there and to make it a difficult place for terrorists and other criminals to operate. Project Servator has been successful in gathering intelligence that has assisted Counter Terrorism Units across the UK in investigating and preventing acts of terror.\n\nProject Servator\u2019s patrols are highly visible and can happen at any time and in any location. Officers will talk to the public and local businesses to let them know what they\u2019re doing and remind them to be vigilant, trust their instincts and report any suspicious or unusual behaviour.\n\n\u201cWe are deploying these additional tactics to further complement the operational activity that exists in and around our Operational Policing Units,\u201d explained Supt Donna Jones, who is leading on the implementation of the project across the Constabulary. \u201cOur aim is to build upon relationships with partners as well as businesses and communities. These tactics are not new but allow us to have a focus on community engagement and encourage people to be our extra eyes and ears. This is not restricted to the Harwell site but also extends to the surrounding area. We are aware of the vast amount of information members of our community have and they are aware of what is out of the ordinary. All we ask is that they report any suspicions to us and we\u2019ll do the rest. The deployments will be unpredictable and our tactics will vary from one deployment to the next. The aim is to work with our local communities to deter any hostile threat.\u201d\n\nwww.gov.uk\/government\/organisations\/civil-nuclear-constabulary<\/a>","post_title":"CNC Harwell launches Project Servator","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"cnc-harwell-launches-project-servator","to_ping":"","pinged":"","post_modified":"2020-12-03 11:07:23","post_modified_gmt":"2020-12-03 11:07:23","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4140","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4102,"post_author":"3","post_date":"2020-11-30 17:30:23","post_date_gmt":"2020-11-30 17:30:23","post_content":"Radiflow and Mitsubishi Electric UK are collaborating to address the needs of IEC62443 cyber security standards in the Critical Infrastructure and Industrial Automation markets. The companys believe that the combination of the automation knowledge and tools of Mitsubishi Electric UK with the cyber security and IEC 62443 compliance skills of Radiflow will provide a holistic view of a client\u2019s risk posture.\n\nRadiflow will also provide Mitsubishi Electric UK customers with a consultancy service for cyber security, which includes the provision of OT security risk assessments, provision of Radiflow intrusion detection software and general advice on alignment with IEC 62443-3. In addition, the solution is intended to help customers to support asset owners in satisfying the requirements of the NIS Directive along with due diligence in alignment with CPNI (Centre for the Protection of National Infrastructure) best practice.\n\n\u201cOur new collaboration with Radiflow provides expertise in the field of OT cyber security which compliments and broadens the services that we offer our customers through the Mitsubishi Electric UK System Service Operation,\u201d said David Bean, Solutions Manager for Mitsubishi Electric UK. \u201cThere is a growing demand for solutions that address the requirements of cyber security in the OT space and we are looking forward to delivering those solutions and building our relationship further with the team at Radiflow.\u201d\n\n\u201cRadiflow sees huge value for OT organisations to have cyber security services and solutions aligned with their automation systems,\u201d added Ilan Barda, Founder and CEO of Radiflow. \u201cBy combining the automation knowledge and tools of Mitsubishi with the OT cyber security skills and tools of Radiflow, we are able to provide a holistic view of an organisation\u2019s OT risk posture.\u201d\n\nwww.radiflow.com<\/a>","post_title":"Radiflow and Mitsubishi Electric UK collaborate on cyber security standards","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"radiflow-and-mitsubishi-electric-uk-collaborate-on-cyber-security-standards","to_ping":"","pinged":"","post_modified":"2020-11-30 17:30:25","post_modified_gmt":"2020-11-30 17:30:25","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4102","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":3359,"post_author":"3","post_date":"2020-10-16 17:11:16","post_date_gmt":"2020-10-16 16:11:16","post_content":"Senstar explains how its products can be applied to protect the full range of upstream, midstream, and downstream facilities in the oil and gas industry.","post_title":"Senstar explains its security solutions for oil and gas","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"senstar-explains-its-security-solutions-for-oil-and-gas","to_ping":"","pinged":"","post_modified":"2020-10-16 17:11:17","post_modified_gmt":"2020-10-16 16:11:17","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=3359","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"}],"next":false,"prev":false,"total_page":1},"paged":1,"column_class":"jeg_col_2o3","class":"epic_block_14"};

\n

\"Cybercriminals don\u2019t really care how important your business is, only how much money they might extract from you,\" comments Tim Mackey Principal Security Strategist at the Synopsys CyRC (Cybersecurity Research Centre). \"This trend can be seen with increasing attacks on municipalities, healthcare systems, and elements of critical infrastructure. Each of these organisations will bring in law enforcement, yet attackers continue to be aggressive in their activities. <\/p>\n\n\n\n

\"While Colonial Pipeline is a US operation, attacks are global in scope. And despite warnings from officials like the US Treasury Department highlighting how ransomware payments are used to fund future criminal activities, victims are often faced with the difficult decision of whether to pay the ransom.\"<\/p>\n\n\n\n

\"The Colonial Pipeline attack reinforces the need to update legacy systems running today\u2019s critical infrastructure networks...\"<\/p>Lior Div, CEO and Co-founder, Cybereason<\/cite><\/blockquote><\/figure>\n\n\n\n

Remaining critical <\/strong><\/p>\n\n\n\n

\u201cThese \u2018Cyber Physical\u2019 attacks are a big deal, because they demonstrate just how fragile the provision of critical services are into society,\" says Andy Norton European Cyber Risk Officer at Armis. \"A few weeks ago a water treatment plant<\/a> was compromised leading to the potential for poisoning of the water. Now, 45% of the US oil energy provision has been switched off to the East coast. Prolonged shortages in critical services lead to civil unrest, economic pressures, and a general lack of confidence in public administration.\" <\/p>\n\n\n\n

Lior Div, CEO and Co-founder of Cybereason also comments: \"The SolarWinds<\/a> and Microsoft Exchange Server<\/a> attacks were unparalleled in their scope, successfully infiltrating and compromising virtually every US government agency and a wide array of medium and large private sector companies. The Colonial Pipeline attack reinforces the need to update legacy systems running today\u2019s critical infrastructure networks.<\/p>\n\n\n\n

\"If the public and private sectors can work together to solve complex cybersecurity issues, and at the same time accurately identify the threat actors and bring them to account for their actions, it will go a long way in reversing the adversary advantage and enable defenders to retake the high ground. There is also another significant opportunity here as well to cooperate on a global scale to develop extradition laws that enable cyber crimes and cyber espionage to be prosecuted more effectively.\u201d<\/p>\n\n\n\n

Mackey agrees, stating: \"Avoiding becoming a victim of ransomware requires organisations to have a comprehensive cybersecurity plan in place that fully captures the risks of each software component, its role and lifecycle, and its deployment configuration and usage assumptions. Armed with this basic information, and an exhaustive inventory, it becomes possible to determine how each component might play a role in an attempted ransomware attack. <\/p>\n\n\n\n

\"An effort like the one impacting Colonial Pipeline is likely the result of multiple weaknesses in process and cyber-defences that were ultimately successfully exploited. With the age of some industrial software systems far exceeding that of commercial software, it\u2019s likely that older software wasn\u2019t designed to limit exposure to modern threats like ransomware attacks. <\/p>\n\n\n\n

\"While the age of the software has limited impact on its serviceability, threat models and defensive protections need to keep pace with new threats \u2013 something that can only be done if all weaknesses present in each component are known and accounted for. After all, if a criminal can identify your weaknesses faster than you can, luck is rarely on your side.\u201d<\/p>\n\n\n\n

\"While this is indeed a financial disaster, and will have a significant impact on many, let us also consider that this means that, at least for a time, threat actors had control of those very same IT systems.\"<\/p>Martin Jartelius, CSO, Outpost24<\/cite><\/blockquote><\/figure>\n\n\n\n

Taking back control <\/strong><\/p>\n\n\n\n

US government officials are currently working with Colonial to help it recover while scrambling to avoid more severe fuel supply disruptions should the outage continue. Whether the pipeline stays shut that long in turn depends on how deeply the hackers penetrated Colonial\u2019s network - and how soon cybersecurity experts can pull them out.<\/p>\n\n\n\n

\"As so many times before when talking about ransomware \u2013 to lock a system with ransomware you need a good degree of control of that system,\" says Martin Jartelius, CSO at Outpost24. \"While this is indeed a financial disaster, and will have a significant impact on many, let us also consider that this means that, at least for a time, threat actors had control of those very same IT systems. Preventive security, as well as segmentation, are critical for those kinds of environments.\"<\/p>\n\n\n\n

\"One thing to note here is that ransomware has to announce itself to be successful,\" adds Tim Erlin, VP at Tripwire. \"In industrial environments, cyber events aren\u2019t always this visible. Increasing visibility into industrial networks becomes more important as attackers continue to target critical infrastructure.\u201d<\/p>\n\n\n\n

Brad Brooks, CEO and President of OneLogin, rightfully concludes: \"This attack represents just how quickly the stakes are escalating on Cybersecurity, with controlling and knowing who has access to your IT systems a board level priority for every company. We are moving from an invisible Cold War that was focused on stealing data to a highly visible hot war that has real implications for physical property and people\u2019s lives.\u201d<\/p>\n","post_title":"Ransomware roundtable | A threat in the pipeline","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"ransomware-roundtable-a-threat-in-the-pipeline","to_ping":"","pinged":"","post_modified":"2021-05-10 18:12:55","post_modified_gmt":"2021-05-10 17:12:55","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=6024","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4871,"post_author":"3","post_date":"2021-02-09 19:22:22","post_date_gmt":"2021-02-09 19:22:22","post_content":"Detectives assigned to the Digital Forensics Unit at Pinellas County Sheriff\u2019s Office are investigating an unlawful computer software intrusion at the City of Oldsmar\u2019s water treatment plant. While the cyber attack was unsuccessful, it does highlight the need for cybersecurity tools in critical infrastructure applications.\n\nOn Friday, February 5, 2021, the Pinellas County Sheriff\u2019s Office was notified by the City of Oldsmar that its computer system had been remotely accessed at 8:00am and 1:30pm by an unknown suspect. According to detectives, the City of Oldsmar\u2019s computer system at the water treatment plant allows for remote access by authorised users to troubleshoot any system problems from other locations.\n\nThe initial intrusion was brief and not cause for concern due to supervisors regularly accessing the system remotely to monitor the system. At 1:30, a plant operator witnessed a second remote access user opening various functions in the system that control the amount of sodium hydroxide in the water. The operator noted the remote access user raised the levels of sodium hydroxide in the water from 100 parts per million to 11,100 parts per million. The operator immediately reduced the levels to their appropriate amount. Sodium hydroxide is used in small amounts to control acidity, but a large amount could have caused major problems in the water.\n\nThe initial investigation revealed that the hacker remotely accessed the treatment plant\u2019s computer for approximately 3 to 5 minutes. Speaking at a press conference about the cyber attack, Sheriff Bob Gualtieri stated: \u201cAt no time was there a significant effect on the water being treated, and more importantly the public was never in danger.\u201d\n\nCommenting on the attack, Andrea Carcano, co-founder at Nozomi Networks stated: \u201cUnfortunately, this attack plays into a troubling trend we\u2019ve been following over the last year. As the pandemic forced critical infrastructure organisations to quickly shift to remote access options to keep systems up and running, we\u2019ve seen threats rise and bad actors reach new lows \u2013 setting their sights on life threatening targets. Fortunately, in this case, operators monitoring Oldsmar\u2019s treatment plant spotted the attack and were able to respond before anyone could be harmed. But it\u2019s a stark reminder that with limited cybersecurity resources and few regulations water utilities are vulnerable to attack. When it comes critical infrastructure, operational resilience must a top priority and advances in AI-powered OT security and network monitoring are available to give operators the network visibility they need to quickly spot trouble and respond before harm is done.\u201d\n\n\u201cThis targeted attack appears to have started by the \u2018bad actor\u2019 getting access to a vulnerable network\/system and working their way through the network trying to find the next weak access point while gathering data and understanding how the organisation operates along the way,\u201d added Niamh Muldoon, Global Data Protection Officer at OneLogin. \u201cIn this instance, understanding the information assets, applying not only MFA but enhanced multi-factor authentication, would have reduced the risk of this unauthorised attack materializing. It\u2019s a critical part of the MFA policy to enforce time limits for end-users and their trusted devices to re-authenticate, requiring them not only to validate themselves but also the identity of the device trying to access critical systems\/applications and the network. Without knowing more of the details, applying enhanced MFA to the execution of critical actions particularly for IT and systems administrators would have reduced the associated risk further. Having logging in place, and understanding logged events would support with the associated monitoring and alerting events. After the event has happened, crisis management is critical for successfully managing the attack response to reduce business impact and consequences, and it appears the Florida agency has done that.\u201d\n\n\u201cWhile this incident will rightfully cause concern, it appears that likelihood of real damage was minimal due to the fail safes in place,\u201d observes Tim Erlin, VP at Tripwire. \u201cThere are real impacts to be worried about, and actions to be taken, but this doesn\u2019t appear to be a sophisticated or novel attack. From a cybersecurity standpoint, we should be particularly concerned about how the attacker was able to authenticate into the remote access software. That entry point should be very well protected, given that it provides access to such obviously sensitive capabilities. Protecting remote access into industrial systems where these types of changes can be made should be a high priority for any industrial environment.\u201d\n\nLocal, State, and Federal investigators are working together to identify those responsible and the investigation is ongoing. Other utility providers have been informed of the intrusion, so they can take their own protective measures.","post_title":"Florida water system cyber attack highlights role of cybersecurity in critical infrastructure","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"florida-water-system-cyber-attack-highlights-role-of-cybersecurity-in-critical-infrastructure","to_ping":"","pinged":"","post_modified":"2021-02-09 19:22:25","post_modified_gmt":"2021-02-09 19:22:25","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4871","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4178,"post_author":"3","post_date":"2020-12-07 14:52:36","post_date_gmt":"2020-12-07 14:52:36","post_content":"Nozomi Networks and Chinook Systems have partnered to provide advanced cybersecurity solutions to protect industrial and critical infrastructure facilities across North America. Under the deal, Chinook will offer Nozomi Networks\u2019 complete portfolio of OT and IoT security solutions.\n\n\u201cFacilities that fully leverage their OT systems deliver tremendous returns when it comes to energy and operational savings, the safety and comfort of occupants and lower total cost of ownership,\u201d said Chinook\u2019s President, Wanda Lenkewich. \u201cAt the same time, the network connectivity that enables these systems, also introduces new and growing cyber threats. Partnering with Nozomi Networks allows Chinook to support clients with an integrated, comprehensive cybersecurity solution that ensures cyber threats are actively discovered, monitored and managed.\u201d\n\n\u201cWe are absolutely delighted to team with Chinook to help industrial and critical infrastructure facilities meet new requirements for secure connectivity across OT, IT and IoT networks,\u201d said Chet Namboodri, Vice President, Worldwide Business Development and Channel Sales at Nozomi. \u201cWe\u2019ve already worked together to deliver on a number of joint customer engagements in both the government and commercial sectors. Partnering with Chinook accelerates our joint efforts to make sure facility-related control and building management systems are safe from cyber threats.\u201d\n\nwww.nozominetworks.com<\/a>\n\nwww.chinooksystems.com<\/a>\n\n ","post_title":"Nozomi Networks and Chinook Systems partner for OT and IoT security solutions","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"nozomi-networks-and-chinook-systems-partner-for-ot-and-iot-security-solutions","to_ping":"","pinged":"","post_modified":"2020-12-07 14:52:40","post_modified_gmt":"2020-12-07 14:52:40","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4178","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4140,"post_author":"3","post_date":"2020-12-03 11:07:21","post_date_gmt":"2020-12-03 11:07:21","post_content":"Civil Nuclear Constabulary (CNC) police officers based at Harwell have launched Project Servator a collaborative community approach to policing. Project Servator aims to disrupt a range of criminal activity, including terrorism, while providing a reassuring presence for the public.\n\nCNC\u2019s officers are experienced and specially trained to spot the tell-tale signs that someone is planning or preparing to commit an illegal act. It works with other police forces, local businesses and the public to protect the Harwell site and the surrounding area and everyone who lives, works or visits there and to make it a difficult place for terrorists and other criminals to operate. Project Servator has been successful in gathering intelligence that has assisted Counter Terrorism Units across the UK in investigating and preventing acts of terror.\n\nProject Servator\u2019s patrols are highly visible and can happen at any time and in any location. Officers will talk to the public and local businesses to let them know what they\u2019re doing and remind them to be vigilant, trust their instincts and report any suspicious or unusual behaviour.\n\n\u201cWe are deploying these additional tactics to further complement the operational activity that exists in and around our Operational Policing Units,\u201d explained Supt Donna Jones, who is leading on the implementation of the project across the Constabulary. \u201cOur aim is to build upon relationships with partners as well as businesses and communities. These tactics are not new but allow us to have a focus on community engagement and encourage people to be our extra eyes and ears. This is not restricted to the Harwell site but also extends to the surrounding area. We are aware of the vast amount of information members of our community have and they are aware of what is out of the ordinary. All we ask is that they report any suspicions to us and we\u2019ll do the rest. The deployments will be unpredictable and our tactics will vary from one deployment to the next. The aim is to work with our local communities to deter any hostile threat.\u201d\n\nwww.gov.uk\/government\/organisations\/civil-nuclear-constabulary<\/a>","post_title":"CNC Harwell launches Project Servator","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"cnc-harwell-launches-project-servator","to_ping":"","pinged":"","post_modified":"2020-12-03 11:07:23","post_modified_gmt":"2020-12-03 11:07:23","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4140","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4102,"post_author":"3","post_date":"2020-11-30 17:30:23","post_date_gmt":"2020-11-30 17:30:23","post_content":"Radiflow and Mitsubishi Electric UK are collaborating to address the needs of IEC62443 cyber security standards in the Critical Infrastructure and Industrial Automation markets. The companys believe that the combination of the automation knowledge and tools of Mitsubishi Electric UK with the cyber security and IEC 62443 compliance skills of Radiflow will provide a holistic view of a client\u2019s risk posture.\n\nRadiflow will also provide Mitsubishi Electric UK customers with a consultancy service for cyber security, which includes the provision of OT security risk assessments, provision of Radiflow intrusion detection software and general advice on alignment with IEC 62443-3. In addition, the solution is intended to help customers to support asset owners in satisfying the requirements of the NIS Directive along with due diligence in alignment with CPNI (Centre for the Protection of National Infrastructure) best practice.\n\n\u201cOur new collaboration with Radiflow provides expertise in the field of OT cyber security which compliments and broadens the services that we offer our customers through the Mitsubishi Electric UK System Service Operation,\u201d said David Bean, Solutions Manager for Mitsubishi Electric UK. \u201cThere is a growing demand for solutions that address the requirements of cyber security in the OT space and we are looking forward to delivering those solutions and building our relationship further with the team at Radiflow.\u201d\n\n\u201cRadiflow sees huge value for OT organisations to have cyber security services and solutions aligned with their automation systems,\u201d added Ilan Barda, Founder and CEO of Radiflow. \u201cBy combining the automation knowledge and tools of Mitsubishi with the OT cyber security skills and tools of Radiflow, we are able to provide a holistic view of an organisation\u2019s OT risk posture.\u201d\n\nwww.radiflow.com<\/a>","post_title":"Radiflow and Mitsubishi Electric UK collaborate on cyber security standards","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"radiflow-and-mitsubishi-electric-uk-collaborate-on-cyber-security-standards","to_ping":"","pinged":"","post_modified":"2020-11-30 17:30:25","post_modified_gmt":"2020-11-30 17:30:25","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4102","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":3359,"post_author":"3","post_date":"2020-10-16 17:11:16","post_date_gmt":"2020-10-16 16:11:16","post_content":"Senstar explains how its products can be applied to protect the full range of upstream, midstream, and downstream facilities in the oil and gas industry.","post_title":"Senstar explains its security solutions for oil and gas","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"senstar-explains-its-security-solutions-for-oil-and-gas","to_ping":"","pinged":"","post_modified":"2020-10-16 17:11:17","post_modified_gmt":"2020-10-16 16:11:17","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=3359","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"}],"next":false,"prev":false,"total_page":1},"paged":1,"column_class":"jeg_col_2o3","class":"epic_block_14"};

\n

\"We're seeing a lot of victims now, this is seriously a big problem,\" said Chappell in a statement. \"The amount of small businesses that are falling victim <\/a>to this. It's becoming a big problem for the economy globally.\"<\/p>\n\n\n\n

\"Cybercriminals don\u2019t really care how important your business is, only how much money they might extract from you,\" comments Tim Mackey Principal Security Strategist at the Synopsys CyRC (Cybersecurity Research Centre). \"This trend can be seen with increasing attacks on municipalities, healthcare systems, and elements of critical infrastructure. Each of these organisations will bring in law enforcement, yet attackers continue to be aggressive in their activities. <\/p>\n\n\n\n

\"While Colonial Pipeline is a US operation, attacks are global in scope. And despite warnings from officials like the US Treasury Department highlighting how ransomware payments are used to fund future criminal activities, victims are often faced with the difficult decision of whether to pay the ransom.\"<\/p>\n\n\n\n

\"The Colonial Pipeline attack reinforces the need to update legacy systems running today\u2019s critical infrastructure networks...\"<\/p>Lior Div, CEO and Co-founder, Cybereason<\/cite><\/blockquote><\/figure>\n\n\n\n

Remaining critical <\/strong><\/p>\n\n\n\n

\u201cThese \u2018Cyber Physical\u2019 attacks are a big deal, because they demonstrate just how fragile the provision of critical services are into society,\" says Andy Norton European Cyber Risk Officer at Armis. \"A few weeks ago a water treatment plant<\/a> was compromised leading to the potential for poisoning of the water. Now, 45% of the US oil energy provision has been switched off to the East coast. Prolonged shortages in critical services lead to civil unrest, economic pressures, and a general lack of confidence in public administration.\" <\/p>\n\n\n\n

Lior Div, CEO and Co-founder of Cybereason also comments: \"The SolarWinds<\/a> and Microsoft Exchange Server<\/a> attacks were unparalleled in their scope, successfully infiltrating and compromising virtually every US government agency and a wide array of medium and large private sector companies. The Colonial Pipeline attack reinforces the need to update legacy systems running today\u2019s critical infrastructure networks.<\/p>\n\n\n\n

\"If the public and private sectors can work together to solve complex cybersecurity issues, and at the same time accurately identify the threat actors and bring them to account for their actions, it will go a long way in reversing the adversary advantage and enable defenders to retake the high ground. There is also another significant opportunity here as well to cooperate on a global scale to develop extradition laws that enable cyber crimes and cyber espionage to be prosecuted more effectively.\u201d<\/p>\n\n\n\n

Mackey agrees, stating: \"Avoiding becoming a victim of ransomware requires organisations to have a comprehensive cybersecurity plan in place that fully captures the risks of each software component, its role and lifecycle, and its deployment configuration and usage assumptions. Armed with this basic information, and an exhaustive inventory, it becomes possible to determine how each component might play a role in an attempted ransomware attack. <\/p>\n\n\n\n

\"An effort like the one impacting Colonial Pipeline is likely the result of multiple weaknesses in process and cyber-defences that were ultimately successfully exploited. With the age of some industrial software systems far exceeding that of commercial software, it\u2019s likely that older software wasn\u2019t designed to limit exposure to modern threats like ransomware attacks. <\/p>\n\n\n\n

\"While the age of the software has limited impact on its serviceability, threat models and defensive protections need to keep pace with new threats \u2013 something that can only be done if all weaknesses present in each component are known and accounted for. After all, if a criminal can identify your weaknesses faster than you can, luck is rarely on your side.\u201d<\/p>\n\n\n\n

\"While this is indeed a financial disaster, and will have a significant impact on many, let us also consider that this means that, at least for a time, threat actors had control of those very same IT systems.\"<\/p>Martin Jartelius, CSO, Outpost24<\/cite><\/blockquote><\/figure>\n\n\n\n

Taking back control <\/strong><\/p>\n\n\n\n

US government officials are currently working with Colonial to help it recover while scrambling to avoid more severe fuel supply disruptions should the outage continue. Whether the pipeline stays shut that long in turn depends on how deeply the hackers penetrated Colonial\u2019s network - and how soon cybersecurity experts can pull them out.<\/p>\n\n\n\n

\"As so many times before when talking about ransomware \u2013 to lock a system with ransomware you need a good degree of control of that system,\" says Martin Jartelius, CSO at Outpost24. \"While this is indeed a financial disaster, and will have a significant impact on many, let us also consider that this means that, at least for a time, threat actors had control of those very same IT systems. Preventive security, as well as segmentation, are critical for those kinds of environments.\"<\/p>\n\n\n\n

\"One thing to note here is that ransomware has to announce itself to be successful,\" adds Tim Erlin, VP at Tripwire. \"In industrial environments, cyber events aren\u2019t always this visible. Increasing visibility into industrial networks becomes more important as attackers continue to target critical infrastructure.\u201d<\/p>\n\n\n\n

Brad Brooks, CEO and President of OneLogin, rightfully concludes: \"This attack represents just how quickly the stakes are escalating on Cybersecurity, with controlling and knowing who has access to your IT systems a board level priority for every company. We are moving from an invisible Cold War that was focused on stealing data to a highly visible hot war that has real implications for physical property and people\u2019s lives.\u201d<\/p>\n","post_title":"Ransomware roundtable | A threat in the pipeline","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"ransomware-roundtable-a-threat-in-the-pipeline","to_ping":"","pinged":"","post_modified":"2021-05-10 18:12:55","post_modified_gmt":"2021-05-10 17:12:55","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=6024","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4871,"post_author":"3","post_date":"2021-02-09 19:22:22","post_date_gmt":"2021-02-09 19:22:22","post_content":"Detectives assigned to the Digital Forensics Unit at Pinellas County Sheriff\u2019s Office are investigating an unlawful computer software intrusion at the City of Oldsmar\u2019s water treatment plant. While the cyber attack was unsuccessful, it does highlight the need for cybersecurity tools in critical infrastructure applications.\n\nOn Friday, February 5, 2021, the Pinellas County Sheriff\u2019s Office was notified by the City of Oldsmar that its computer system had been remotely accessed at 8:00am and 1:30pm by an unknown suspect. According to detectives, the City of Oldsmar\u2019s computer system at the water treatment plant allows for remote access by authorised users to troubleshoot any system problems from other locations.\n\nThe initial intrusion was brief and not cause for concern due to supervisors regularly accessing the system remotely to monitor the system. At 1:30, a plant operator witnessed a second remote access user opening various functions in the system that control the amount of sodium hydroxide in the water. The operator noted the remote access user raised the levels of sodium hydroxide in the water from 100 parts per million to 11,100 parts per million. The operator immediately reduced the levels to their appropriate amount. Sodium hydroxide is used in small amounts to control acidity, but a large amount could have caused major problems in the water.\n\nThe initial investigation revealed that the hacker remotely accessed the treatment plant\u2019s computer for approximately 3 to 5 minutes. Speaking at a press conference about the cyber attack, Sheriff Bob Gualtieri stated: \u201cAt no time was there a significant effect on the water being treated, and more importantly the public was never in danger.\u201d\n\nCommenting on the attack, Andrea Carcano, co-founder at Nozomi Networks stated: \u201cUnfortunately, this attack plays into a troubling trend we\u2019ve been following over the last year. As the pandemic forced critical infrastructure organisations to quickly shift to remote access options to keep systems up and running, we\u2019ve seen threats rise and bad actors reach new lows \u2013 setting their sights on life threatening targets. Fortunately, in this case, operators monitoring Oldsmar\u2019s treatment plant spotted the attack and were able to respond before anyone could be harmed. But it\u2019s a stark reminder that with limited cybersecurity resources and few regulations water utilities are vulnerable to attack. When it comes critical infrastructure, operational resilience must a top priority and advances in AI-powered OT security and network monitoring are available to give operators the network visibility they need to quickly spot trouble and respond before harm is done.\u201d\n\n\u201cThis targeted attack appears to have started by the \u2018bad actor\u2019 getting access to a vulnerable network\/system and working their way through the network trying to find the next weak access point while gathering data and understanding how the organisation operates along the way,\u201d added Niamh Muldoon, Global Data Protection Officer at OneLogin. \u201cIn this instance, understanding the information assets, applying not only MFA but enhanced multi-factor authentication, would have reduced the risk of this unauthorised attack materializing. It\u2019s a critical part of the MFA policy to enforce time limits for end-users and their trusted devices to re-authenticate, requiring them not only to validate themselves but also the identity of the device trying to access critical systems\/applications and the network. Without knowing more of the details, applying enhanced MFA to the execution of critical actions particularly for IT and systems administrators would have reduced the associated risk further. Having logging in place, and understanding logged events would support with the associated monitoring and alerting events. After the event has happened, crisis management is critical for successfully managing the attack response to reduce business impact and consequences, and it appears the Florida agency has done that.\u201d\n\n\u201cWhile this incident will rightfully cause concern, it appears that likelihood of real damage was minimal due to the fail safes in place,\u201d observes Tim Erlin, VP at Tripwire. \u201cThere are real impacts to be worried about, and actions to be taken, but this doesn\u2019t appear to be a sophisticated or novel attack. From a cybersecurity standpoint, we should be particularly concerned about how the attacker was able to authenticate into the remote access software. That entry point should be very well protected, given that it provides access to such obviously sensitive capabilities. Protecting remote access into industrial systems where these types of changes can be made should be a high priority for any industrial environment.\u201d\n\nLocal, State, and Federal investigators are working together to identify those responsible and the investigation is ongoing. Other utility providers have been informed of the intrusion, so they can take their own protective measures.","post_title":"Florida water system cyber attack highlights role of cybersecurity in critical infrastructure","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"florida-water-system-cyber-attack-highlights-role-of-cybersecurity-in-critical-infrastructure","to_ping":"","pinged":"","post_modified":"2021-02-09 19:22:25","post_modified_gmt":"2021-02-09 19:22:25","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4871","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4178,"post_author":"3","post_date":"2020-12-07 14:52:36","post_date_gmt":"2020-12-07 14:52:36","post_content":"Nozomi Networks and Chinook Systems have partnered to provide advanced cybersecurity solutions to protect industrial and critical infrastructure facilities across North America. Under the deal, Chinook will offer Nozomi Networks\u2019 complete portfolio of OT and IoT security solutions.\n\n\u201cFacilities that fully leverage their OT systems deliver tremendous returns when it comes to energy and operational savings, the safety and comfort of occupants and lower total cost of ownership,\u201d said Chinook\u2019s President, Wanda Lenkewich. \u201cAt the same time, the network connectivity that enables these systems, also introduces new and growing cyber threats. Partnering with Nozomi Networks allows Chinook to support clients with an integrated, comprehensive cybersecurity solution that ensures cyber threats are actively discovered, monitored and managed.\u201d\n\n\u201cWe are absolutely delighted to team with Chinook to help industrial and critical infrastructure facilities meet new requirements for secure connectivity across OT, IT and IoT networks,\u201d said Chet Namboodri, Vice President, Worldwide Business Development and Channel Sales at Nozomi. \u201cWe\u2019ve already worked together to deliver on a number of joint customer engagements in both the government and commercial sectors. Partnering with Chinook accelerates our joint efforts to make sure facility-related control and building management systems are safe from cyber threats.\u201d\n\nwww.nozominetworks.com<\/a>\n\nwww.chinooksystems.com<\/a>\n\n ","post_title":"Nozomi Networks and Chinook Systems partner for OT and IoT security solutions","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"nozomi-networks-and-chinook-systems-partner-for-ot-and-iot-security-solutions","to_ping":"","pinged":"","post_modified":"2020-12-07 14:52:40","post_modified_gmt":"2020-12-07 14:52:40","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4178","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4140,"post_author":"3","post_date":"2020-12-03 11:07:21","post_date_gmt":"2020-12-03 11:07:21","post_content":"Civil Nuclear Constabulary (CNC) police officers based at Harwell have launched Project Servator a collaborative community approach to policing. Project Servator aims to disrupt a range of criminal activity, including terrorism, while providing a reassuring presence for the public.\n\nCNC\u2019s officers are experienced and specially trained to spot the tell-tale signs that someone is planning or preparing to commit an illegal act. It works with other police forces, local businesses and the public to protect the Harwell site and the surrounding area and everyone who lives, works or visits there and to make it a difficult place for terrorists and other criminals to operate. Project Servator has been successful in gathering intelligence that has assisted Counter Terrorism Units across the UK in investigating and preventing acts of terror.\n\nProject Servator\u2019s patrols are highly visible and can happen at any time and in any location. Officers will talk to the public and local businesses to let them know what they\u2019re doing and remind them to be vigilant, trust their instincts and report any suspicious or unusual behaviour.\n\n\u201cWe are deploying these additional tactics to further complement the operational activity that exists in and around our Operational Policing Units,\u201d explained Supt Donna Jones, who is leading on the implementation of the project across the Constabulary. \u201cOur aim is to build upon relationships with partners as well as businesses and communities. These tactics are not new but allow us to have a focus on community engagement and encourage people to be our extra eyes and ears. This is not restricted to the Harwell site but also extends to the surrounding area. We are aware of the vast amount of information members of our community have and they are aware of what is out of the ordinary. All we ask is that they report any suspicions to us and we\u2019ll do the rest. The deployments will be unpredictable and our tactics will vary from one deployment to the next. The aim is to work with our local communities to deter any hostile threat.\u201d\n\nwww.gov.uk\/government\/organisations\/civil-nuclear-constabulary<\/a>","post_title":"CNC Harwell launches Project Servator","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"cnc-harwell-launches-project-servator","to_ping":"","pinged":"","post_modified":"2020-12-03 11:07:23","post_modified_gmt":"2020-12-03 11:07:23","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4140","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4102,"post_author":"3","post_date":"2020-11-30 17:30:23","post_date_gmt":"2020-11-30 17:30:23","post_content":"Radiflow and Mitsubishi Electric UK are collaborating to address the needs of IEC62443 cyber security standards in the Critical Infrastructure and Industrial Automation markets. The companys believe that the combination of the automation knowledge and tools of Mitsubishi Electric UK with the cyber security and IEC 62443 compliance skills of Radiflow will provide a holistic view of a client\u2019s risk posture.\n\nRadiflow will also provide Mitsubishi Electric UK customers with a consultancy service for cyber security, which includes the provision of OT security risk assessments, provision of Radiflow intrusion detection software and general advice on alignment with IEC 62443-3. In addition, the solution is intended to help customers to support asset owners in satisfying the requirements of the NIS Directive along with due diligence in alignment with CPNI (Centre for the Protection of National Infrastructure) best practice.\n\n\u201cOur new collaboration with Radiflow provides expertise in the field of OT cyber security which compliments and broadens the services that we offer our customers through the Mitsubishi Electric UK System Service Operation,\u201d said David Bean, Solutions Manager for Mitsubishi Electric UK. \u201cThere is a growing demand for solutions that address the requirements of cyber security in the OT space and we are looking forward to delivering those solutions and building our relationship further with the team at Radiflow.\u201d\n\n\u201cRadiflow sees huge value for OT organisations to have cyber security services and solutions aligned with their automation systems,\u201d added Ilan Barda, Founder and CEO of Radiflow. \u201cBy combining the automation knowledge and tools of Mitsubishi with the OT cyber security skills and tools of Radiflow, we are able to provide a holistic view of an organisation\u2019s OT risk posture.\u201d\n\nwww.radiflow.com<\/a>","post_title":"Radiflow and Mitsubishi Electric UK collaborate on cyber security standards","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"radiflow-and-mitsubishi-electric-uk-collaborate-on-cyber-security-standards","to_ping":"","pinged":"","post_modified":"2020-11-30 17:30:25","post_modified_gmt":"2020-11-30 17:30:25","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4102","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":3359,"post_author":"3","post_date":"2020-10-16 17:11:16","post_date_gmt":"2020-10-16 16:11:16","post_content":"Senstar explains how its products can be applied to protect the full range of upstream, midstream, and downstream facilities in the oil and gas industry.","post_title":"Senstar explains its security solutions for oil and gas","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"senstar-explains-its-security-solutions-for-oil-and-gas","to_ping":"","pinged":"","post_modified":"2020-10-16 17:11:17","post_modified_gmt":"2020-10-16 16:11:17","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=3359","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"}],"next":false,"prev":false,"total_page":1},"paged":1,"column_class":"jeg_col_2o3","class":"epic_block_14"};

\n

Computer security service, Digital Shadows has claimed that the Colonial attack was indeed helped by the coronavirus pandemic, with more engineers remotely accessing control systems for the pipeline from home. James Chappell, Co-Founder of Digital Shadows, said DarkSide could have bought account login details for remote desktop software such as TeamViewer and Microsoft Remote Desktop.<\/p>\n\n\n\n

\"We're seeing a lot of victims now, this is seriously a big problem,\" said Chappell in a statement. \"The amount of small businesses that are falling victim <\/a>to this. It's becoming a big problem for the economy globally.\"<\/p>\n\n\n\n

\"Cybercriminals don\u2019t really care how important your business is, only how much money they might extract from you,\" comments Tim Mackey Principal Security Strategist at the Synopsys CyRC (Cybersecurity Research Centre). \"This trend can be seen with increasing attacks on municipalities, healthcare systems, and elements of critical infrastructure. Each of these organisations will bring in law enforcement, yet attackers continue to be aggressive in their activities. <\/p>\n\n\n\n

\"While Colonial Pipeline is a US operation, attacks are global in scope. And despite warnings from officials like the US Treasury Department highlighting how ransomware payments are used to fund future criminal activities, victims are often faced with the difficult decision of whether to pay the ransom.\"<\/p>\n\n\n\n

\"The Colonial Pipeline attack reinforces the need to update legacy systems running today\u2019s critical infrastructure networks...\"<\/p>Lior Div, CEO and Co-founder, Cybereason<\/cite><\/blockquote><\/figure>\n\n\n\n

Remaining critical <\/strong><\/p>\n\n\n\n

\u201cThese \u2018Cyber Physical\u2019 attacks are a big deal, because they demonstrate just how fragile the provision of critical services are into society,\" says Andy Norton European Cyber Risk Officer at Armis. \"A few weeks ago a water treatment plant<\/a> was compromised leading to the potential for poisoning of the water. Now, 45% of the US oil energy provision has been switched off to the East coast. Prolonged shortages in critical services lead to civil unrest, economic pressures, and a general lack of confidence in public administration.\" <\/p>\n\n\n\n

Lior Div, CEO and Co-founder of Cybereason also comments: \"The SolarWinds<\/a> and Microsoft Exchange Server<\/a> attacks were unparalleled in their scope, successfully infiltrating and compromising virtually every US government agency and a wide array of medium and large private sector companies. The Colonial Pipeline attack reinforces the need to update legacy systems running today\u2019s critical infrastructure networks.<\/p>\n\n\n\n

\"If the public and private sectors can work together to solve complex cybersecurity issues, and at the same time accurately identify the threat actors and bring them to account for their actions, it will go a long way in reversing the adversary advantage and enable defenders to retake the high ground. There is also another significant opportunity here as well to cooperate on a global scale to develop extradition laws that enable cyber crimes and cyber espionage to be prosecuted more effectively.\u201d<\/p>\n\n\n\n

Mackey agrees, stating: \"Avoiding becoming a victim of ransomware requires organisations to have a comprehensive cybersecurity plan in place that fully captures the risks of each software component, its role and lifecycle, and its deployment configuration and usage assumptions. Armed with this basic information, and an exhaustive inventory, it becomes possible to determine how each component might play a role in an attempted ransomware attack. <\/p>\n\n\n\n

\"An effort like the one impacting Colonial Pipeline is likely the result of multiple weaknesses in process and cyber-defences that were ultimately successfully exploited. With the age of some industrial software systems far exceeding that of commercial software, it\u2019s likely that older software wasn\u2019t designed to limit exposure to modern threats like ransomware attacks. <\/p>\n\n\n\n

\"While the age of the software has limited impact on its serviceability, threat models and defensive protections need to keep pace with new threats \u2013 something that can only be done if all weaknesses present in each component are known and accounted for. After all, if a criminal can identify your weaknesses faster than you can, luck is rarely on your side.\u201d<\/p>\n\n\n\n

\"While this is indeed a financial disaster, and will have a significant impact on many, let us also consider that this means that, at least for a time, threat actors had control of those very same IT systems.\"<\/p>Martin Jartelius, CSO, Outpost24<\/cite><\/blockquote><\/figure>\n\n\n\n

Taking back control <\/strong><\/p>\n\n\n\n

US government officials are currently working with Colonial to help it recover while scrambling to avoid more severe fuel supply disruptions should the outage continue. Whether the pipeline stays shut that long in turn depends on how deeply the hackers penetrated Colonial\u2019s network - and how soon cybersecurity experts can pull them out.<\/p>\n\n\n\n

\"As so many times before when talking about ransomware \u2013 to lock a system with ransomware you need a good degree of control of that system,\" says Martin Jartelius, CSO at Outpost24. \"While this is indeed a financial disaster, and will have a significant impact on many, let us also consider that this means that, at least for a time, threat actors had control of those very same IT systems. Preventive security, as well as segmentation, are critical for those kinds of environments.\"<\/p>\n\n\n\n

\"One thing to note here is that ransomware has to announce itself to be successful,\" adds Tim Erlin, VP at Tripwire. \"In industrial environments, cyber events aren\u2019t always this visible. Increasing visibility into industrial networks becomes more important as attackers continue to target critical infrastructure.\u201d<\/p>\n\n\n\n

Brad Brooks, CEO and President of OneLogin, rightfully concludes: \"This attack represents just how quickly the stakes are escalating on Cybersecurity, with controlling and knowing who has access to your IT systems a board level priority for every company. We are moving from an invisible Cold War that was focused on stealing data to a highly visible hot war that has real implications for physical property and people\u2019s lives.\u201d<\/p>\n","post_title":"Ransomware roundtable | A threat in the pipeline","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"ransomware-roundtable-a-threat-in-the-pipeline","to_ping":"","pinged":"","post_modified":"2021-05-10 18:12:55","post_modified_gmt":"2021-05-10 17:12:55","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=6024","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4871,"post_author":"3","post_date":"2021-02-09 19:22:22","post_date_gmt":"2021-02-09 19:22:22","post_content":"Detectives assigned to the Digital Forensics Unit at Pinellas County Sheriff\u2019s Office are investigating an unlawful computer software intrusion at the City of Oldsmar\u2019s water treatment plant. While the cyber attack was unsuccessful, it does highlight the need for cybersecurity tools in critical infrastructure applications.\n\nOn Friday, February 5, 2021, the Pinellas County Sheriff\u2019s Office was notified by the City of Oldsmar that its computer system had been remotely accessed at 8:00am and 1:30pm by an unknown suspect. According to detectives, the City of Oldsmar\u2019s computer system at the water treatment plant allows for remote access by authorised users to troubleshoot any system problems from other locations.\n\nThe initial intrusion was brief and not cause for concern due to supervisors regularly accessing the system remotely to monitor the system. At 1:30, a plant operator witnessed a second remote access user opening various functions in the system that control the amount of sodium hydroxide in the water. The operator noted the remote access user raised the levels of sodium hydroxide in the water from 100 parts per million to 11,100 parts per million. The operator immediately reduced the levels to their appropriate amount. Sodium hydroxide is used in small amounts to control acidity, but a large amount could have caused major problems in the water.\n\nThe initial investigation revealed that the hacker remotely accessed the treatment plant\u2019s computer for approximately 3 to 5 minutes. Speaking at a press conference about the cyber attack, Sheriff Bob Gualtieri stated: \u201cAt no time was there a significant effect on the water being treated, and more importantly the public was never in danger.\u201d\n\nCommenting on the attack, Andrea Carcano, co-founder at Nozomi Networks stated: \u201cUnfortunately, this attack plays into a troubling trend we\u2019ve been following over the last year. As the pandemic forced critical infrastructure organisations to quickly shift to remote access options to keep systems up and running, we\u2019ve seen threats rise and bad actors reach new lows \u2013 setting their sights on life threatening targets. Fortunately, in this case, operators monitoring Oldsmar\u2019s treatment plant spotted the attack and were able to respond before anyone could be harmed. But it\u2019s a stark reminder that with limited cybersecurity resources and few regulations water utilities are vulnerable to attack. When it comes critical infrastructure, operational resilience must a top priority and advances in AI-powered OT security and network monitoring are available to give operators the network visibility they need to quickly spot trouble and respond before harm is done.\u201d\n\n\u201cThis targeted attack appears to have started by the \u2018bad actor\u2019 getting access to a vulnerable network\/system and working their way through the network trying to find the next weak access point while gathering data and understanding how the organisation operates along the way,\u201d added Niamh Muldoon, Global Data Protection Officer at OneLogin. \u201cIn this instance, understanding the information assets, applying not only MFA but enhanced multi-factor authentication, would have reduced the risk of this unauthorised attack materializing. It\u2019s a critical part of the MFA policy to enforce time limits for end-users and their trusted devices to re-authenticate, requiring them not only to validate themselves but also the identity of the device trying to access critical systems\/applications and the network. Without knowing more of the details, applying enhanced MFA to the execution of critical actions particularly for IT and systems administrators would have reduced the associated risk further. Having logging in place, and understanding logged events would support with the associated monitoring and alerting events. After the event has happened, crisis management is critical for successfully managing the attack response to reduce business impact and consequences, and it appears the Florida agency has done that.\u201d\n\n\u201cWhile this incident will rightfully cause concern, it appears that likelihood of real damage was minimal due to the fail safes in place,\u201d observes Tim Erlin, VP at Tripwire. \u201cThere are real impacts to be worried about, and actions to be taken, but this doesn\u2019t appear to be a sophisticated or novel attack. From a cybersecurity standpoint, we should be particularly concerned about how the attacker was able to authenticate into the remote access software. That entry point should be very well protected, given that it provides access to such obviously sensitive capabilities. Protecting remote access into industrial systems where these types of changes can be made should be a high priority for any industrial environment.\u201d\n\nLocal, State, and Federal investigators are working together to identify those responsible and the investigation is ongoing. Other utility providers have been informed of the intrusion, so they can take their own protective measures.","post_title":"Florida water system cyber attack highlights role of cybersecurity in critical infrastructure","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"florida-water-system-cyber-attack-highlights-role-of-cybersecurity-in-critical-infrastructure","to_ping":"","pinged":"","post_modified":"2021-02-09 19:22:25","post_modified_gmt":"2021-02-09 19:22:25","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4871","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4178,"post_author":"3","post_date":"2020-12-07 14:52:36","post_date_gmt":"2020-12-07 14:52:36","post_content":"Nozomi Networks and Chinook Systems have partnered to provide advanced cybersecurity solutions to protect industrial and critical infrastructure facilities across North America. Under the deal, Chinook will offer Nozomi Networks\u2019 complete portfolio of OT and IoT security solutions.\n\n\u201cFacilities that fully leverage their OT systems deliver tremendous returns when it comes to energy and operational savings, the safety and comfort of occupants and lower total cost of ownership,\u201d said Chinook\u2019s President, Wanda Lenkewich. \u201cAt the same time, the network connectivity that enables these systems, also introduces new and growing cyber threats. Partnering with Nozomi Networks allows Chinook to support clients with an integrated, comprehensive cybersecurity solution that ensures cyber threats are actively discovered, monitored and managed.\u201d\n\n\u201cWe are absolutely delighted to team with Chinook to help industrial and critical infrastructure facilities meet new requirements for secure connectivity across OT, IT and IoT networks,\u201d said Chet Namboodri, Vice President, Worldwide Business Development and Channel Sales at Nozomi. \u201cWe\u2019ve already worked together to deliver on a number of joint customer engagements in both the government and commercial sectors. Partnering with Chinook accelerates our joint efforts to make sure facility-related control and building management systems are safe from cyber threats.\u201d\n\nwww.nozominetworks.com<\/a>\n\nwww.chinooksystems.com<\/a>\n\n ","post_title":"Nozomi Networks and Chinook Systems partner for OT and IoT security solutions","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"nozomi-networks-and-chinook-systems-partner-for-ot-and-iot-security-solutions","to_ping":"","pinged":"","post_modified":"2020-12-07 14:52:40","post_modified_gmt":"2020-12-07 14:52:40","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4178","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4140,"post_author":"3","post_date":"2020-12-03 11:07:21","post_date_gmt":"2020-12-03 11:07:21","post_content":"Civil Nuclear Constabulary (CNC) police officers based at Harwell have launched Project Servator a collaborative community approach to policing. Project Servator aims to disrupt a range of criminal activity, including terrorism, while providing a reassuring presence for the public.\n\nCNC\u2019s officers are experienced and specially trained to spot the tell-tale signs that someone is planning or preparing to commit an illegal act. It works with other police forces, local businesses and the public to protect the Harwell site and the surrounding area and everyone who lives, works or visits there and to make it a difficult place for terrorists and other criminals to operate. Project Servator has been successful in gathering intelligence that has assisted Counter Terrorism Units across the UK in investigating and preventing acts of terror.\n\nProject Servator\u2019s patrols are highly visible and can happen at any time and in any location. Officers will talk to the public and local businesses to let them know what they\u2019re doing and remind them to be vigilant, trust their instincts and report any suspicious or unusual behaviour.\n\n\u201cWe are deploying these additional tactics to further complement the operational activity that exists in and around our Operational Policing Units,\u201d explained Supt Donna Jones, who is leading on the implementation of the project across the Constabulary. \u201cOur aim is to build upon relationships with partners as well as businesses and communities. These tactics are not new but allow us to have a focus on community engagement and encourage people to be our extra eyes and ears. This is not restricted to the Harwell site but also extends to the surrounding area. We are aware of the vast amount of information members of our community have and they are aware of what is out of the ordinary. All we ask is that they report any suspicions to us and we\u2019ll do the rest. The deployments will be unpredictable and our tactics will vary from one deployment to the next. The aim is to work with our local communities to deter any hostile threat.\u201d\n\nwww.gov.uk\/government\/organisations\/civil-nuclear-constabulary<\/a>","post_title":"CNC Harwell launches Project Servator","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"cnc-harwell-launches-project-servator","to_ping":"","pinged":"","post_modified":"2020-12-03 11:07:23","post_modified_gmt":"2020-12-03 11:07:23","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4140","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4102,"post_author":"3","post_date":"2020-11-30 17:30:23","post_date_gmt":"2020-11-30 17:30:23","post_content":"Radiflow and Mitsubishi Electric UK are collaborating to address the needs of IEC62443 cyber security standards in the Critical Infrastructure and Industrial Automation markets. The companys believe that the combination of the automation knowledge and tools of Mitsubishi Electric UK with the cyber security and IEC 62443 compliance skills of Radiflow will provide a holistic view of a client\u2019s risk posture.\n\nRadiflow will also provide Mitsubishi Electric UK customers with a consultancy service for cyber security, which includes the provision of OT security risk assessments, provision of Radiflow intrusion detection software and general advice on alignment with IEC 62443-3. In addition, the solution is intended to help customers to support asset owners in satisfying the requirements of the NIS Directive along with due diligence in alignment with CPNI (Centre for the Protection of National Infrastructure) best practice.\n\n\u201cOur new collaboration with Radiflow provides expertise in the field of OT cyber security which compliments and broadens the services that we offer our customers through the Mitsubishi Electric UK System Service Operation,\u201d said David Bean, Solutions Manager for Mitsubishi Electric UK. \u201cThere is a growing demand for solutions that address the requirements of cyber security in the OT space and we are looking forward to delivering those solutions and building our relationship further with the team at Radiflow.\u201d\n\n\u201cRadiflow sees huge value for OT organisations to have cyber security services and solutions aligned with their automation systems,\u201d added Ilan Barda, Founder and CEO of Radiflow. \u201cBy combining the automation knowledge and tools of Mitsubishi with the OT cyber security skills and tools of Radiflow, we are able to provide a holistic view of an organisation\u2019s OT risk posture.\u201d\n\nwww.radiflow.com<\/a>","post_title":"Radiflow and Mitsubishi Electric UK collaborate on cyber security standards","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"radiflow-and-mitsubishi-electric-uk-collaborate-on-cyber-security-standards","to_ping":"","pinged":"","post_modified":"2020-11-30 17:30:25","post_modified_gmt":"2020-11-30 17:30:25","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4102","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":3359,"post_author":"3","post_date":"2020-10-16 17:11:16","post_date_gmt":"2020-10-16 16:11:16","post_content":"Senstar explains how its products can be applied to protect the full range of upstream, midstream, and downstream facilities in the oil and gas industry.","post_title":"Senstar explains its security solutions for oil and gas","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"senstar-explains-its-security-solutions-for-oil-and-gas","to_ping":"","pinged":"","post_modified":"2020-10-16 17:11:17","post_modified_gmt":"2020-10-16 16:11:17","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=3359","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"}],"next":false,"prev":false,"total_page":1},"paged":1,"column_class":"jeg_col_2o3","class":"epic_block_14"};

\n

\"The fact that US government has quickly issued emergency legislation to relax rules on road fuel transportation highlights how concerning this attack is. A longer term implication of the attack could create a delay in delivery and disruption of the supply chain. This would cause an increase in price at a time when the economy is already fragile due to the current pandemic.\" <\/p>\n\n\n\n

Computer security service, Digital Shadows has claimed that the Colonial attack was indeed helped by the coronavirus pandemic, with more engineers remotely accessing control systems for the pipeline from home. James Chappell, Co-Founder of Digital Shadows, said DarkSide could have bought account login details for remote desktop software such as TeamViewer and Microsoft Remote Desktop.<\/p>\n\n\n\n

\"We're seeing a lot of victims now, this is seriously a big problem,\" said Chappell in a statement. \"The amount of small businesses that are falling victim <\/a>to this. It's becoming a big problem for the economy globally.\"<\/p>\n\n\n\n

\"Cybercriminals don\u2019t really care how important your business is, only how much money they might extract from you,\" comments Tim Mackey Principal Security Strategist at the Synopsys CyRC (Cybersecurity Research Centre). \"This trend can be seen with increasing attacks on municipalities, healthcare systems, and elements of critical infrastructure. Each of these organisations will bring in law enforcement, yet attackers continue to be aggressive in their activities. <\/p>\n\n\n\n

\"While Colonial Pipeline is a US operation, attacks are global in scope. And despite warnings from officials like the US Treasury Department highlighting how ransomware payments are used to fund future criminal activities, victims are often faced with the difficult decision of whether to pay the ransom.\"<\/p>\n\n\n\n

\"The Colonial Pipeline attack reinforces the need to update legacy systems running today\u2019s critical infrastructure networks...\"<\/p>Lior Div, CEO and Co-founder, Cybereason<\/cite><\/blockquote><\/figure>\n\n\n\n

Remaining critical <\/strong><\/p>\n\n\n\n

\u201cThese \u2018Cyber Physical\u2019 attacks are a big deal, because they demonstrate just how fragile the provision of critical services are into society,\" says Andy Norton European Cyber Risk Officer at Armis. \"A few weeks ago a water treatment plant<\/a> was compromised leading to the potential for poisoning of the water. Now, 45% of the US oil energy provision has been switched off to the East coast. Prolonged shortages in critical services lead to civil unrest, economic pressures, and a general lack of confidence in public administration.\" <\/p>\n\n\n\n

Lior Div, CEO and Co-founder of Cybereason also comments: \"The SolarWinds<\/a> and Microsoft Exchange Server<\/a> attacks were unparalleled in their scope, successfully infiltrating and compromising virtually every US government agency and a wide array of medium and large private sector companies. The Colonial Pipeline attack reinforces the need to update legacy systems running today\u2019s critical infrastructure networks.<\/p>\n\n\n\n

\"If the public and private sectors can work together to solve complex cybersecurity issues, and at the same time accurately identify the threat actors and bring them to account for their actions, it will go a long way in reversing the adversary advantage and enable defenders to retake the high ground. There is also another significant opportunity here as well to cooperate on a global scale to develop extradition laws that enable cyber crimes and cyber espionage to be prosecuted more effectively.\u201d<\/p>\n\n\n\n

Mackey agrees, stating: \"Avoiding becoming a victim of ransomware requires organisations to have a comprehensive cybersecurity plan in place that fully captures the risks of each software component, its role and lifecycle, and its deployment configuration and usage assumptions. Armed with this basic information, and an exhaustive inventory, it becomes possible to determine how each component might play a role in an attempted ransomware attack. <\/p>\n\n\n\n

\"An effort like the one impacting Colonial Pipeline is likely the result of multiple weaknesses in process and cyber-defences that were ultimately successfully exploited. With the age of some industrial software systems far exceeding that of commercial software, it\u2019s likely that older software wasn\u2019t designed to limit exposure to modern threats like ransomware attacks. <\/p>\n\n\n\n

\"While the age of the software has limited impact on its serviceability, threat models and defensive protections need to keep pace with new threats \u2013 something that can only be done if all weaknesses present in each component are known and accounted for. After all, if a criminal can identify your weaknesses faster than you can, luck is rarely on your side.\u201d<\/p>\n\n\n\n

\"While this is indeed a financial disaster, and will have a significant impact on many, let us also consider that this means that, at least for a time, threat actors had control of those very same IT systems.\"<\/p>Martin Jartelius, CSO, Outpost24<\/cite><\/blockquote><\/figure>\n\n\n\n

Taking back control <\/strong><\/p>\n\n\n\n

US government officials are currently working with Colonial to help it recover while scrambling to avoid more severe fuel supply disruptions should the outage continue. Whether the pipeline stays shut that long in turn depends on how deeply the hackers penetrated Colonial\u2019s network - and how soon cybersecurity experts can pull them out.<\/p>\n\n\n\n

\"As so many times before when talking about ransomware \u2013 to lock a system with ransomware you need a good degree of control of that system,\" says Martin Jartelius, CSO at Outpost24. \"While this is indeed a financial disaster, and will have a significant impact on many, let us also consider that this means that, at least for a time, threat actors had control of those very same IT systems. Preventive security, as well as segmentation, are critical for those kinds of environments.\"<\/p>\n\n\n\n

\"One thing to note here is that ransomware has to announce itself to be successful,\" adds Tim Erlin, VP at Tripwire. \"In industrial environments, cyber events aren\u2019t always this visible. Increasing visibility into industrial networks becomes more important as attackers continue to target critical infrastructure.\u201d<\/p>\n\n\n\n

Brad Brooks, CEO and President of OneLogin, rightfully concludes: \"This attack represents just how quickly the stakes are escalating on Cybersecurity, with controlling and knowing who has access to your IT systems a board level priority for every company. We are moving from an invisible Cold War that was focused on stealing data to a highly visible hot war that has real implications for physical property and people\u2019s lives.\u201d<\/p>\n","post_title":"Ransomware roundtable | A threat in the pipeline","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"ransomware-roundtable-a-threat-in-the-pipeline","to_ping":"","pinged":"","post_modified":"2021-05-10 18:12:55","post_modified_gmt":"2021-05-10 17:12:55","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=6024","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4871,"post_author":"3","post_date":"2021-02-09 19:22:22","post_date_gmt":"2021-02-09 19:22:22","post_content":"Detectives assigned to the Digital Forensics Unit at Pinellas County Sheriff\u2019s Office are investigating an unlawful computer software intrusion at the City of Oldsmar\u2019s water treatment plant. While the cyber attack was unsuccessful, it does highlight the need for cybersecurity tools in critical infrastructure applications.\n\nOn Friday, February 5, 2021, the Pinellas County Sheriff\u2019s Office was notified by the City of Oldsmar that its computer system had been remotely accessed at 8:00am and 1:30pm by an unknown suspect. According to detectives, the City of Oldsmar\u2019s computer system at the water treatment plant allows for remote access by authorised users to troubleshoot any system problems from other locations.\n\nThe initial intrusion was brief and not cause for concern due to supervisors regularly accessing the system remotely to monitor the system. At 1:30, a plant operator witnessed a second remote access user opening various functions in the system that control the amount of sodium hydroxide in the water. The operator noted the remote access user raised the levels of sodium hydroxide in the water from 100 parts per million to 11,100 parts per million. The operator immediately reduced the levels to their appropriate amount. Sodium hydroxide is used in small amounts to control acidity, but a large amount could have caused major problems in the water.\n\nThe initial investigation revealed that the hacker remotely accessed the treatment plant\u2019s computer for approximately 3 to 5 minutes. Speaking at a press conference about the cyber attack, Sheriff Bob Gualtieri stated: \u201cAt no time was there a significant effect on the water being treated, and more importantly the public was never in danger.\u201d\n\nCommenting on the attack, Andrea Carcano, co-founder at Nozomi Networks stated: \u201cUnfortunately, this attack plays into a troubling trend we\u2019ve been following over the last year. As the pandemic forced critical infrastructure organisations to quickly shift to remote access options to keep systems up and running, we\u2019ve seen threats rise and bad actors reach new lows \u2013 setting their sights on life threatening targets. Fortunately, in this case, operators monitoring Oldsmar\u2019s treatment plant spotted the attack and were able to respond before anyone could be harmed. But it\u2019s a stark reminder that with limited cybersecurity resources and few regulations water utilities are vulnerable to attack. When it comes critical infrastructure, operational resilience must a top priority and advances in AI-powered OT security and network monitoring are available to give operators the network visibility they need to quickly spot trouble and respond before harm is done.\u201d\n\n\u201cThis targeted attack appears to have started by the \u2018bad actor\u2019 getting access to a vulnerable network\/system and working their way through the network trying to find the next weak access point while gathering data and understanding how the organisation operates along the way,\u201d added Niamh Muldoon, Global Data Protection Officer at OneLogin. \u201cIn this instance, understanding the information assets, applying not only MFA but enhanced multi-factor authentication, would have reduced the risk of this unauthorised attack materializing. It\u2019s a critical part of the MFA policy to enforce time limits for end-users and their trusted devices to re-authenticate, requiring them not only to validate themselves but also the identity of the device trying to access critical systems\/applications and the network. Without knowing more of the details, applying enhanced MFA to the execution of critical actions particularly for IT and systems administrators would have reduced the associated risk further. Having logging in place, and understanding logged events would support with the associated monitoring and alerting events. After the event has happened, crisis management is critical for successfully managing the attack response to reduce business impact and consequences, and it appears the Florida agency has done that.\u201d\n\n\u201cWhile this incident will rightfully cause concern, it appears that likelihood of real damage was minimal due to the fail safes in place,\u201d observes Tim Erlin, VP at Tripwire. \u201cThere are real impacts to be worried about, and actions to be taken, but this doesn\u2019t appear to be a sophisticated or novel attack. From a cybersecurity standpoint, we should be particularly concerned about how the attacker was able to authenticate into the remote access software. That entry point should be very well protected, given that it provides access to such obviously sensitive capabilities. Protecting remote access into industrial systems where these types of changes can be made should be a high priority for any industrial environment.\u201d\n\nLocal, State, and Federal investigators are working together to identify those responsible and the investigation is ongoing. Other utility providers have been informed of the intrusion, so they can take their own protective measures.","post_title":"Florida water system cyber attack highlights role of cybersecurity in critical infrastructure","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"florida-water-system-cyber-attack-highlights-role-of-cybersecurity-in-critical-infrastructure","to_ping":"","pinged":"","post_modified":"2021-02-09 19:22:25","post_modified_gmt":"2021-02-09 19:22:25","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4871","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4178,"post_author":"3","post_date":"2020-12-07 14:52:36","post_date_gmt":"2020-12-07 14:52:36","post_content":"Nozomi Networks and Chinook Systems have partnered to provide advanced cybersecurity solutions to protect industrial and critical infrastructure facilities across North America. Under the deal, Chinook will offer Nozomi Networks\u2019 complete portfolio of OT and IoT security solutions.\n\n\u201cFacilities that fully leverage their OT systems deliver tremendous returns when it comes to energy and operational savings, the safety and comfort of occupants and lower total cost of ownership,\u201d said Chinook\u2019s President, Wanda Lenkewich. \u201cAt the same time, the network connectivity that enables these systems, also introduces new and growing cyber threats. Partnering with Nozomi Networks allows Chinook to support clients with an integrated, comprehensive cybersecurity solution that ensures cyber threats are actively discovered, monitored and managed.\u201d\n\n\u201cWe are absolutely delighted to team with Chinook to help industrial and critical infrastructure facilities meet new requirements for secure connectivity across OT, IT and IoT networks,\u201d said Chet Namboodri, Vice President, Worldwide Business Development and Channel Sales at Nozomi. \u201cWe\u2019ve already worked together to deliver on a number of joint customer engagements in both the government and commercial sectors. Partnering with Chinook accelerates our joint efforts to make sure facility-related control and building management systems are safe from cyber threats.\u201d\n\nwww.nozominetworks.com<\/a>\n\nwww.chinooksystems.com<\/a>\n\n ","post_title":"Nozomi Networks and Chinook Systems partner for OT and IoT security solutions","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"nozomi-networks-and-chinook-systems-partner-for-ot-and-iot-security-solutions","to_ping":"","pinged":"","post_modified":"2020-12-07 14:52:40","post_modified_gmt":"2020-12-07 14:52:40","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4178","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4140,"post_author":"3","post_date":"2020-12-03 11:07:21","post_date_gmt":"2020-12-03 11:07:21","post_content":"Civil Nuclear Constabulary (CNC) police officers based at Harwell have launched Project Servator a collaborative community approach to policing. Project Servator aims to disrupt a range of criminal activity, including terrorism, while providing a reassuring presence for the public.\n\nCNC\u2019s officers are experienced and specially trained to spot the tell-tale signs that someone is planning or preparing to commit an illegal act. It works with other police forces, local businesses and the public to protect the Harwell site and the surrounding area and everyone who lives, works or visits there and to make it a difficult place for terrorists and other criminals to operate. Project Servator has been successful in gathering intelligence that has assisted Counter Terrorism Units across the UK in investigating and preventing acts of terror.\n\nProject Servator\u2019s patrols are highly visible and can happen at any time and in any location. Officers will talk to the public and local businesses to let them know what they\u2019re doing and remind them to be vigilant, trust their instincts and report any suspicious or unusual behaviour.\n\n\u201cWe are deploying these additional tactics to further complement the operational activity that exists in and around our Operational Policing Units,\u201d explained Supt Donna Jones, who is leading on the implementation of the project across the Constabulary. \u201cOur aim is to build upon relationships with partners as well as businesses and communities. These tactics are not new but allow us to have a focus on community engagement and encourage people to be our extra eyes and ears. This is not restricted to the Harwell site but also extends to the surrounding area. We are aware of the vast amount of information members of our community have and they are aware of what is out of the ordinary. All we ask is that they report any suspicions to us and we\u2019ll do the rest. The deployments will be unpredictable and our tactics will vary from one deployment to the next. The aim is to work with our local communities to deter any hostile threat.\u201d\n\nwww.gov.uk\/government\/organisations\/civil-nuclear-constabulary<\/a>","post_title":"CNC Harwell launches Project Servator","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"cnc-harwell-launches-project-servator","to_ping":"","pinged":"","post_modified":"2020-12-03 11:07:23","post_modified_gmt":"2020-12-03 11:07:23","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4140","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4102,"post_author":"3","post_date":"2020-11-30 17:30:23","post_date_gmt":"2020-11-30 17:30:23","post_content":"Radiflow and Mitsubishi Electric UK are collaborating to address the needs of IEC62443 cyber security standards in the Critical Infrastructure and Industrial Automation markets. The companys believe that the combination of the automation knowledge and tools of Mitsubishi Electric UK with the cyber security and IEC 62443 compliance skills of Radiflow will provide a holistic view of a client\u2019s risk posture.\n\nRadiflow will also provide Mitsubishi Electric UK customers with a consultancy service for cyber security, which includes the provision of OT security risk assessments, provision of Radiflow intrusion detection software and general advice on alignment with IEC 62443-3. In addition, the solution is intended to help customers to support asset owners in satisfying the requirements of the NIS Directive along with due diligence in alignment with CPNI (Centre for the Protection of National Infrastructure) best practice.\n\n\u201cOur new collaboration with Radiflow provides expertise in the field of OT cyber security which compliments and broadens the services that we offer our customers through the Mitsubishi Electric UK System Service Operation,\u201d said David Bean, Solutions Manager for Mitsubishi Electric UK. \u201cThere is a growing demand for solutions that address the requirements of cyber security in the OT space and we are looking forward to delivering those solutions and building our relationship further with the team at Radiflow.\u201d\n\n\u201cRadiflow sees huge value for OT organisations to have cyber security services and solutions aligned with their automation systems,\u201d added Ilan Barda, Founder and CEO of Radiflow. \u201cBy combining the automation knowledge and tools of Mitsubishi with the OT cyber security skills and tools of Radiflow, we are able to provide a holistic view of an organisation\u2019s OT risk posture.\u201d\n\nwww.radiflow.com<\/a>","post_title":"Radiflow and Mitsubishi Electric UK collaborate on cyber security standards","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"radiflow-and-mitsubishi-electric-uk-collaborate-on-cyber-security-standards","to_ping":"","pinged":"","post_modified":"2020-11-30 17:30:25","post_modified_gmt":"2020-11-30 17:30:25","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4102","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":3359,"post_author":"3","post_date":"2020-10-16 17:11:16","post_date_gmt":"2020-10-16 16:11:16","post_content":"Senstar explains how its products can be applied to protect the full range of upstream, midstream, and downstream facilities in the oil and gas industry.","post_title":"Senstar explains its security solutions for oil and gas","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"senstar-explains-its-security-solutions-for-oil-and-gas","to_ping":"","pinged":"","post_modified":"2020-10-16 17:11:17","post_modified_gmt":"2020-10-16 16:11:17","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=3359","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"}],"next":false,"prev":false,"total_page":1},"paged":1,"column_class":"jeg_col_2o3","class":"epic_block_14"};

\n

In response to this substantial attack, Lewis Jones, Threat Intelligence Analyst at Talion says: \u201cThis appears to be one of the most disruptive ransomware attacks ever reported, highlighting the vulnerabilities in the energy sector and why it is often targeted by attackers. A long term ransomware negotiation within the energy sector could cause mass disruption and means that the likelihood of payment is increased. <\/p>\n\n\n\n

\"The fact that US government has quickly issued emergency legislation to relax rules on road fuel transportation highlights how concerning this attack is. A longer term implication of the attack could create a delay in delivery and disruption of the supply chain. This would cause an increase in price at a time when the economy is already fragile due to the current pandemic.\" <\/p>\n\n\n\n

Computer security service, Digital Shadows has claimed that the Colonial attack was indeed helped by the coronavirus pandemic, with more engineers remotely accessing control systems for the pipeline from home. James Chappell, Co-Founder of Digital Shadows, said DarkSide could have bought account login details for remote desktop software such as TeamViewer and Microsoft Remote Desktop.<\/p>\n\n\n\n

\"We're seeing a lot of victims now, this is seriously a big problem,\" said Chappell in a statement. \"The amount of small businesses that are falling victim <\/a>to this. It's becoming a big problem for the economy globally.\"<\/p>\n\n\n\n

\"Cybercriminals don\u2019t really care how important your business is, only how much money they might extract from you,\" comments Tim Mackey Principal Security Strategist at the Synopsys CyRC (Cybersecurity Research Centre). \"This trend can be seen with increasing attacks on municipalities, healthcare systems, and elements of critical infrastructure. Each of these organisations will bring in law enforcement, yet attackers continue to be aggressive in their activities. <\/p>\n\n\n\n

\"While Colonial Pipeline is a US operation, attacks are global in scope. And despite warnings from officials like the US Treasury Department highlighting how ransomware payments are used to fund future criminal activities, victims are often faced with the difficult decision of whether to pay the ransom.\"<\/p>\n\n\n\n

\"The Colonial Pipeline attack reinforces the need to update legacy systems running today\u2019s critical infrastructure networks...\"<\/p>Lior Div, CEO and Co-founder, Cybereason<\/cite><\/blockquote><\/figure>\n\n\n\n

Remaining critical <\/strong><\/p>\n\n\n\n

\u201cThese \u2018Cyber Physical\u2019 attacks are a big deal, because they demonstrate just how fragile the provision of critical services are into society,\" says Andy Norton European Cyber Risk Officer at Armis. \"A few weeks ago a water treatment plant<\/a> was compromised leading to the potential for poisoning of the water. Now, 45% of the US oil energy provision has been switched off to the East coast. Prolonged shortages in critical services lead to civil unrest, economic pressures, and a general lack of confidence in public administration.\" <\/p>\n\n\n\n

Lior Div, CEO and Co-founder of Cybereason also comments: \"The SolarWinds<\/a> and Microsoft Exchange Server<\/a> attacks were unparalleled in their scope, successfully infiltrating and compromising virtually every US government agency and a wide array of medium and large private sector companies. The Colonial Pipeline attack reinforces the need to update legacy systems running today\u2019s critical infrastructure networks.<\/p>\n\n\n\n

\"If the public and private sectors can work together to solve complex cybersecurity issues, and at the same time accurately identify the threat actors and bring them to account for their actions, it will go a long way in reversing the adversary advantage and enable defenders to retake the high ground. There is also another significant opportunity here as well to cooperate on a global scale to develop extradition laws that enable cyber crimes and cyber espionage to be prosecuted more effectively.\u201d<\/p>\n\n\n\n

Mackey agrees, stating: \"Avoiding becoming a victim of ransomware requires organisations to have a comprehensive cybersecurity plan in place that fully captures the risks of each software component, its role and lifecycle, and its deployment configuration and usage assumptions. Armed with this basic information, and an exhaustive inventory, it becomes possible to determine how each component might play a role in an attempted ransomware attack. <\/p>\n\n\n\n

\"An effort like the one impacting Colonial Pipeline is likely the result of multiple weaknesses in process and cyber-defences that were ultimately successfully exploited. With the age of some industrial software systems far exceeding that of commercial software, it\u2019s likely that older software wasn\u2019t designed to limit exposure to modern threats like ransomware attacks. <\/p>\n\n\n\n

\"While the age of the software has limited impact on its serviceability, threat models and defensive protections need to keep pace with new threats \u2013 something that can only be done if all weaknesses present in each component are known and accounted for. After all, if a criminal can identify your weaknesses faster than you can, luck is rarely on your side.\u201d<\/p>\n\n\n\n

\"While this is indeed a financial disaster, and will have a significant impact on many, let us also consider that this means that, at least for a time, threat actors had control of those very same IT systems.\"<\/p>Martin Jartelius, CSO, Outpost24<\/cite><\/blockquote><\/figure>\n\n\n\n

Taking back control <\/strong><\/p>\n\n\n\n

US government officials are currently working with Colonial to help it recover while scrambling to avoid more severe fuel supply disruptions should the outage continue. Whether the pipeline stays shut that long in turn depends on how deeply the hackers penetrated Colonial\u2019s network - and how soon cybersecurity experts can pull them out.<\/p>\n\n\n\n

\"As so many times before when talking about ransomware \u2013 to lock a system with ransomware you need a good degree of control of that system,\" says Martin Jartelius, CSO at Outpost24. \"While this is indeed a financial disaster, and will have a significant impact on many, let us also consider that this means that, at least for a time, threat actors had control of those very same IT systems. Preventive security, as well as segmentation, are critical for those kinds of environments.\"<\/p>\n\n\n\n

\"One thing to note here is that ransomware has to announce itself to be successful,\" adds Tim Erlin, VP at Tripwire. \"In industrial environments, cyber events aren\u2019t always this visible. Increasing visibility into industrial networks becomes more important as attackers continue to target critical infrastructure.\u201d<\/p>\n\n\n\n

Brad Brooks, CEO and President of OneLogin, rightfully concludes: \"This attack represents just how quickly the stakes are escalating on Cybersecurity, with controlling and knowing who has access to your IT systems a board level priority for every company. We are moving from an invisible Cold War that was focused on stealing data to a highly visible hot war that has real implications for physical property and people\u2019s lives.\u201d<\/p>\n","post_title":"Ransomware roundtable | A threat in the pipeline","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"ransomware-roundtable-a-threat-in-the-pipeline","to_ping":"","pinged":"","post_modified":"2021-05-10 18:12:55","post_modified_gmt":"2021-05-10 17:12:55","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=6024","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4871,"post_author":"3","post_date":"2021-02-09 19:22:22","post_date_gmt":"2021-02-09 19:22:22","post_content":"Detectives assigned to the Digital Forensics Unit at Pinellas County Sheriff\u2019s Office are investigating an unlawful computer software intrusion at the City of Oldsmar\u2019s water treatment plant. While the cyber attack was unsuccessful, it does highlight the need for cybersecurity tools in critical infrastructure applications.\n\nOn Friday, February 5, 2021, the Pinellas County Sheriff\u2019s Office was notified by the City of Oldsmar that its computer system had been remotely accessed at 8:00am and 1:30pm by an unknown suspect. According to detectives, the City of Oldsmar\u2019s computer system at the water treatment plant allows for remote access by authorised users to troubleshoot any system problems from other locations.\n\nThe initial intrusion was brief and not cause for concern due to supervisors regularly accessing the system remotely to monitor the system. At 1:30, a plant operator witnessed a second remote access user opening various functions in the system that control the amount of sodium hydroxide in the water. The operator noted the remote access user raised the levels of sodium hydroxide in the water from 100 parts per million to 11,100 parts per million. The operator immediately reduced the levels to their appropriate amount. Sodium hydroxide is used in small amounts to control acidity, but a large amount could have caused major problems in the water.\n\nThe initial investigation revealed that the hacker remotely accessed the treatment plant\u2019s computer for approximately 3 to 5 minutes. Speaking at a press conference about the cyber attack, Sheriff Bob Gualtieri stated: \u201cAt no time was there a significant effect on the water being treated, and more importantly the public was never in danger.\u201d\n\nCommenting on the attack, Andrea Carcano, co-founder at Nozomi Networks stated: \u201cUnfortunately, this attack plays into a troubling trend we\u2019ve been following over the last year. As the pandemic forced critical infrastructure organisations to quickly shift to remote access options to keep systems up and running, we\u2019ve seen threats rise and bad actors reach new lows \u2013 setting their sights on life threatening targets. Fortunately, in this case, operators monitoring Oldsmar\u2019s treatment plant spotted the attack and were able to respond before anyone could be harmed. But it\u2019s a stark reminder that with limited cybersecurity resources and few regulations water utilities are vulnerable to attack. When it comes critical infrastructure, operational resilience must a top priority and advances in AI-powered OT security and network monitoring are available to give operators the network visibility they need to quickly spot trouble and respond before harm is done.\u201d\n\n\u201cThis targeted attack appears to have started by the \u2018bad actor\u2019 getting access to a vulnerable network\/system and working their way through the network trying to find the next weak access point while gathering data and understanding how the organisation operates along the way,\u201d added Niamh Muldoon, Global Data Protection Officer at OneLogin. \u201cIn this instance, understanding the information assets, applying not only MFA but enhanced multi-factor authentication, would have reduced the risk of this unauthorised attack materializing. It\u2019s a critical part of the MFA policy to enforce time limits for end-users and their trusted devices to re-authenticate, requiring them not only to validate themselves but also the identity of the device trying to access critical systems\/applications and the network. Without knowing more of the details, applying enhanced MFA to the execution of critical actions particularly for IT and systems administrators would have reduced the associated risk further. Having logging in place, and understanding logged events would support with the associated monitoring and alerting events. After the event has happened, crisis management is critical for successfully managing the attack response to reduce business impact and consequences, and it appears the Florida agency has done that.\u201d\n\n\u201cWhile this incident will rightfully cause concern, it appears that likelihood of real damage was minimal due to the fail safes in place,\u201d observes Tim Erlin, VP at Tripwire. \u201cThere are real impacts to be worried about, and actions to be taken, but this doesn\u2019t appear to be a sophisticated or novel attack. From a cybersecurity standpoint, we should be particularly concerned about how the attacker was able to authenticate into the remote access software. That entry point should be very well protected, given that it provides access to such obviously sensitive capabilities. Protecting remote access into industrial systems where these types of changes can be made should be a high priority for any industrial environment.\u201d\n\nLocal, State, and Federal investigators are working together to identify those responsible and the investigation is ongoing. Other utility providers have been informed of the intrusion, so they can take their own protective measures.","post_title":"Florida water system cyber attack highlights role of cybersecurity in critical infrastructure","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"florida-water-system-cyber-attack-highlights-role-of-cybersecurity-in-critical-infrastructure","to_ping":"","pinged":"","post_modified":"2021-02-09 19:22:25","post_modified_gmt":"2021-02-09 19:22:25","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4871","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4178,"post_author":"3","post_date":"2020-12-07 14:52:36","post_date_gmt":"2020-12-07 14:52:36","post_content":"Nozomi Networks and Chinook Systems have partnered to provide advanced cybersecurity solutions to protect industrial and critical infrastructure facilities across North America. Under the deal, Chinook will offer Nozomi Networks\u2019 complete portfolio of OT and IoT security solutions.\n\n\u201cFacilities that fully leverage their OT systems deliver tremendous returns when it comes to energy and operational savings, the safety and comfort of occupants and lower total cost of ownership,\u201d said Chinook\u2019s President, Wanda Lenkewich. \u201cAt the same time, the network connectivity that enables these systems, also introduces new and growing cyber threats. Partnering with Nozomi Networks allows Chinook to support clients with an integrated, comprehensive cybersecurity solution that ensures cyber threats are actively discovered, monitored and managed.\u201d\n\n\u201cWe are absolutely delighted to team with Chinook to help industrial and critical infrastructure facilities meet new requirements for secure connectivity across OT, IT and IoT networks,\u201d said Chet Namboodri, Vice President, Worldwide Business Development and Channel Sales at Nozomi. \u201cWe\u2019ve already worked together to deliver on a number of joint customer engagements in both the government and commercial sectors. Partnering with Chinook accelerates our joint efforts to make sure facility-related control and building management systems are safe from cyber threats.\u201d\n\nwww.nozominetworks.com<\/a>\n\nwww.chinooksystems.com<\/a>\n\n ","post_title":"Nozomi Networks and Chinook Systems partner for OT and IoT security solutions","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"nozomi-networks-and-chinook-systems-partner-for-ot-and-iot-security-solutions","to_ping":"","pinged":"","post_modified":"2020-12-07 14:52:40","post_modified_gmt":"2020-12-07 14:52:40","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4178","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4140,"post_author":"3","post_date":"2020-12-03 11:07:21","post_date_gmt":"2020-12-03 11:07:21","post_content":"Civil Nuclear Constabulary (CNC) police officers based at Harwell have launched Project Servator a collaborative community approach to policing. Project Servator aims to disrupt a range of criminal activity, including terrorism, while providing a reassuring presence for the public.\n\nCNC\u2019s officers are experienced and specially trained to spot the tell-tale signs that someone is planning or preparing to commit an illegal act. It works with other police forces, local businesses and the public to protect the Harwell site and the surrounding area and everyone who lives, works or visits there and to make it a difficult place for terrorists and other criminals to operate. Project Servator has been successful in gathering intelligence that has assisted Counter Terrorism Units across the UK in investigating and preventing acts of terror.\n\nProject Servator\u2019s patrols are highly visible and can happen at any time and in any location. Officers will talk to the public and local businesses to let them know what they\u2019re doing and remind them to be vigilant, trust their instincts and report any suspicious or unusual behaviour.\n\n\u201cWe are deploying these additional tactics to further complement the operational activity that exists in and around our Operational Policing Units,\u201d explained Supt Donna Jones, who is leading on the implementation of the project across the Constabulary. \u201cOur aim is to build upon relationships with partners as well as businesses and communities. These tactics are not new but allow us to have a focus on community engagement and encourage people to be our extra eyes and ears. This is not restricted to the Harwell site but also extends to the surrounding area. We are aware of the vast amount of information members of our community have and they are aware of what is out of the ordinary. All we ask is that they report any suspicions to us and we\u2019ll do the rest. The deployments will be unpredictable and our tactics will vary from one deployment to the next. The aim is to work with our local communities to deter any hostile threat.\u201d\n\nwww.gov.uk\/government\/organisations\/civil-nuclear-constabulary<\/a>","post_title":"CNC Harwell launches Project Servator","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"cnc-harwell-launches-project-servator","to_ping":"","pinged":"","post_modified":"2020-12-03 11:07:23","post_modified_gmt":"2020-12-03 11:07:23","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4140","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4102,"post_author":"3","post_date":"2020-11-30 17:30:23","post_date_gmt":"2020-11-30 17:30:23","post_content":"Radiflow and Mitsubishi Electric UK are collaborating to address the needs of IEC62443 cyber security standards in the Critical Infrastructure and Industrial Automation markets. The companys believe that the combination of the automation knowledge and tools of Mitsubishi Electric UK with the cyber security and IEC 62443 compliance skills of Radiflow will provide a holistic view of a client\u2019s risk posture.\n\nRadiflow will also provide Mitsubishi Electric UK customers with a consultancy service for cyber security, which includes the provision of OT security risk assessments, provision of Radiflow intrusion detection software and general advice on alignment with IEC 62443-3. In addition, the solution is intended to help customers to support asset owners in satisfying the requirements of the NIS Directive along with due diligence in alignment with CPNI (Centre for the Protection of National Infrastructure) best practice.\n\n\u201cOur new collaboration with Radiflow provides expertise in the field of OT cyber security which compliments and broadens the services that we offer our customers through the Mitsubishi Electric UK System Service Operation,\u201d said David Bean, Solutions Manager for Mitsubishi Electric UK. \u201cThere is a growing demand for solutions that address the requirements of cyber security in the OT space and we are looking forward to delivering those solutions and building our relationship further with the team at Radiflow.\u201d\n\n\u201cRadiflow sees huge value for OT organisations to have cyber security services and solutions aligned with their automation systems,\u201d added Ilan Barda, Founder and CEO of Radiflow. \u201cBy combining the automation knowledge and tools of Mitsubishi with the OT cyber security skills and tools of Radiflow, we are able to provide a holistic view of an organisation\u2019s OT risk posture.\u201d\n\nwww.radiflow.com<\/a>","post_title":"Radiflow and Mitsubishi Electric UK collaborate on cyber security standards","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"radiflow-and-mitsubishi-electric-uk-collaborate-on-cyber-security-standards","to_ping":"","pinged":"","post_modified":"2020-11-30 17:30:25","post_modified_gmt":"2020-11-30 17:30:25","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4102","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":3359,"post_author":"3","post_date":"2020-10-16 17:11:16","post_date_gmt":"2020-10-16 16:11:16","post_content":"Senstar explains how its products can be applied to protect the full range of upstream, midstream, and downstream facilities in the oil and gas industry.","post_title":"Senstar explains its security solutions for oil and gas","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"senstar-explains-its-security-solutions-for-oil-and-gas","to_ping":"","pinged":"","post_modified":"2020-10-16 17:11:17","post_modified_gmt":"2020-10-16 16:11:17","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=3359","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"}],"next":false,"prev":false,"total_page":1},"paged":1,"column_class":"jeg_col_2o3","class":"epic_block_14"};

\n

A major disruption<\/strong><\/p>\n\n\n\n

In response to this substantial attack, Lewis Jones, Threat Intelligence Analyst at Talion says: \u201cThis appears to be one of the most disruptive ransomware attacks ever reported, highlighting the vulnerabilities in the energy sector and why it is often targeted by attackers. A long term ransomware negotiation within the energy sector could cause mass disruption and means that the likelihood of payment is increased. <\/p>\n\n\n\n

\"The fact that US government has quickly issued emergency legislation to relax rules on road fuel transportation highlights how concerning this attack is. A longer term implication of the attack could create a delay in delivery and disruption of the supply chain. This would cause an increase in price at a time when the economy is already fragile due to the current pandemic.\" <\/p>\n\n\n\n

Computer security service, Digital Shadows has claimed that the Colonial attack was indeed helped by the coronavirus pandemic, with more engineers remotely accessing control systems for the pipeline from home. James Chappell, Co-Founder of Digital Shadows, said DarkSide could have bought account login details for remote desktop software such as TeamViewer and Microsoft Remote Desktop.<\/p>\n\n\n\n

\"We're seeing a lot of victims now, this is seriously a big problem,\" said Chappell in a statement. \"The amount of small businesses that are falling victim <\/a>to this. It's becoming a big problem for the economy globally.\"<\/p>\n\n\n\n

\"Cybercriminals don\u2019t really care how important your business is, only how much money they might extract from you,\" comments Tim Mackey Principal Security Strategist at the Synopsys CyRC (Cybersecurity Research Centre). \"This trend can be seen with increasing attacks on municipalities, healthcare systems, and elements of critical infrastructure. Each of these organisations will bring in law enforcement, yet attackers continue to be aggressive in their activities. <\/p>\n\n\n\n

\"While Colonial Pipeline is a US operation, attacks are global in scope. And despite warnings from officials like the US Treasury Department highlighting how ransomware payments are used to fund future criminal activities, victims are often faced with the difficult decision of whether to pay the ransom.\"<\/p>\n\n\n\n

\"The Colonial Pipeline attack reinforces the need to update legacy systems running today\u2019s critical infrastructure networks...\"<\/p>Lior Div, CEO and Co-founder, Cybereason<\/cite><\/blockquote><\/figure>\n\n\n\n

Remaining critical <\/strong><\/p>\n\n\n\n

\u201cThese \u2018Cyber Physical\u2019 attacks are a big deal, because they demonstrate just how fragile the provision of critical services are into society,\" says Andy Norton European Cyber Risk Officer at Armis. \"A few weeks ago a water treatment plant<\/a> was compromised leading to the potential for poisoning of the water. Now, 45% of the US oil energy provision has been switched off to the East coast. Prolonged shortages in critical services lead to civil unrest, economic pressures, and a general lack of confidence in public administration.\" <\/p>\n\n\n\n

Lior Div, CEO and Co-founder of Cybereason also comments: \"The SolarWinds<\/a> and Microsoft Exchange Server<\/a> attacks were unparalleled in their scope, successfully infiltrating and compromising virtually every US government agency and a wide array of medium and large private sector companies. The Colonial Pipeline attack reinforces the need to update legacy systems running today\u2019s critical infrastructure networks.<\/p>\n\n\n\n

\"If the public and private sectors can work together to solve complex cybersecurity issues, and at the same time accurately identify the threat actors and bring them to account for their actions, it will go a long way in reversing the adversary advantage and enable defenders to retake the high ground. There is also another significant opportunity here as well to cooperate on a global scale to develop extradition laws that enable cyber crimes and cyber espionage to be prosecuted more effectively.\u201d<\/p>\n\n\n\n

Mackey agrees, stating: \"Avoiding becoming a victim of ransomware requires organisations to have a comprehensive cybersecurity plan in place that fully captures the risks of each software component, its role and lifecycle, and its deployment configuration and usage assumptions. Armed with this basic information, and an exhaustive inventory, it becomes possible to determine how each component might play a role in an attempted ransomware attack. <\/p>\n\n\n\n

\"An effort like the one impacting Colonial Pipeline is likely the result of multiple weaknesses in process and cyber-defences that were ultimately successfully exploited. With the age of some industrial software systems far exceeding that of commercial software, it\u2019s likely that older software wasn\u2019t designed to limit exposure to modern threats like ransomware attacks. <\/p>\n\n\n\n

\"While the age of the software has limited impact on its serviceability, threat models and defensive protections need to keep pace with new threats \u2013 something that can only be done if all weaknesses present in each component are known and accounted for. After all, if a criminal can identify your weaknesses faster than you can, luck is rarely on your side.\u201d<\/p>\n\n\n\n

\"While this is indeed a financial disaster, and will have a significant impact on many, let us also consider that this means that, at least for a time, threat actors had control of those very same IT systems.\"<\/p>Martin Jartelius, CSO, Outpost24<\/cite><\/blockquote><\/figure>\n\n\n\n

Taking back control <\/strong><\/p>\n\n\n\n

US government officials are currently working with Colonial to help it recover while scrambling to avoid more severe fuel supply disruptions should the outage continue. Whether the pipeline stays shut that long in turn depends on how deeply the hackers penetrated Colonial\u2019s network - and how soon cybersecurity experts can pull them out.<\/p>\n\n\n\n

\"As so many times before when talking about ransomware \u2013 to lock a system with ransomware you need a good degree of control of that system,\" says Martin Jartelius, CSO at Outpost24. \"While this is indeed a financial disaster, and will have a significant impact on many, let us also consider that this means that, at least for a time, threat actors had control of those very same IT systems. Preventive security, as well as segmentation, are critical for those kinds of environments.\"<\/p>\n\n\n\n

\"One thing to note here is that ransomware has to announce itself to be successful,\" adds Tim Erlin, VP at Tripwire. \"In industrial environments, cyber events aren\u2019t always this visible. Increasing visibility into industrial networks becomes more important as attackers continue to target critical infrastructure.\u201d<\/p>\n\n\n\n

Brad Brooks, CEO and President of OneLogin, rightfully concludes: \"This attack represents just how quickly the stakes are escalating on Cybersecurity, with controlling and knowing who has access to your IT systems a board level priority for every company. We are moving from an invisible Cold War that was focused on stealing data to a highly visible hot war that has real implications for physical property and people\u2019s lives.\u201d<\/p>\n","post_title":"Ransomware roundtable | A threat in the pipeline","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"ransomware-roundtable-a-threat-in-the-pipeline","to_ping":"","pinged":"","post_modified":"2021-05-10 18:12:55","post_modified_gmt":"2021-05-10 17:12:55","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=6024","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4871,"post_author":"3","post_date":"2021-02-09 19:22:22","post_date_gmt":"2021-02-09 19:22:22","post_content":"Detectives assigned to the Digital Forensics Unit at Pinellas County Sheriff\u2019s Office are investigating an unlawful computer software intrusion at the City of Oldsmar\u2019s water treatment plant. While the cyber attack was unsuccessful, it does highlight the need for cybersecurity tools in critical infrastructure applications.\n\nOn Friday, February 5, 2021, the Pinellas County Sheriff\u2019s Office was notified by the City of Oldsmar that its computer system had been remotely accessed at 8:00am and 1:30pm by an unknown suspect. According to detectives, the City of Oldsmar\u2019s computer system at the water treatment plant allows for remote access by authorised users to troubleshoot any system problems from other locations.\n\nThe initial intrusion was brief and not cause for concern due to supervisors regularly accessing the system remotely to monitor the system. At 1:30, a plant operator witnessed a second remote access user opening various functions in the system that control the amount of sodium hydroxide in the water. The operator noted the remote access user raised the levels of sodium hydroxide in the water from 100 parts per million to 11,100 parts per million. The operator immediately reduced the levels to their appropriate amount. Sodium hydroxide is used in small amounts to control acidity, but a large amount could have caused major problems in the water.\n\nThe initial investigation revealed that the hacker remotely accessed the treatment plant\u2019s computer for approximately 3 to 5 minutes. Speaking at a press conference about the cyber attack, Sheriff Bob Gualtieri stated: \u201cAt no time was there a significant effect on the water being treated, and more importantly the public was never in danger.\u201d\n\nCommenting on the attack, Andrea Carcano, co-founder at Nozomi Networks stated: \u201cUnfortunately, this attack plays into a troubling trend we\u2019ve been following over the last year. As the pandemic forced critical infrastructure organisations to quickly shift to remote access options to keep systems up and running, we\u2019ve seen threats rise and bad actors reach new lows \u2013 setting their sights on life threatening targets. Fortunately, in this case, operators monitoring Oldsmar\u2019s treatment plant spotted the attack and were able to respond before anyone could be harmed. But it\u2019s a stark reminder that with limited cybersecurity resources and few regulations water utilities are vulnerable to attack. When it comes critical infrastructure, operational resilience must a top priority and advances in AI-powered OT security and network monitoring are available to give operators the network visibility they need to quickly spot trouble and respond before harm is done.\u201d\n\n\u201cThis targeted attack appears to have started by the \u2018bad actor\u2019 getting access to a vulnerable network\/system and working their way through the network trying to find the next weak access point while gathering data and understanding how the organisation operates along the way,\u201d added Niamh Muldoon, Global Data Protection Officer at OneLogin. \u201cIn this instance, understanding the information assets, applying not only MFA but enhanced multi-factor authentication, would have reduced the risk of this unauthorised attack materializing. It\u2019s a critical part of the MFA policy to enforce time limits for end-users and their trusted devices to re-authenticate, requiring them not only to validate themselves but also the identity of the device trying to access critical systems\/applications and the network. Without knowing more of the details, applying enhanced MFA to the execution of critical actions particularly for IT and systems administrators would have reduced the associated risk further. Having logging in place, and understanding logged events would support with the associated monitoring and alerting events. After the event has happened, crisis management is critical for successfully managing the attack response to reduce business impact and consequences, and it appears the Florida agency has done that.\u201d\n\n\u201cWhile this incident will rightfully cause concern, it appears that likelihood of real damage was minimal due to the fail safes in place,\u201d observes Tim Erlin, VP at Tripwire. \u201cThere are real impacts to be worried about, and actions to be taken, but this doesn\u2019t appear to be a sophisticated or novel attack. From a cybersecurity standpoint, we should be particularly concerned about how the attacker was able to authenticate into the remote access software. That entry point should be very well protected, given that it provides access to such obviously sensitive capabilities. Protecting remote access into industrial systems where these types of changes can be made should be a high priority for any industrial environment.\u201d\n\nLocal, State, and Federal investigators are working together to identify those responsible and the investigation is ongoing. Other utility providers have been informed of the intrusion, so they can take their own protective measures.","post_title":"Florida water system cyber attack highlights role of cybersecurity in critical infrastructure","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"florida-water-system-cyber-attack-highlights-role-of-cybersecurity-in-critical-infrastructure","to_ping":"","pinged":"","post_modified":"2021-02-09 19:22:25","post_modified_gmt":"2021-02-09 19:22:25","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4871","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4178,"post_author":"3","post_date":"2020-12-07 14:52:36","post_date_gmt":"2020-12-07 14:52:36","post_content":"Nozomi Networks and Chinook Systems have partnered to provide advanced cybersecurity solutions to protect industrial and critical infrastructure facilities across North America. Under the deal, Chinook will offer Nozomi Networks\u2019 complete portfolio of OT and IoT security solutions.\n\n\u201cFacilities that fully leverage their OT systems deliver tremendous returns when it comes to energy and operational savings, the safety and comfort of occupants and lower total cost of ownership,\u201d said Chinook\u2019s President, Wanda Lenkewich. \u201cAt the same time, the network connectivity that enables these systems, also introduces new and growing cyber threats. Partnering with Nozomi Networks allows Chinook to support clients with an integrated, comprehensive cybersecurity solution that ensures cyber threats are actively discovered, monitored and managed.\u201d\n\n\u201cWe are absolutely delighted to team with Chinook to help industrial and critical infrastructure facilities meet new requirements for secure connectivity across OT, IT and IoT networks,\u201d said Chet Namboodri, Vice President, Worldwide Business Development and Channel Sales at Nozomi. \u201cWe\u2019ve already worked together to deliver on a number of joint customer engagements in both the government and commercial sectors. Partnering with Chinook accelerates our joint efforts to make sure facility-related control and building management systems are safe from cyber threats.\u201d\n\nwww.nozominetworks.com<\/a>\n\nwww.chinooksystems.com<\/a>\n\n ","post_title":"Nozomi Networks and Chinook Systems partner for OT and IoT security solutions","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"nozomi-networks-and-chinook-systems-partner-for-ot-and-iot-security-solutions","to_ping":"","pinged":"","post_modified":"2020-12-07 14:52:40","post_modified_gmt":"2020-12-07 14:52:40","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4178","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4140,"post_author":"3","post_date":"2020-12-03 11:07:21","post_date_gmt":"2020-12-03 11:07:21","post_content":"Civil Nuclear Constabulary (CNC) police officers based at Harwell have launched Project Servator a collaborative community approach to policing. Project Servator aims to disrupt a range of criminal activity, including terrorism, while providing a reassuring presence for the public.\n\nCNC\u2019s officers are experienced and specially trained to spot the tell-tale signs that someone is planning or preparing to commit an illegal act. It works with other police forces, local businesses and the public to protect the Harwell site and the surrounding area and everyone who lives, works or visits there and to make it a difficult place for terrorists and other criminals to operate. Project Servator has been successful in gathering intelligence that has assisted Counter Terrorism Units across the UK in investigating and preventing acts of terror.\n\nProject Servator\u2019s patrols are highly visible and can happen at any time and in any location. Officers will talk to the public and local businesses to let them know what they\u2019re doing and remind them to be vigilant, trust their instincts and report any suspicious or unusual behaviour.\n\n\u201cWe are deploying these additional tactics to further complement the operational activity that exists in and around our Operational Policing Units,\u201d explained Supt Donna Jones, who is leading on the implementation of the project across the Constabulary. \u201cOur aim is to build upon relationships with partners as well as businesses and communities. These tactics are not new but allow us to have a focus on community engagement and encourage people to be our extra eyes and ears. This is not restricted to the Harwell site but also extends to the surrounding area. We are aware of the vast amount of information members of our community have and they are aware of what is out of the ordinary. All we ask is that they report any suspicions to us and we\u2019ll do the rest. The deployments will be unpredictable and our tactics will vary from one deployment to the next. The aim is to work with our local communities to deter any hostile threat.\u201d\n\nwww.gov.uk\/government\/organisations\/civil-nuclear-constabulary<\/a>","post_title":"CNC Harwell launches Project Servator","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"cnc-harwell-launches-project-servator","to_ping":"","pinged":"","post_modified":"2020-12-03 11:07:23","post_modified_gmt":"2020-12-03 11:07:23","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4140","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4102,"post_author":"3","post_date":"2020-11-30 17:30:23","post_date_gmt":"2020-11-30 17:30:23","post_content":"Radiflow and Mitsubishi Electric UK are collaborating to address the needs of IEC62443 cyber security standards in the Critical Infrastructure and Industrial Automation markets. The companys believe that the combination of the automation knowledge and tools of Mitsubishi Electric UK with the cyber security and IEC 62443 compliance skills of Radiflow will provide a holistic view of a client\u2019s risk posture.\n\nRadiflow will also provide Mitsubishi Electric UK customers with a consultancy service for cyber security, which includes the provision of OT security risk assessments, provision of Radiflow intrusion detection software and general advice on alignment with IEC 62443-3. In addition, the solution is intended to help customers to support asset owners in satisfying the requirements of the NIS Directive along with due diligence in alignment with CPNI (Centre for the Protection of National Infrastructure) best practice.\n\n\u201cOur new collaboration with Radiflow provides expertise in the field of OT cyber security which compliments and broadens the services that we offer our customers through the Mitsubishi Electric UK System Service Operation,\u201d said David Bean, Solutions Manager for Mitsubishi Electric UK. \u201cThere is a growing demand for solutions that address the requirements of cyber security in the OT space and we are looking forward to delivering those solutions and building our relationship further with the team at Radiflow.\u201d\n\n\u201cRadiflow sees huge value for OT organisations to have cyber security services and solutions aligned with their automation systems,\u201d added Ilan Barda, Founder and CEO of Radiflow. \u201cBy combining the automation knowledge and tools of Mitsubishi with the OT cyber security skills and tools of Radiflow, we are able to provide a holistic view of an organisation\u2019s OT risk posture.\u201d\n\nwww.radiflow.com<\/a>","post_title":"Radiflow and Mitsubishi Electric UK collaborate on cyber security standards","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"radiflow-and-mitsubishi-electric-uk-collaborate-on-cyber-security-standards","to_ping":"","pinged":"","post_modified":"2020-11-30 17:30:25","post_modified_gmt":"2020-11-30 17:30:25","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4102","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":3359,"post_author":"3","post_date":"2020-10-16 17:11:16","post_date_gmt":"2020-10-16 16:11:16","post_content":"Senstar explains how its products can be applied to protect the full range of upstream, midstream, and downstream facilities in the oil and gas industry.","post_title":"Senstar explains its security solutions for oil and gas","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"senstar-explains-its-security-solutions-for-oil-and-gas","to_ping":"","pinged":"","post_modified":"2020-10-16 17:11:17","post_modified_gmt":"2020-10-16 16:11:17","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=3359","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"}],"next":false,"prev":false,"total_page":1},"paged":1,"column_class":"jeg_col_2o3","class":"epic_block_14"};

\n

\"The fact that the US government has quickly issued emergency legislation to relax rules on road fuel transportation highlights how concerning this attack is...\"<\/p>Lewis Jones, Threat Intelligence Analyst, Talion<\/cite><\/blockquote><\/figure>\n\n\n\n

A major disruption<\/strong><\/p>\n\n\n\n

In response to this substantial attack, Lewis Jones, Threat Intelligence Analyst at Talion says: \u201cThis appears to be one of the most disruptive ransomware attacks ever reported, highlighting the vulnerabilities in the energy sector and why it is often targeted by attackers. A long term ransomware negotiation within the energy sector could cause mass disruption and means that the likelihood of payment is increased. <\/p>\n\n\n\n

\"The fact that US government has quickly issued emergency legislation to relax rules on road fuel transportation highlights how concerning this attack is. A longer term implication of the attack could create a delay in delivery and disruption of the supply chain. This would cause an increase in price at a time when the economy is already fragile due to the current pandemic.\" <\/p>\n\n\n\n

Computer security service, Digital Shadows has claimed that the Colonial attack was indeed helped by the coronavirus pandemic, with more engineers remotely accessing control systems for the pipeline from home. James Chappell, Co-Founder of Digital Shadows, said DarkSide could have bought account login details for remote desktop software such as TeamViewer and Microsoft Remote Desktop.<\/p>\n\n\n\n

\"We're seeing a lot of victims now, this is seriously a big problem,\" said Chappell in a statement. \"The amount of small businesses that are falling victim <\/a>to this. It's becoming a big problem for the economy globally.\"<\/p>\n\n\n\n

\"Cybercriminals don\u2019t really care how important your business is, only how much money they might extract from you,\" comments Tim Mackey Principal Security Strategist at the Synopsys CyRC (Cybersecurity Research Centre). \"This trend can be seen with increasing attacks on municipalities, healthcare systems, and elements of critical infrastructure. Each of these organisations will bring in law enforcement, yet attackers continue to be aggressive in their activities. <\/p>\n\n\n\n

\"While Colonial Pipeline is a US operation, attacks are global in scope. And despite warnings from officials like the US Treasury Department highlighting how ransomware payments are used to fund future criminal activities, victims are often faced with the difficult decision of whether to pay the ransom.\"<\/p>\n\n\n\n

\"The Colonial Pipeline attack reinforces the need to update legacy systems running today\u2019s critical infrastructure networks...\"<\/p>Lior Div, CEO and Co-founder, Cybereason<\/cite><\/blockquote><\/figure>\n\n\n\n

Remaining critical <\/strong><\/p>\n\n\n\n

\u201cThese \u2018Cyber Physical\u2019 attacks are a big deal, because they demonstrate just how fragile the provision of critical services are into society,\" says Andy Norton European Cyber Risk Officer at Armis. \"A few weeks ago a water treatment plant<\/a> was compromised leading to the potential for poisoning of the water. Now, 45% of the US oil energy provision has been switched off to the East coast. Prolonged shortages in critical services lead to civil unrest, economic pressures, and a general lack of confidence in public administration.\" <\/p>\n\n\n\n

Lior Div, CEO and Co-founder of Cybereason also comments: \"The SolarWinds<\/a> and Microsoft Exchange Server<\/a> attacks were unparalleled in their scope, successfully infiltrating and compromising virtually every US government agency and a wide array of medium and large private sector companies. The Colonial Pipeline attack reinforces the need to update legacy systems running today\u2019s critical infrastructure networks.<\/p>\n\n\n\n

\"If the public and private sectors can work together to solve complex cybersecurity issues, and at the same time accurately identify the threat actors and bring them to account for their actions, it will go a long way in reversing the adversary advantage and enable defenders to retake the high ground. There is also another significant opportunity here as well to cooperate on a global scale to develop extradition laws that enable cyber crimes and cyber espionage to be prosecuted more effectively.\u201d<\/p>\n\n\n\n

Mackey agrees, stating: \"Avoiding becoming a victim of ransomware requires organisations to have a comprehensive cybersecurity plan in place that fully captures the risks of each software component, its role and lifecycle, and its deployment configuration and usage assumptions. Armed with this basic information, and an exhaustive inventory, it becomes possible to determine how each component might play a role in an attempted ransomware attack. <\/p>\n\n\n\n

\"An effort like the one impacting Colonial Pipeline is likely the result of multiple weaknesses in process and cyber-defences that were ultimately successfully exploited. With the age of some industrial software systems far exceeding that of commercial software, it\u2019s likely that older software wasn\u2019t designed to limit exposure to modern threats like ransomware attacks. <\/p>\n\n\n\n

\"While the age of the software has limited impact on its serviceability, threat models and defensive protections need to keep pace with new threats \u2013 something that can only be done if all weaknesses present in each component are known and accounted for. After all, if a criminal can identify your weaknesses faster than you can, luck is rarely on your side.\u201d<\/p>\n\n\n\n

\"While this is indeed a financial disaster, and will have a significant impact on many, let us also consider that this means that, at least for a time, threat actors had control of those very same IT systems.\"<\/p>Martin Jartelius, CSO, Outpost24<\/cite><\/blockquote><\/figure>\n\n\n\n

Taking back control <\/strong><\/p>\n\n\n\n

US government officials are currently working with Colonial to help it recover while scrambling to avoid more severe fuel supply disruptions should the outage continue. Whether the pipeline stays shut that long in turn depends on how deeply the hackers penetrated Colonial\u2019s network - and how soon cybersecurity experts can pull them out.<\/p>\n\n\n\n

\"As so many times before when talking about ransomware \u2013 to lock a system with ransomware you need a good degree of control of that system,\" says Martin Jartelius, CSO at Outpost24. \"While this is indeed a financial disaster, and will have a significant impact on many, let us also consider that this means that, at least for a time, threat actors had control of those very same IT systems. Preventive security, as well as segmentation, are critical for those kinds of environments.\"<\/p>\n\n\n\n

\"One thing to note here is that ransomware has to announce itself to be successful,\" adds Tim Erlin, VP at Tripwire. \"In industrial environments, cyber events aren\u2019t always this visible. Increasing visibility into industrial networks becomes more important as attackers continue to target critical infrastructure.\u201d<\/p>\n\n\n\n

Brad Brooks, CEO and President of OneLogin, rightfully concludes: \"This attack represents just how quickly the stakes are escalating on Cybersecurity, with controlling and knowing who has access to your IT systems a board level priority for every company. We are moving from an invisible Cold War that was focused on stealing data to a highly visible hot war that has real implications for physical property and people\u2019s lives.\u201d<\/p>\n","post_title":"Ransomware roundtable | A threat in the pipeline","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"ransomware-roundtable-a-threat-in-the-pipeline","to_ping":"","pinged":"","post_modified":"2021-05-10 18:12:55","post_modified_gmt":"2021-05-10 17:12:55","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=6024","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4871,"post_author":"3","post_date":"2021-02-09 19:22:22","post_date_gmt":"2021-02-09 19:22:22","post_content":"Detectives assigned to the Digital Forensics Unit at Pinellas County Sheriff\u2019s Office are investigating an unlawful computer software intrusion at the City of Oldsmar\u2019s water treatment plant. While the cyber attack was unsuccessful, it does highlight the need for cybersecurity tools in critical infrastructure applications.\n\nOn Friday, February 5, 2021, the Pinellas County Sheriff\u2019s Office was notified by the City of Oldsmar that its computer system had been remotely accessed at 8:00am and 1:30pm by an unknown suspect. According to detectives, the City of Oldsmar\u2019s computer system at the water treatment plant allows for remote access by authorised users to troubleshoot any system problems from other locations.\n\nThe initial intrusion was brief and not cause for concern due to supervisors regularly accessing the system remotely to monitor the system. At 1:30, a plant operator witnessed a second remote access user opening various functions in the system that control the amount of sodium hydroxide in the water. The operator noted the remote access user raised the levels of sodium hydroxide in the water from 100 parts per million to 11,100 parts per million. The operator immediately reduced the levels to their appropriate amount. Sodium hydroxide is used in small amounts to control acidity, but a large amount could have caused major problems in the water.\n\nThe initial investigation revealed that the hacker remotely accessed the treatment plant\u2019s computer for approximately 3 to 5 minutes. Speaking at a press conference about the cyber attack, Sheriff Bob Gualtieri stated: \u201cAt no time was there a significant effect on the water being treated, and more importantly the public was never in danger.\u201d\n\nCommenting on the attack, Andrea Carcano, co-founder at Nozomi Networks stated: \u201cUnfortunately, this attack plays into a troubling trend we\u2019ve been following over the last year. As the pandemic forced critical infrastructure organisations to quickly shift to remote access options to keep systems up and running, we\u2019ve seen threats rise and bad actors reach new lows \u2013 setting their sights on life threatening targets. Fortunately, in this case, operators monitoring Oldsmar\u2019s treatment plant spotted the attack and were able to respond before anyone could be harmed. But it\u2019s a stark reminder that with limited cybersecurity resources and few regulations water utilities are vulnerable to attack. When it comes critical infrastructure, operational resilience must a top priority and advances in AI-powered OT security and network monitoring are available to give operators the network visibility they need to quickly spot trouble and respond before harm is done.\u201d\n\n\u201cThis targeted attack appears to have started by the \u2018bad actor\u2019 getting access to a vulnerable network\/system and working their way through the network trying to find the next weak access point while gathering data and understanding how the organisation operates along the way,\u201d added Niamh Muldoon, Global Data Protection Officer at OneLogin. \u201cIn this instance, understanding the information assets, applying not only MFA but enhanced multi-factor authentication, would have reduced the risk of this unauthorised attack materializing. It\u2019s a critical part of the MFA policy to enforce time limits for end-users and their trusted devices to re-authenticate, requiring them not only to validate themselves but also the identity of the device trying to access critical systems\/applications and the network. Without knowing more of the details, applying enhanced MFA to the execution of critical actions particularly for IT and systems administrators would have reduced the associated risk further. Having logging in place, and understanding logged events would support with the associated monitoring and alerting events. After the event has happened, crisis management is critical for successfully managing the attack response to reduce business impact and consequences, and it appears the Florida agency has done that.\u201d\n\n\u201cWhile this incident will rightfully cause concern, it appears that likelihood of real damage was minimal due to the fail safes in place,\u201d observes Tim Erlin, VP at Tripwire. \u201cThere are real impacts to be worried about, and actions to be taken, but this doesn\u2019t appear to be a sophisticated or novel attack. From a cybersecurity standpoint, we should be particularly concerned about how the attacker was able to authenticate into the remote access software. That entry point should be very well protected, given that it provides access to such obviously sensitive capabilities. Protecting remote access into industrial systems where these types of changes can be made should be a high priority for any industrial environment.\u201d\n\nLocal, State, and Federal investigators are working together to identify those responsible and the investigation is ongoing. Other utility providers have been informed of the intrusion, so they can take their own protective measures.","post_title":"Florida water system cyber attack highlights role of cybersecurity in critical infrastructure","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"florida-water-system-cyber-attack-highlights-role-of-cybersecurity-in-critical-infrastructure","to_ping":"","pinged":"","post_modified":"2021-02-09 19:22:25","post_modified_gmt":"2021-02-09 19:22:25","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4871","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4178,"post_author":"3","post_date":"2020-12-07 14:52:36","post_date_gmt":"2020-12-07 14:52:36","post_content":"Nozomi Networks and Chinook Systems have partnered to provide advanced cybersecurity solutions to protect industrial and critical infrastructure facilities across North America. Under the deal, Chinook will offer Nozomi Networks\u2019 complete portfolio of OT and IoT security solutions.\n\n\u201cFacilities that fully leverage their OT systems deliver tremendous returns when it comes to energy and operational savings, the safety and comfort of occupants and lower total cost of ownership,\u201d said Chinook\u2019s President, Wanda Lenkewich. \u201cAt the same time, the network connectivity that enables these systems, also introduces new and growing cyber threats. Partnering with Nozomi Networks allows Chinook to support clients with an integrated, comprehensive cybersecurity solution that ensures cyber threats are actively discovered, monitored and managed.\u201d\n\n\u201cWe are absolutely delighted to team with Chinook to help industrial and critical infrastructure facilities meet new requirements for secure connectivity across OT, IT and IoT networks,\u201d said Chet Namboodri, Vice President, Worldwide Business Development and Channel Sales at Nozomi. \u201cWe\u2019ve already worked together to deliver on a number of joint customer engagements in both the government and commercial sectors. Partnering with Chinook accelerates our joint efforts to make sure facility-related control and building management systems are safe from cyber threats.\u201d\n\nwww.nozominetworks.com<\/a>\n\nwww.chinooksystems.com<\/a>\n\n ","post_title":"Nozomi Networks and Chinook Systems partner for OT and IoT security solutions","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"nozomi-networks-and-chinook-systems-partner-for-ot-and-iot-security-solutions","to_ping":"","pinged":"","post_modified":"2020-12-07 14:52:40","post_modified_gmt":"2020-12-07 14:52:40","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4178","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4140,"post_author":"3","post_date":"2020-12-03 11:07:21","post_date_gmt":"2020-12-03 11:07:21","post_content":"Civil Nuclear Constabulary (CNC) police officers based at Harwell have launched Project Servator a collaborative community approach to policing. Project Servator aims to disrupt a range of criminal activity, including terrorism, while providing a reassuring presence for the public.\n\nCNC\u2019s officers are experienced and specially trained to spot the tell-tale signs that someone is planning or preparing to commit an illegal act. It works with other police forces, local businesses and the public to protect the Harwell site and the surrounding area and everyone who lives, works or visits there and to make it a difficult place for terrorists and other criminals to operate. Project Servator has been successful in gathering intelligence that has assisted Counter Terrorism Units across the UK in investigating and preventing acts of terror.\n\nProject Servator\u2019s patrols are highly visible and can happen at any time and in any location. Officers will talk to the public and local businesses to let them know what they\u2019re doing and remind them to be vigilant, trust their instincts and report any suspicious or unusual behaviour.\n\n\u201cWe are deploying these additional tactics to further complement the operational activity that exists in and around our Operational Policing Units,\u201d explained Supt Donna Jones, who is leading on the implementation of the project across the Constabulary. \u201cOur aim is to build upon relationships with partners as well as businesses and communities. These tactics are not new but allow us to have a focus on community engagement and encourage people to be our extra eyes and ears. This is not restricted to the Harwell site but also extends to the surrounding area. We are aware of the vast amount of information members of our community have and they are aware of what is out of the ordinary. All we ask is that they report any suspicions to us and we\u2019ll do the rest. The deployments will be unpredictable and our tactics will vary from one deployment to the next. The aim is to work with our local communities to deter any hostile threat.\u201d\n\nwww.gov.uk\/government\/organisations\/civil-nuclear-constabulary<\/a>","post_title":"CNC Harwell launches Project Servator","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"cnc-harwell-launches-project-servator","to_ping":"","pinged":"","post_modified":"2020-12-03 11:07:23","post_modified_gmt":"2020-12-03 11:07:23","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4140","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4102,"post_author":"3","post_date":"2020-11-30 17:30:23","post_date_gmt":"2020-11-30 17:30:23","post_content":"Radiflow and Mitsubishi Electric UK are collaborating to address the needs of IEC62443 cyber security standards in the Critical Infrastructure and Industrial Automation markets. The companys believe that the combination of the automation knowledge and tools of Mitsubishi Electric UK with the cyber security and IEC 62443 compliance skills of Radiflow will provide a holistic view of a client\u2019s risk posture.\n\nRadiflow will also provide Mitsubishi Electric UK customers with a consultancy service for cyber security, which includes the provision of OT security risk assessments, provision of Radiflow intrusion detection software and general advice on alignment with IEC 62443-3. In addition, the solution is intended to help customers to support asset owners in satisfying the requirements of the NIS Directive along with due diligence in alignment with CPNI (Centre for the Protection of National Infrastructure) best practice.\n\n\u201cOur new collaboration with Radiflow provides expertise in the field of OT cyber security which compliments and broadens the services that we offer our customers through the Mitsubishi Electric UK System Service Operation,\u201d said David Bean, Solutions Manager for Mitsubishi Electric UK. \u201cThere is a growing demand for solutions that address the requirements of cyber security in the OT space and we are looking forward to delivering those solutions and building our relationship further with the team at Radiflow.\u201d\n\n\u201cRadiflow sees huge value for OT organisations to have cyber security services and solutions aligned with their automation systems,\u201d added Ilan Barda, Founder and CEO of Radiflow. \u201cBy combining the automation knowledge and tools of Mitsubishi with the OT cyber security skills and tools of Radiflow, we are able to provide a holistic view of an organisation\u2019s OT risk posture.\u201d\n\nwww.radiflow.com<\/a>","post_title":"Radiflow and Mitsubishi Electric UK collaborate on cyber security standards","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"radiflow-and-mitsubishi-electric-uk-collaborate-on-cyber-security-standards","to_ping":"","pinged":"","post_modified":"2020-11-30 17:30:25","post_modified_gmt":"2020-11-30 17:30:25","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4102","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":3359,"post_author":"3","post_date":"2020-10-16 17:11:16","post_date_gmt":"2020-10-16 16:11:16","post_content":"Senstar explains how its products can be applied to protect the full range of upstream, midstream, and downstream facilities in the oil and gas industry.","post_title":"Senstar explains its security solutions for oil and gas","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"senstar-explains-its-security-solutions-for-oil-and-gas","to_ping":"","pinged":"","post_modified":"2020-10-16 17:11:17","post_modified_gmt":"2020-10-16 16:11:17","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=3359","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"}],"next":false,"prev":false,"total_page":1},"paged":1,"column_class":"jeg_col_2o3","class":"epic_block_14"};

\n

While US fuel prices at the pump were largely unaffected on Monday, there are fears that could change if the shutdown is prolonged. <\/p>\n\n\n\n

\"The fact that the US government has quickly issued emergency legislation to relax rules on road fuel transportation highlights how concerning this attack is...\"<\/p>Lewis Jones, Threat Intelligence Analyst, Talion<\/cite><\/blockquote><\/figure>\n\n\n\n

A major disruption<\/strong><\/p>\n\n\n\n

In response to this substantial attack, Lewis Jones, Threat Intelligence Analyst at Talion says: \u201cThis appears to be one of the most disruptive ransomware attacks ever reported, highlighting the vulnerabilities in the energy sector and why it is often targeted by attackers. A long term ransomware negotiation within the energy sector could cause mass disruption and means that the likelihood of payment is increased. <\/p>\n\n\n\n

\"The fact that US government has quickly issued emergency legislation to relax rules on road fuel transportation highlights how concerning this attack is. A longer term implication of the attack could create a delay in delivery and disruption of the supply chain. This would cause an increase in price at a time when the economy is already fragile due to the current pandemic.\" <\/p>\n\n\n\n

Computer security service, Digital Shadows has claimed that the Colonial attack was indeed helped by the coronavirus pandemic, with more engineers remotely accessing control systems for the pipeline from home. James Chappell, Co-Founder of Digital Shadows, said DarkSide could have bought account login details for remote desktop software such as TeamViewer and Microsoft Remote Desktop.<\/p>\n\n\n\n

\"We're seeing a lot of victims now, this is seriously a big problem,\" said Chappell in a statement. \"The amount of small businesses that are falling victim <\/a>to this. It's becoming a big problem for the economy globally.\"<\/p>\n\n\n\n

\"Cybercriminals don\u2019t really care how important your business is, only how much money they might extract from you,\" comments Tim Mackey Principal Security Strategist at the Synopsys CyRC (Cybersecurity Research Centre). \"This trend can be seen with increasing attacks on municipalities, healthcare systems, and elements of critical infrastructure. Each of these organisations will bring in law enforcement, yet attackers continue to be aggressive in their activities. <\/p>\n\n\n\n

\"While Colonial Pipeline is a US operation, attacks are global in scope. And despite warnings from officials like the US Treasury Department highlighting how ransomware payments are used to fund future criminal activities, victims are often faced with the difficult decision of whether to pay the ransom.\"<\/p>\n\n\n\n

\"The Colonial Pipeline attack reinforces the need to update legacy systems running today\u2019s critical infrastructure networks...\"<\/p>Lior Div, CEO and Co-founder, Cybereason<\/cite><\/blockquote><\/figure>\n\n\n\n

Remaining critical <\/strong><\/p>\n\n\n\n

\u201cThese \u2018Cyber Physical\u2019 attacks are a big deal, because they demonstrate just how fragile the provision of critical services are into society,\" says Andy Norton European Cyber Risk Officer at Armis. \"A few weeks ago a water treatment plant<\/a> was compromised leading to the potential for poisoning of the water. Now, 45% of the US oil energy provision has been switched off to the East coast. Prolonged shortages in critical services lead to civil unrest, economic pressures, and a general lack of confidence in public administration.\" <\/p>\n\n\n\n

Lior Div, CEO and Co-founder of Cybereason also comments: \"The SolarWinds<\/a> and Microsoft Exchange Server<\/a> attacks were unparalleled in their scope, successfully infiltrating and compromising virtually every US government agency and a wide array of medium and large private sector companies. The Colonial Pipeline attack reinforces the need to update legacy systems running today\u2019s critical infrastructure networks.<\/p>\n\n\n\n

\"If the public and private sectors can work together to solve complex cybersecurity issues, and at the same time accurately identify the threat actors and bring them to account for their actions, it will go a long way in reversing the adversary advantage and enable defenders to retake the high ground. There is also another significant opportunity here as well to cooperate on a global scale to develop extradition laws that enable cyber crimes and cyber espionage to be prosecuted more effectively.\u201d<\/p>\n\n\n\n

Mackey agrees, stating: \"Avoiding becoming a victim of ransomware requires organisations to have a comprehensive cybersecurity plan in place that fully captures the risks of each software component, its role and lifecycle, and its deployment configuration and usage assumptions. Armed with this basic information, and an exhaustive inventory, it becomes possible to determine how each component might play a role in an attempted ransomware attack. <\/p>\n\n\n\n

\"An effort like the one impacting Colonial Pipeline is likely the result of multiple weaknesses in process and cyber-defences that were ultimately successfully exploited. With the age of some industrial software systems far exceeding that of commercial software, it\u2019s likely that older software wasn\u2019t designed to limit exposure to modern threats like ransomware attacks. <\/p>\n\n\n\n

\"While the age of the software has limited impact on its serviceability, threat models and defensive protections need to keep pace with new threats \u2013 something that can only be done if all weaknesses present in each component are known and accounted for. After all, if a criminal can identify your weaknesses faster than you can, luck is rarely on your side.\u201d<\/p>\n\n\n\n

\"While this is indeed a financial disaster, and will have a significant impact on many, let us also consider that this means that, at least for a time, threat actors had control of those very same IT systems.\"<\/p>Martin Jartelius, CSO, Outpost24<\/cite><\/blockquote><\/figure>\n\n\n\n

Taking back control <\/strong><\/p>\n\n\n\n

US government officials are currently working with Colonial to help it recover while scrambling to avoid more severe fuel supply disruptions should the outage continue. Whether the pipeline stays shut that long in turn depends on how deeply the hackers penetrated Colonial\u2019s network - and how soon cybersecurity experts can pull them out.<\/p>\n\n\n\n

\"As so many times before when talking about ransomware \u2013 to lock a system with ransomware you need a good degree of control of that system,\" says Martin Jartelius, CSO at Outpost24. \"While this is indeed a financial disaster, and will have a significant impact on many, let us also consider that this means that, at least for a time, threat actors had control of those very same IT systems. Preventive security, as well as segmentation, are critical for those kinds of environments.\"<\/p>\n\n\n\n

\"One thing to note here is that ransomware has to announce itself to be successful,\" adds Tim Erlin, VP at Tripwire. \"In industrial environments, cyber events aren\u2019t always this visible. Increasing visibility into industrial networks becomes more important as attackers continue to target critical infrastructure.\u201d<\/p>\n\n\n\n

Brad Brooks, CEO and President of OneLogin, rightfully concludes: \"This attack represents just how quickly the stakes are escalating on Cybersecurity, with controlling and knowing who has access to your IT systems a board level priority for every company. We are moving from an invisible Cold War that was focused on stealing data to a highly visible hot war that has real implications for physical property and people\u2019s lives.\u201d<\/p>\n","post_title":"Ransomware roundtable | A threat in the pipeline","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"ransomware-roundtable-a-threat-in-the-pipeline","to_ping":"","pinged":"","post_modified":"2021-05-10 18:12:55","post_modified_gmt":"2021-05-10 17:12:55","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=6024","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4871,"post_author":"3","post_date":"2021-02-09 19:22:22","post_date_gmt":"2021-02-09 19:22:22","post_content":"Detectives assigned to the Digital Forensics Unit at Pinellas County Sheriff\u2019s Office are investigating an unlawful computer software intrusion at the City of Oldsmar\u2019s water treatment plant. While the cyber attack was unsuccessful, it does highlight the need for cybersecurity tools in critical infrastructure applications.\n\nOn Friday, February 5, 2021, the Pinellas County Sheriff\u2019s Office was notified by the City of Oldsmar that its computer system had been remotely accessed at 8:00am and 1:30pm by an unknown suspect. According to detectives, the City of Oldsmar\u2019s computer system at the water treatment plant allows for remote access by authorised users to troubleshoot any system problems from other locations.\n\nThe initial intrusion was brief and not cause for concern due to supervisors regularly accessing the system remotely to monitor the system. At 1:30, a plant operator witnessed a second remote access user opening various functions in the system that control the amount of sodium hydroxide in the water. The operator noted the remote access user raised the levels of sodium hydroxide in the water from 100 parts per million to 11,100 parts per million. The operator immediately reduced the levels to their appropriate amount. Sodium hydroxide is used in small amounts to control acidity, but a large amount could have caused major problems in the water.\n\nThe initial investigation revealed that the hacker remotely accessed the treatment plant\u2019s computer for approximately 3 to 5 minutes. Speaking at a press conference about the cyber attack, Sheriff Bob Gualtieri stated: \u201cAt no time was there a significant effect on the water being treated, and more importantly the public was never in danger.\u201d\n\nCommenting on the attack, Andrea Carcano, co-founder at Nozomi Networks stated: \u201cUnfortunately, this attack plays into a troubling trend we\u2019ve been following over the last year. As the pandemic forced critical infrastructure organisations to quickly shift to remote access options to keep systems up and running, we\u2019ve seen threats rise and bad actors reach new lows \u2013 setting their sights on life threatening targets. Fortunately, in this case, operators monitoring Oldsmar\u2019s treatment plant spotted the attack and were able to respond before anyone could be harmed. But it\u2019s a stark reminder that with limited cybersecurity resources and few regulations water utilities are vulnerable to attack. When it comes critical infrastructure, operational resilience must a top priority and advances in AI-powered OT security and network monitoring are available to give operators the network visibility they need to quickly spot trouble and respond before harm is done.\u201d\n\n\u201cThis targeted attack appears to have started by the \u2018bad actor\u2019 getting access to a vulnerable network\/system and working their way through the network trying to find the next weak access point while gathering data and understanding how the organisation operates along the way,\u201d added Niamh Muldoon, Global Data Protection Officer at OneLogin. \u201cIn this instance, understanding the information assets, applying not only MFA but enhanced multi-factor authentication, would have reduced the risk of this unauthorised attack materializing. It\u2019s a critical part of the MFA policy to enforce time limits for end-users and their trusted devices to re-authenticate, requiring them not only to validate themselves but also the identity of the device trying to access critical systems\/applications and the network. Without knowing more of the details, applying enhanced MFA to the execution of critical actions particularly for IT and systems administrators would have reduced the associated risk further. Having logging in place, and understanding logged events would support with the associated monitoring and alerting events. After the event has happened, crisis management is critical for successfully managing the attack response to reduce business impact and consequences, and it appears the Florida agency has done that.\u201d\n\n\u201cWhile this incident will rightfully cause concern, it appears that likelihood of real damage was minimal due to the fail safes in place,\u201d observes Tim Erlin, VP at Tripwire. \u201cThere are real impacts to be worried about, and actions to be taken, but this doesn\u2019t appear to be a sophisticated or novel attack. From a cybersecurity standpoint, we should be particularly concerned about how the attacker was able to authenticate into the remote access software. That entry point should be very well protected, given that it provides access to such obviously sensitive capabilities. Protecting remote access into industrial systems where these types of changes can be made should be a high priority for any industrial environment.\u201d\n\nLocal, State, and Federal investigators are working together to identify those responsible and the investigation is ongoing. Other utility providers have been informed of the intrusion, so they can take their own protective measures.","post_title":"Florida water system cyber attack highlights role of cybersecurity in critical infrastructure","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"florida-water-system-cyber-attack-highlights-role-of-cybersecurity-in-critical-infrastructure","to_ping":"","pinged":"","post_modified":"2021-02-09 19:22:25","post_modified_gmt":"2021-02-09 19:22:25","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4871","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4178,"post_author":"3","post_date":"2020-12-07 14:52:36","post_date_gmt":"2020-12-07 14:52:36","post_content":"Nozomi Networks and Chinook Systems have partnered to provide advanced cybersecurity solutions to protect industrial and critical infrastructure facilities across North America. Under the deal, Chinook will offer Nozomi Networks\u2019 complete portfolio of OT and IoT security solutions.\n\n\u201cFacilities that fully leverage their OT systems deliver tremendous returns when it comes to energy and operational savings, the safety and comfort of occupants and lower total cost of ownership,\u201d said Chinook\u2019s President, Wanda Lenkewich. \u201cAt the same time, the network connectivity that enables these systems, also introduces new and growing cyber threats. Partnering with Nozomi Networks allows Chinook to support clients with an integrated, comprehensive cybersecurity solution that ensures cyber threats are actively discovered, monitored and managed.\u201d\n\n\u201cWe are absolutely delighted to team with Chinook to help industrial and critical infrastructure facilities meet new requirements for secure connectivity across OT, IT and IoT networks,\u201d said Chet Namboodri, Vice President, Worldwide Business Development and Channel Sales at Nozomi. \u201cWe\u2019ve already worked together to deliver on a number of joint customer engagements in both the government and commercial sectors. Partnering with Chinook accelerates our joint efforts to make sure facility-related control and building management systems are safe from cyber threats.\u201d\n\nwww.nozominetworks.com<\/a>\n\nwww.chinooksystems.com<\/a>\n\n ","post_title":"Nozomi Networks and Chinook Systems partner for OT and IoT security solutions","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"nozomi-networks-and-chinook-systems-partner-for-ot-and-iot-security-solutions","to_ping":"","pinged":"","post_modified":"2020-12-07 14:52:40","post_modified_gmt":"2020-12-07 14:52:40","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4178","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4140,"post_author":"3","post_date":"2020-12-03 11:07:21","post_date_gmt":"2020-12-03 11:07:21","post_content":"Civil Nuclear Constabulary (CNC) police officers based at Harwell have launched Project Servator a collaborative community approach to policing. Project Servator aims to disrupt a range of criminal activity, including terrorism, while providing a reassuring presence for the public.\n\nCNC\u2019s officers are experienced and specially trained to spot the tell-tale signs that someone is planning or preparing to commit an illegal act. It works with other police forces, local businesses and the public to protect the Harwell site and the surrounding area and everyone who lives, works or visits there and to make it a difficult place for terrorists and other criminals to operate. Project Servator has been successful in gathering intelligence that has assisted Counter Terrorism Units across the UK in investigating and preventing acts of terror.\n\nProject Servator\u2019s patrols are highly visible and can happen at any time and in any location. Officers will talk to the public and local businesses to let them know what they\u2019re doing and remind them to be vigilant, trust their instincts and report any suspicious or unusual behaviour.\n\n\u201cWe are deploying these additional tactics to further complement the operational activity that exists in and around our Operational Policing Units,\u201d explained Supt Donna Jones, who is leading on the implementation of the project across the Constabulary. \u201cOur aim is to build upon relationships with partners as well as businesses and communities. These tactics are not new but allow us to have a focus on community engagement and encourage people to be our extra eyes and ears. This is not restricted to the Harwell site but also extends to the surrounding area. We are aware of the vast amount of information members of our community have and they are aware of what is out of the ordinary. All we ask is that they report any suspicions to us and we\u2019ll do the rest. The deployments will be unpredictable and our tactics will vary from one deployment to the next. The aim is to work with our local communities to deter any hostile threat.\u201d\n\nwww.gov.uk\/government\/organisations\/civil-nuclear-constabulary<\/a>","post_title":"CNC Harwell launches Project Servator","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"cnc-harwell-launches-project-servator","to_ping":"","pinged":"","post_modified":"2020-12-03 11:07:23","post_modified_gmt":"2020-12-03 11:07:23","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4140","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4102,"post_author":"3","post_date":"2020-11-30 17:30:23","post_date_gmt":"2020-11-30 17:30:23","post_content":"Radiflow and Mitsubishi Electric UK are collaborating to address the needs of IEC62443 cyber security standards in the Critical Infrastructure and Industrial Automation markets. The companys believe that the combination of the automation knowledge and tools of Mitsubishi Electric UK with the cyber security and IEC 62443 compliance skills of Radiflow will provide a holistic view of a client\u2019s risk posture.\n\nRadiflow will also provide Mitsubishi Electric UK customers with a consultancy service for cyber security, which includes the provision of OT security risk assessments, provision of Radiflow intrusion detection software and general advice on alignment with IEC 62443-3. In addition, the solution is intended to help customers to support asset owners in satisfying the requirements of the NIS Directive along with due diligence in alignment with CPNI (Centre for the Protection of National Infrastructure) best practice.\n\n\u201cOur new collaboration with Radiflow provides expertise in the field of OT cyber security which compliments and broadens the services that we offer our customers through the Mitsubishi Electric UK System Service Operation,\u201d said David Bean, Solutions Manager for Mitsubishi Electric UK. \u201cThere is a growing demand for solutions that address the requirements of cyber security in the OT space and we are looking forward to delivering those solutions and building our relationship further with the team at Radiflow.\u201d\n\n\u201cRadiflow sees huge value for OT organisations to have cyber security services and solutions aligned with their automation systems,\u201d added Ilan Barda, Founder and CEO of Radiflow. \u201cBy combining the automation knowledge and tools of Mitsubishi with the OT cyber security skills and tools of Radiflow, we are able to provide a holistic view of an organisation\u2019s OT risk posture.\u201d\n\nwww.radiflow.com<\/a>","post_title":"Radiflow and Mitsubishi Electric UK collaborate on cyber security standards","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"radiflow-and-mitsubishi-electric-uk-collaborate-on-cyber-security-standards","to_ping":"","pinged":"","post_modified":"2020-11-30 17:30:25","post_modified_gmt":"2020-11-30 17:30:25","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4102","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":3359,"post_author":"3","post_date":"2020-10-16 17:11:16","post_date_gmt":"2020-10-16 16:11:16","post_content":"Senstar explains how its products can be applied to protect the full range of upstream, midstream, and downstream facilities in the oil and gas industry.","post_title":"Senstar explains its security solutions for oil and gas","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"senstar-explains-its-security-solutions-for-oil-and-gas","to_ping":"","pinged":"","post_modified":"2020-10-16 17:11:17","post_modified_gmt":"2020-10-16 16:11:17","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=3359","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"}],"next":false,"prev":false,"total_page":1},"paged":1,"column_class":"jeg_col_2o3","class":"epic_block_14"};

\n

On Sunday, Colonial said that although its four main pipelines remain offline, some smaller lines between terminals and delivery points were now operational. The US government has now relaxed rules on fuel being transported by road, meaning drivers in 18 states can work extra or more flexible hours when transporting refined petroleum products.<\/p>\n\n\n\n

While US fuel prices at the pump were largely unaffected on Monday, there are fears that could change if the shutdown is prolonged. <\/p>\n\n\n\n

\"The fact that the US government has quickly issued emergency legislation to relax rules on road fuel transportation highlights how concerning this attack is...\"<\/p>Lewis Jones, Threat Intelligence Analyst, Talion<\/cite><\/blockquote><\/figure>\n\n\n\n

A major disruption<\/strong><\/p>\n\n\n\n

In response to this substantial attack, Lewis Jones, Threat Intelligence Analyst at Talion says: \u201cThis appears to be one of the most disruptive ransomware attacks ever reported, highlighting the vulnerabilities in the energy sector and why it is often targeted by attackers. A long term ransomware negotiation within the energy sector could cause mass disruption and means that the likelihood of payment is increased. <\/p>\n\n\n\n

\"The fact that US government has quickly issued emergency legislation to relax rules on road fuel transportation highlights how concerning this attack is. A longer term implication of the attack could create a delay in delivery and disruption of the supply chain. This would cause an increase in price at a time when the economy is already fragile due to the current pandemic.\" <\/p>\n\n\n\n

Computer security service, Digital Shadows has claimed that the Colonial attack was indeed helped by the coronavirus pandemic, with more engineers remotely accessing control systems for the pipeline from home. James Chappell, Co-Founder of Digital Shadows, said DarkSide could have bought account login details for remote desktop software such as TeamViewer and Microsoft Remote Desktop.<\/p>\n\n\n\n

\"We're seeing a lot of victims now, this is seriously a big problem,\" said Chappell in a statement. \"The amount of small businesses that are falling victim <\/a>to this. It's becoming a big problem for the economy globally.\"<\/p>\n\n\n\n

\"Cybercriminals don\u2019t really care how important your business is, only how much money they might extract from you,\" comments Tim Mackey Principal Security Strategist at the Synopsys CyRC (Cybersecurity Research Centre). \"This trend can be seen with increasing attacks on municipalities, healthcare systems, and elements of critical infrastructure. Each of these organisations will bring in law enforcement, yet attackers continue to be aggressive in their activities. <\/p>\n\n\n\n

\"While Colonial Pipeline is a US operation, attacks are global in scope. And despite warnings from officials like the US Treasury Department highlighting how ransomware payments are used to fund future criminal activities, victims are often faced with the difficult decision of whether to pay the ransom.\"<\/p>\n\n\n\n

\"The Colonial Pipeline attack reinforces the need to update legacy systems running today\u2019s critical infrastructure networks...\"<\/p>Lior Div, CEO and Co-founder, Cybereason<\/cite><\/blockquote><\/figure>\n\n\n\n

Remaining critical <\/strong><\/p>\n\n\n\n

\u201cThese \u2018Cyber Physical\u2019 attacks are a big deal, because they demonstrate just how fragile the provision of critical services are into society,\" says Andy Norton European Cyber Risk Officer at Armis. \"A few weeks ago a water treatment plant<\/a> was compromised leading to the potential for poisoning of the water. Now, 45% of the US oil energy provision has been switched off to the East coast. Prolonged shortages in critical services lead to civil unrest, economic pressures, and a general lack of confidence in public administration.\" <\/p>\n\n\n\n

Lior Div, CEO and Co-founder of Cybereason also comments: \"The SolarWinds<\/a> and Microsoft Exchange Server<\/a> attacks were unparalleled in their scope, successfully infiltrating and compromising virtually every US government agency and a wide array of medium and large private sector companies. The Colonial Pipeline attack reinforces the need to update legacy systems running today\u2019s critical infrastructure networks.<\/p>\n\n\n\n

\"If the public and private sectors can work together to solve complex cybersecurity issues, and at the same time accurately identify the threat actors and bring them to account for their actions, it will go a long way in reversing the adversary advantage and enable defenders to retake the high ground. There is also another significant opportunity here as well to cooperate on a global scale to develop extradition laws that enable cyber crimes and cyber espionage to be prosecuted more effectively.\u201d<\/p>\n\n\n\n

Mackey agrees, stating: \"Avoiding becoming a victim of ransomware requires organisations to have a comprehensive cybersecurity plan in place that fully captures the risks of each software component, its role and lifecycle, and its deployment configuration and usage assumptions. Armed with this basic information, and an exhaustive inventory, it becomes possible to determine how each component might play a role in an attempted ransomware attack. <\/p>\n\n\n\n

\"An effort like the one impacting Colonial Pipeline is likely the result of multiple weaknesses in process and cyber-defences that were ultimately successfully exploited. With the age of some industrial software systems far exceeding that of commercial software, it\u2019s likely that older software wasn\u2019t designed to limit exposure to modern threats like ransomware attacks. <\/p>\n\n\n\n

\"While the age of the software has limited impact on its serviceability, threat models and defensive protections need to keep pace with new threats \u2013 something that can only be done if all weaknesses present in each component are known and accounted for. After all, if a criminal can identify your weaknesses faster than you can, luck is rarely on your side.\u201d<\/p>\n\n\n\n

\"While this is indeed a financial disaster, and will have a significant impact on many, let us also consider that this means that, at least for a time, threat actors had control of those very same IT systems.\"<\/p>Martin Jartelius, CSO, Outpost24<\/cite><\/blockquote><\/figure>\n\n\n\n

Taking back control <\/strong><\/p>\n\n\n\n

US government officials are currently working with Colonial to help it recover while scrambling to avoid more severe fuel supply disruptions should the outage continue. Whether the pipeline stays shut that long in turn depends on how deeply the hackers penetrated Colonial\u2019s network - and how soon cybersecurity experts can pull them out.<\/p>\n\n\n\n

\"As so many times before when talking about ransomware \u2013 to lock a system with ransomware you need a good degree of control of that system,\" says Martin Jartelius, CSO at Outpost24. \"While this is indeed a financial disaster, and will have a significant impact on many, let us also consider that this means that, at least for a time, threat actors had control of those very same IT systems. Preventive security, as well as segmentation, are critical for those kinds of environments.\"<\/p>\n\n\n\n

\"One thing to note here is that ransomware has to announce itself to be successful,\" adds Tim Erlin, VP at Tripwire. \"In industrial environments, cyber events aren\u2019t always this visible. Increasing visibility into industrial networks becomes more important as attackers continue to target critical infrastructure.\u201d<\/p>\n\n\n\n

Brad Brooks, CEO and President of OneLogin, rightfully concludes: \"This attack represents just how quickly the stakes are escalating on Cybersecurity, with controlling and knowing who has access to your IT systems a board level priority for every company. We are moving from an invisible Cold War that was focused on stealing data to a highly visible hot war that has real implications for physical property and people\u2019s lives.\u201d<\/p>\n","post_title":"Ransomware roundtable | A threat in the pipeline","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"ransomware-roundtable-a-threat-in-the-pipeline","to_ping":"","pinged":"","post_modified":"2021-05-10 18:12:55","post_modified_gmt":"2021-05-10 17:12:55","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=6024","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4871,"post_author":"3","post_date":"2021-02-09 19:22:22","post_date_gmt":"2021-02-09 19:22:22","post_content":"Detectives assigned to the Digital Forensics Unit at Pinellas County Sheriff\u2019s Office are investigating an unlawful computer software intrusion at the City of Oldsmar\u2019s water treatment plant. While the cyber attack was unsuccessful, it does highlight the need for cybersecurity tools in critical infrastructure applications.\n\nOn Friday, February 5, 2021, the Pinellas County Sheriff\u2019s Office was notified by the City of Oldsmar that its computer system had been remotely accessed at 8:00am and 1:30pm by an unknown suspect. According to detectives, the City of Oldsmar\u2019s computer system at the water treatment plant allows for remote access by authorised users to troubleshoot any system problems from other locations.\n\nThe initial intrusion was brief and not cause for concern due to supervisors regularly accessing the system remotely to monitor the system. At 1:30, a plant operator witnessed a second remote access user opening various functions in the system that control the amount of sodium hydroxide in the water. The operator noted the remote access user raised the levels of sodium hydroxide in the water from 100 parts per million to 11,100 parts per million. The operator immediately reduced the levels to their appropriate amount. Sodium hydroxide is used in small amounts to control acidity, but a large amount could have caused major problems in the water.\n\nThe initial investigation revealed that the hacker remotely accessed the treatment plant\u2019s computer for approximately 3 to 5 minutes. Speaking at a press conference about the cyber attack, Sheriff Bob Gualtieri stated: \u201cAt no time was there a significant effect on the water being treated, and more importantly the public was never in danger.\u201d\n\nCommenting on the attack, Andrea Carcano, co-founder at Nozomi Networks stated: \u201cUnfortunately, this attack plays into a troubling trend we\u2019ve been following over the last year. As the pandemic forced critical infrastructure organisations to quickly shift to remote access options to keep systems up and running, we\u2019ve seen threats rise and bad actors reach new lows \u2013 setting their sights on life threatening targets. Fortunately, in this case, operators monitoring Oldsmar\u2019s treatment plant spotted the attack and were able to respond before anyone could be harmed. But it\u2019s a stark reminder that with limited cybersecurity resources and few regulations water utilities are vulnerable to attack. When it comes critical infrastructure, operational resilience must a top priority and advances in AI-powered OT security and network monitoring are available to give operators the network visibility they need to quickly spot trouble and respond before harm is done.\u201d\n\n\u201cThis targeted attack appears to have started by the \u2018bad actor\u2019 getting access to a vulnerable network\/system and working their way through the network trying to find the next weak access point while gathering data and understanding how the organisation operates along the way,\u201d added Niamh Muldoon, Global Data Protection Officer at OneLogin. \u201cIn this instance, understanding the information assets, applying not only MFA but enhanced multi-factor authentication, would have reduced the risk of this unauthorised attack materializing. It\u2019s a critical part of the MFA policy to enforce time limits for end-users and their trusted devices to re-authenticate, requiring them not only to validate themselves but also the identity of the device trying to access critical systems\/applications and the network. Without knowing more of the details, applying enhanced MFA to the execution of critical actions particularly for IT and systems administrators would have reduced the associated risk further. Having logging in place, and understanding logged events would support with the associated monitoring and alerting events. After the event has happened, crisis management is critical for successfully managing the attack response to reduce business impact and consequences, and it appears the Florida agency has done that.\u201d\n\n\u201cWhile this incident will rightfully cause concern, it appears that likelihood of real damage was minimal due to the fail safes in place,\u201d observes Tim Erlin, VP at Tripwire. \u201cThere are real impacts to be worried about, and actions to be taken, but this doesn\u2019t appear to be a sophisticated or novel attack. From a cybersecurity standpoint, we should be particularly concerned about how the attacker was able to authenticate into the remote access software. That entry point should be very well protected, given that it provides access to such obviously sensitive capabilities. Protecting remote access into industrial systems where these types of changes can be made should be a high priority for any industrial environment.\u201d\n\nLocal, State, and Federal investigators are working together to identify those responsible and the investigation is ongoing. Other utility providers have been informed of the intrusion, so they can take their own protective measures.","post_title":"Florida water system cyber attack highlights role of cybersecurity in critical infrastructure","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"florida-water-system-cyber-attack-highlights-role-of-cybersecurity-in-critical-infrastructure","to_ping":"","pinged":"","post_modified":"2021-02-09 19:22:25","post_modified_gmt":"2021-02-09 19:22:25","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4871","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4178,"post_author":"3","post_date":"2020-12-07 14:52:36","post_date_gmt":"2020-12-07 14:52:36","post_content":"Nozomi Networks and Chinook Systems have partnered to provide advanced cybersecurity solutions to protect industrial and critical infrastructure facilities across North America. Under the deal, Chinook will offer Nozomi Networks\u2019 complete portfolio of OT and IoT security solutions.\n\n\u201cFacilities that fully leverage their OT systems deliver tremendous returns when it comes to energy and operational savings, the safety and comfort of occupants and lower total cost of ownership,\u201d said Chinook\u2019s President, Wanda Lenkewich. \u201cAt the same time, the network connectivity that enables these systems, also introduces new and growing cyber threats. Partnering with Nozomi Networks allows Chinook to support clients with an integrated, comprehensive cybersecurity solution that ensures cyber threats are actively discovered, monitored and managed.\u201d\n\n\u201cWe are absolutely delighted to team with Chinook to help industrial and critical infrastructure facilities meet new requirements for secure connectivity across OT, IT and IoT networks,\u201d said Chet Namboodri, Vice President, Worldwide Business Development and Channel Sales at Nozomi. \u201cWe\u2019ve already worked together to deliver on a number of joint customer engagements in both the government and commercial sectors. Partnering with Chinook accelerates our joint efforts to make sure facility-related control and building management systems are safe from cyber threats.\u201d\n\nwww.nozominetworks.com<\/a>\n\nwww.chinooksystems.com<\/a>\n\n ","post_title":"Nozomi Networks and Chinook Systems partner for OT and IoT security solutions","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"nozomi-networks-and-chinook-systems-partner-for-ot-and-iot-security-solutions","to_ping":"","pinged":"","post_modified":"2020-12-07 14:52:40","post_modified_gmt":"2020-12-07 14:52:40","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4178","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4140,"post_author":"3","post_date":"2020-12-03 11:07:21","post_date_gmt":"2020-12-03 11:07:21","post_content":"Civil Nuclear Constabulary (CNC) police officers based at Harwell have launched Project Servator a collaborative community approach to policing. Project Servator aims to disrupt a range of criminal activity, including terrorism, while providing a reassuring presence for the public.\n\nCNC\u2019s officers are experienced and specially trained to spot the tell-tale signs that someone is planning or preparing to commit an illegal act. It works with other police forces, local businesses and the public to protect the Harwell site and the surrounding area and everyone who lives, works or visits there and to make it a difficult place for terrorists and other criminals to operate. Project Servator has been successful in gathering intelligence that has assisted Counter Terrorism Units across the UK in investigating and preventing acts of terror.\n\nProject Servator\u2019s patrols are highly visible and can happen at any time and in any location. Officers will talk to the public and local businesses to let them know what they\u2019re doing and remind them to be vigilant, trust their instincts and report any suspicious or unusual behaviour.\n\n\u201cWe are deploying these additional tactics to further complement the operational activity that exists in and around our Operational Policing Units,\u201d explained Supt Donna Jones, who is leading on the implementation of the project across the Constabulary. \u201cOur aim is to build upon relationships with partners as well as businesses and communities. These tactics are not new but allow us to have a focus on community engagement and encourage people to be our extra eyes and ears. This is not restricted to the Harwell site but also extends to the surrounding area. We are aware of the vast amount of information members of our community have and they are aware of what is out of the ordinary. All we ask is that they report any suspicions to us and we\u2019ll do the rest. The deployments will be unpredictable and our tactics will vary from one deployment to the next. The aim is to work with our local communities to deter any hostile threat.\u201d\n\nwww.gov.uk\/government\/organisations\/civil-nuclear-constabulary<\/a>","post_title":"CNC Harwell launches Project Servator","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"cnc-harwell-launches-project-servator","to_ping":"","pinged":"","post_modified":"2020-12-03 11:07:23","post_modified_gmt":"2020-12-03 11:07:23","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4140","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4102,"post_author":"3","post_date":"2020-11-30 17:30:23","post_date_gmt":"2020-11-30 17:30:23","post_content":"Radiflow and Mitsubishi Electric UK are collaborating to address the needs of IEC62443 cyber security standards in the Critical Infrastructure and Industrial Automation markets. The companys believe that the combination of the automation knowledge and tools of Mitsubishi Electric UK with the cyber security and IEC 62443 compliance skills of Radiflow will provide a holistic view of a client\u2019s risk posture.\n\nRadiflow will also provide Mitsubishi Electric UK customers with a consultancy service for cyber security, which includes the provision of OT security risk assessments, provision of Radiflow intrusion detection software and general advice on alignment with IEC 62443-3. In addition, the solution is intended to help customers to support asset owners in satisfying the requirements of the NIS Directive along with due diligence in alignment with CPNI (Centre for the Protection of National Infrastructure) best practice.\n\n\u201cOur new collaboration with Radiflow provides expertise in the field of OT cyber security which compliments and broadens the services that we offer our customers through the Mitsubishi Electric UK System Service Operation,\u201d said David Bean, Solutions Manager for Mitsubishi Electric UK. \u201cThere is a growing demand for solutions that address the requirements of cyber security in the OT space and we are looking forward to delivering those solutions and building our relationship further with the team at Radiflow.\u201d\n\n\u201cRadiflow sees huge value for OT organisations to have cyber security services and solutions aligned with their automation systems,\u201d added Ilan Barda, Founder and CEO of Radiflow. \u201cBy combining the automation knowledge and tools of Mitsubishi with the OT cyber security skills and tools of Radiflow, we are able to provide a holistic view of an organisation\u2019s OT risk posture.\u201d\n\nwww.radiflow.com<\/a>","post_title":"Radiflow and Mitsubishi Electric UK collaborate on cyber security standards","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"radiflow-and-mitsubishi-electric-uk-collaborate-on-cyber-security-standards","to_ping":"","pinged":"","post_modified":"2020-11-30 17:30:25","post_modified_gmt":"2020-11-30 17:30:25","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4102","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":3359,"post_author":"3","post_date":"2020-10-16 17:11:16","post_date_gmt":"2020-10-16 16:11:16","post_content":"Senstar explains how its products can be applied to protect the full range of upstream, midstream, and downstream facilities in the oil and gas industry.","post_title":"Senstar explains its security solutions for oil and gas","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"senstar-explains-its-security-solutions-for-oil-and-gas","to_ping":"","pinged":"","post_modified":"2020-10-16 17:11:17","post_modified_gmt":"2020-10-16 16:11:17","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=3359","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"}],"next":false,"prev":false,"total_page":1},"paged":1,"column_class":"jeg_col_2o3","class":"epic_block_14"};

\n

Subsequently, the operator took itself offline on Friday after the cyber-attack was discovered, with the cloud computing system that was used by the hackers to collect the stolen data was taken offline on Saturday. Colonial's data did not appear to have been transferred from that system anywhere else, potentially limiting the hackers' leverage to extort or further embarrass the company. <\/p>\n\n\n\n

On Sunday, Colonial said that although its four main pipelines remain offline, some smaller lines between terminals and delivery points were now operational. The US government has now relaxed rules on fuel being transported by road, meaning drivers in 18 states can work extra or more flexible hours when transporting refined petroleum products.<\/p>\n\n\n\n

While US fuel prices at the pump were largely unaffected on Monday, there are fears that could change if the shutdown is prolonged. <\/p>\n\n\n\n

\"The fact that the US government has quickly issued emergency legislation to relax rules on road fuel transportation highlights how concerning this attack is...\"<\/p>Lewis Jones, Threat Intelligence Analyst, Talion<\/cite><\/blockquote><\/figure>\n\n\n\n

A major disruption<\/strong><\/p>\n\n\n\n

In response to this substantial attack, Lewis Jones, Threat Intelligence Analyst at Talion says: \u201cThis appears to be one of the most disruptive ransomware attacks ever reported, highlighting the vulnerabilities in the energy sector and why it is often targeted by attackers. A long term ransomware negotiation within the energy sector could cause mass disruption and means that the likelihood of payment is increased. <\/p>\n\n\n\n

\"The fact that US government has quickly issued emergency legislation to relax rules on road fuel transportation highlights how concerning this attack is. A longer term implication of the attack could create a delay in delivery and disruption of the supply chain. This would cause an increase in price at a time when the economy is already fragile due to the current pandemic.\" <\/p>\n\n\n\n

Computer security service, Digital Shadows has claimed that the Colonial attack was indeed helped by the coronavirus pandemic, with more engineers remotely accessing control systems for the pipeline from home. James Chappell, Co-Founder of Digital Shadows, said DarkSide could have bought account login details for remote desktop software such as TeamViewer and Microsoft Remote Desktop.<\/p>\n\n\n\n

\"We're seeing a lot of victims now, this is seriously a big problem,\" said Chappell in a statement. \"The amount of small businesses that are falling victim <\/a>to this. It's becoming a big problem for the economy globally.\"<\/p>\n\n\n\n

\"Cybercriminals don\u2019t really care how important your business is, only how much money they might extract from you,\" comments Tim Mackey Principal Security Strategist at the Synopsys CyRC (Cybersecurity Research Centre). \"This trend can be seen with increasing attacks on municipalities, healthcare systems, and elements of critical infrastructure. Each of these organisations will bring in law enforcement, yet attackers continue to be aggressive in their activities. <\/p>\n\n\n\n

\"While Colonial Pipeline is a US operation, attacks are global in scope. And despite warnings from officials like the US Treasury Department highlighting how ransomware payments are used to fund future criminal activities, victims are often faced with the difficult decision of whether to pay the ransom.\"<\/p>\n\n\n\n

\"The Colonial Pipeline attack reinforces the need to update legacy systems running today\u2019s critical infrastructure networks...\"<\/p>Lior Div, CEO and Co-founder, Cybereason<\/cite><\/blockquote><\/figure>\n\n\n\n

Remaining critical <\/strong><\/p>\n\n\n\n

\u201cThese \u2018Cyber Physical\u2019 attacks are a big deal, because they demonstrate just how fragile the provision of critical services are into society,\" says Andy Norton European Cyber Risk Officer at Armis. \"A few weeks ago a water treatment plant<\/a> was compromised leading to the potential for poisoning of the water. Now, 45% of the US oil energy provision has been switched off to the East coast. Prolonged shortages in critical services lead to civil unrest, economic pressures, and a general lack of confidence in public administration.\" <\/p>\n\n\n\n

Lior Div, CEO and Co-founder of Cybereason also comments: \"The SolarWinds<\/a> and Microsoft Exchange Server<\/a> attacks were unparalleled in their scope, successfully infiltrating and compromising virtually every US government agency and a wide array of medium and large private sector companies. The Colonial Pipeline attack reinforces the need to update legacy systems running today\u2019s critical infrastructure networks.<\/p>\n\n\n\n

\"If the public and private sectors can work together to solve complex cybersecurity issues, and at the same time accurately identify the threat actors and bring them to account for their actions, it will go a long way in reversing the adversary advantage and enable defenders to retake the high ground. There is also another significant opportunity here as well to cooperate on a global scale to develop extradition laws that enable cyber crimes and cyber espionage to be prosecuted more effectively.\u201d<\/p>\n\n\n\n

Mackey agrees, stating: \"Avoiding becoming a victim of ransomware requires organisations to have a comprehensive cybersecurity plan in place that fully captures the risks of each software component, its role and lifecycle, and its deployment configuration and usage assumptions. Armed with this basic information, and an exhaustive inventory, it becomes possible to determine how each component might play a role in an attempted ransomware attack. <\/p>\n\n\n\n

\"An effort like the one impacting Colonial Pipeline is likely the result of multiple weaknesses in process and cyber-defences that were ultimately successfully exploited. With the age of some industrial software systems far exceeding that of commercial software, it\u2019s likely that older software wasn\u2019t designed to limit exposure to modern threats like ransomware attacks. <\/p>\n\n\n\n

\"While the age of the software has limited impact on its serviceability, threat models and defensive protections need to keep pace with new threats \u2013 something that can only be done if all weaknesses present in each component are known and accounted for. After all, if a criminal can identify your weaknesses faster than you can, luck is rarely on your side.\u201d<\/p>\n\n\n\n

\"While this is indeed a financial disaster, and will have a significant impact on many, let us also consider that this means that, at least for a time, threat actors had control of those very same IT systems.\"<\/p>Martin Jartelius, CSO, Outpost24<\/cite><\/blockquote><\/figure>\n\n\n\n

Taking back control <\/strong><\/p>\n\n\n\n

US government officials are currently working with Colonial to help it recover while scrambling to avoid more severe fuel supply disruptions should the outage continue. Whether the pipeline stays shut that long in turn depends on how deeply the hackers penetrated Colonial\u2019s network - and how soon cybersecurity experts can pull them out.<\/p>\n\n\n\n

\"As so many times before when talking about ransomware \u2013 to lock a system with ransomware you need a good degree of control of that system,\" says Martin Jartelius, CSO at Outpost24. \"While this is indeed a financial disaster, and will have a significant impact on many, let us also consider that this means that, at least for a time, threat actors had control of those very same IT systems. Preventive security, as well as segmentation, are critical for those kinds of environments.\"<\/p>\n\n\n\n

\"One thing to note here is that ransomware has to announce itself to be successful,\" adds Tim Erlin, VP at Tripwire. \"In industrial environments, cyber events aren\u2019t always this visible. Increasing visibility into industrial networks becomes more important as attackers continue to target critical infrastructure.\u201d<\/p>\n\n\n\n

Brad Brooks, CEO and President of OneLogin, rightfully concludes: \"This attack represents just how quickly the stakes are escalating on Cybersecurity, with controlling and knowing who has access to your IT systems a board level priority for every company. We are moving from an invisible Cold War that was focused on stealing data to a highly visible hot war that has real implications for physical property and people\u2019s lives.\u201d<\/p>\n","post_title":"Ransomware roundtable | A threat in the pipeline","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"ransomware-roundtable-a-threat-in-the-pipeline","to_ping":"","pinged":"","post_modified":"2021-05-10 18:12:55","post_modified_gmt":"2021-05-10 17:12:55","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=6024","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4871,"post_author":"3","post_date":"2021-02-09 19:22:22","post_date_gmt":"2021-02-09 19:22:22","post_content":"Detectives assigned to the Digital Forensics Unit at Pinellas County Sheriff\u2019s Office are investigating an unlawful computer software intrusion at the City of Oldsmar\u2019s water treatment plant. While the cyber attack was unsuccessful, it does highlight the need for cybersecurity tools in critical infrastructure applications.\n\nOn Friday, February 5, 2021, the Pinellas County Sheriff\u2019s Office was notified by the City of Oldsmar that its computer system had been remotely accessed at 8:00am and 1:30pm by an unknown suspect. According to detectives, the City of Oldsmar\u2019s computer system at the water treatment plant allows for remote access by authorised users to troubleshoot any system problems from other locations.\n\nThe initial intrusion was brief and not cause for concern due to supervisors regularly accessing the system remotely to monitor the system. At 1:30, a plant operator witnessed a second remote access user opening various functions in the system that control the amount of sodium hydroxide in the water. The operator noted the remote access user raised the levels of sodium hydroxide in the water from 100 parts per million to 11,100 parts per million. The operator immediately reduced the levels to their appropriate amount. Sodium hydroxide is used in small amounts to control acidity, but a large amount could have caused major problems in the water.\n\nThe initial investigation revealed that the hacker remotely accessed the treatment plant\u2019s computer for approximately 3 to 5 minutes. Speaking at a press conference about the cyber attack, Sheriff Bob Gualtieri stated: \u201cAt no time was there a significant effect on the water being treated, and more importantly the public was never in danger.\u201d\n\nCommenting on the attack, Andrea Carcano, co-founder at Nozomi Networks stated: \u201cUnfortunately, this attack plays into a troubling trend we\u2019ve been following over the last year. As the pandemic forced critical infrastructure organisations to quickly shift to remote access options to keep systems up and running, we\u2019ve seen threats rise and bad actors reach new lows \u2013 setting their sights on life threatening targets. Fortunately, in this case, operators monitoring Oldsmar\u2019s treatment plant spotted the attack and were able to respond before anyone could be harmed. But it\u2019s a stark reminder that with limited cybersecurity resources and few regulations water utilities are vulnerable to attack. When it comes critical infrastructure, operational resilience must a top priority and advances in AI-powered OT security and network monitoring are available to give operators the network visibility they need to quickly spot trouble and respond before harm is done.\u201d\n\n\u201cThis targeted attack appears to have started by the \u2018bad actor\u2019 getting access to a vulnerable network\/system and working their way through the network trying to find the next weak access point while gathering data and understanding how the organisation operates along the way,\u201d added Niamh Muldoon, Global Data Protection Officer at OneLogin. \u201cIn this instance, understanding the information assets, applying not only MFA but enhanced multi-factor authentication, would have reduced the risk of this unauthorised attack materializing. It\u2019s a critical part of the MFA policy to enforce time limits for end-users and their trusted devices to re-authenticate, requiring them not only to validate themselves but also the identity of the device trying to access critical systems\/applications and the network. Without knowing more of the details, applying enhanced MFA to the execution of critical actions particularly for IT and systems administrators would have reduced the associated risk further. Having logging in place, and understanding logged events would support with the associated monitoring and alerting events. After the event has happened, crisis management is critical for successfully managing the attack response to reduce business impact and consequences, and it appears the Florida agency has done that.\u201d\n\n\u201cWhile this incident will rightfully cause concern, it appears that likelihood of real damage was minimal due to the fail safes in place,\u201d observes Tim Erlin, VP at Tripwire. \u201cThere are real impacts to be worried about, and actions to be taken, but this doesn\u2019t appear to be a sophisticated or novel attack. From a cybersecurity standpoint, we should be particularly concerned about how the attacker was able to authenticate into the remote access software. That entry point should be very well protected, given that it provides access to such obviously sensitive capabilities. Protecting remote access into industrial systems where these types of changes can be made should be a high priority for any industrial environment.\u201d\n\nLocal, State, and Federal investigators are working together to identify those responsible and the investigation is ongoing. Other utility providers have been informed of the intrusion, so they can take their own protective measures.","post_title":"Florida water system cyber attack highlights role of cybersecurity in critical infrastructure","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"florida-water-system-cyber-attack-highlights-role-of-cybersecurity-in-critical-infrastructure","to_ping":"","pinged":"","post_modified":"2021-02-09 19:22:25","post_modified_gmt":"2021-02-09 19:22:25","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4871","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4178,"post_author":"3","post_date":"2020-12-07 14:52:36","post_date_gmt":"2020-12-07 14:52:36","post_content":"Nozomi Networks and Chinook Systems have partnered to provide advanced cybersecurity solutions to protect industrial and critical infrastructure facilities across North America. Under the deal, Chinook will offer Nozomi Networks\u2019 complete portfolio of OT and IoT security solutions.\n\n\u201cFacilities that fully leverage their OT systems deliver tremendous returns when it comes to energy and operational savings, the safety and comfort of occupants and lower total cost of ownership,\u201d said Chinook\u2019s President, Wanda Lenkewich. \u201cAt the same time, the network connectivity that enables these systems, also introduces new and growing cyber threats. Partnering with Nozomi Networks allows Chinook to support clients with an integrated, comprehensive cybersecurity solution that ensures cyber threats are actively discovered, monitored and managed.\u201d\n\n\u201cWe are absolutely delighted to team with Chinook to help industrial and critical infrastructure facilities meet new requirements for secure connectivity across OT, IT and IoT networks,\u201d said Chet Namboodri, Vice President, Worldwide Business Development and Channel Sales at Nozomi. \u201cWe\u2019ve already worked together to deliver on a number of joint customer engagements in both the government and commercial sectors. Partnering with Chinook accelerates our joint efforts to make sure facility-related control and building management systems are safe from cyber threats.\u201d\n\nwww.nozominetworks.com<\/a>\n\nwww.chinooksystems.com<\/a>\n\n ","post_title":"Nozomi Networks and Chinook Systems partner for OT and IoT security solutions","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"nozomi-networks-and-chinook-systems-partner-for-ot-and-iot-security-solutions","to_ping":"","pinged":"","post_modified":"2020-12-07 14:52:40","post_modified_gmt":"2020-12-07 14:52:40","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4178","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4140,"post_author":"3","post_date":"2020-12-03 11:07:21","post_date_gmt":"2020-12-03 11:07:21","post_content":"Civil Nuclear Constabulary (CNC) police officers based at Harwell have launched Project Servator a collaborative community approach to policing. Project Servator aims to disrupt a range of criminal activity, including terrorism, while providing a reassuring presence for the public.\n\nCNC\u2019s officers are experienced and specially trained to spot the tell-tale signs that someone is planning or preparing to commit an illegal act. It works with other police forces, local businesses and the public to protect the Harwell site and the surrounding area and everyone who lives, works or visits there and to make it a difficult place for terrorists and other criminals to operate. Project Servator has been successful in gathering intelligence that has assisted Counter Terrorism Units across the UK in investigating and preventing acts of terror.\n\nProject Servator\u2019s patrols are highly visible and can happen at any time and in any location. Officers will talk to the public and local businesses to let them know what they\u2019re doing and remind them to be vigilant, trust their instincts and report any suspicious or unusual behaviour.\n\n\u201cWe are deploying these additional tactics to further complement the operational activity that exists in and around our Operational Policing Units,\u201d explained Supt Donna Jones, who is leading on the implementation of the project across the Constabulary. \u201cOur aim is to build upon relationships with partners as well as businesses and communities. These tactics are not new but allow us to have a focus on community engagement and encourage people to be our extra eyes and ears. This is not restricted to the Harwell site but also extends to the surrounding area. We are aware of the vast amount of information members of our community have and they are aware of what is out of the ordinary. All we ask is that they report any suspicions to us and we\u2019ll do the rest. The deployments will be unpredictable and our tactics will vary from one deployment to the next. The aim is to work with our local communities to deter any hostile threat.\u201d\n\nwww.gov.uk\/government\/organisations\/civil-nuclear-constabulary<\/a>","post_title":"CNC Harwell launches Project Servator","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"cnc-harwell-launches-project-servator","to_ping":"","pinged":"","post_modified":"2020-12-03 11:07:23","post_modified_gmt":"2020-12-03 11:07:23","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4140","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4102,"post_author":"3","post_date":"2020-11-30 17:30:23","post_date_gmt":"2020-11-30 17:30:23","post_content":"Radiflow and Mitsubishi Electric UK are collaborating to address the needs of IEC62443 cyber security standards in the Critical Infrastructure and Industrial Automation markets. The companys believe that the combination of the automation knowledge and tools of Mitsubishi Electric UK with the cyber security and IEC 62443 compliance skills of Radiflow will provide a holistic view of a client\u2019s risk posture.\n\nRadiflow will also provide Mitsubishi Electric UK customers with a consultancy service for cyber security, which includes the provision of OT security risk assessments, provision of Radiflow intrusion detection software and general advice on alignment with IEC 62443-3. In addition, the solution is intended to help customers to support asset owners in satisfying the requirements of the NIS Directive along with due diligence in alignment with CPNI (Centre for the Protection of National Infrastructure) best practice.\n\n\u201cOur new collaboration with Radiflow provides expertise in the field of OT cyber security which compliments and broadens the services that we offer our customers through the Mitsubishi Electric UK System Service Operation,\u201d said David Bean, Solutions Manager for Mitsubishi Electric UK. \u201cThere is a growing demand for solutions that address the requirements of cyber security in the OT space and we are looking forward to delivering those solutions and building our relationship further with the team at Radiflow.\u201d\n\n\u201cRadiflow sees huge value for OT organisations to have cyber security services and solutions aligned with their automation systems,\u201d added Ilan Barda, Founder and CEO of Radiflow. \u201cBy combining the automation knowledge and tools of Mitsubishi with the OT cyber security skills and tools of Radiflow, we are able to provide a holistic view of an organisation\u2019s OT risk posture.\u201d\n\nwww.radiflow.com<\/a>","post_title":"Radiflow and Mitsubishi Electric UK collaborate on cyber security standards","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"radiflow-and-mitsubishi-electric-uk-collaborate-on-cyber-security-standards","to_ping":"","pinged":"","post_modified":"2020-11-30 17:30:25","post_modified_gmt":"2020-11-30 17:30:25","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4102","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":3359,"post_author":"3","post_date":"2020-10-16 17:11:16","post_date_gmt":"2020-10-16 16:11:16","post_content":"Senstar explains how its products can be applied to protect the full range of upstream, midstream, and downstream facilities in the oil and gas industry.","post_title":"Senstar explains its security solutions for oil and gas","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"senstar-explains-its-security-solutions-for-oil-and-gas","to_ping":"","pinged":"","post_modified":"2020-10-16 17:11:17","post_modified_gmt":"2020-10-16 16:11:17","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=3359","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"}],"next":false,"prev":false,"total_page":1},"paged":1,"column_class":"jeg_col_2o3","class":"epic_block_14"};

\n

Sources said the ransomware attack was likely to have been caused by a cyber-criminal gang called DarkSide, who infiltrated Colonial's network and locked the data on some computers and servers, demanding a ransom on Friday. The gang tried to take almost 100 gigabytes of data hostage, threatening to leak it onto the internet, but the FBI and other government agencies worked with private companies to respond. <\/p>\n\n\n\n

Subsequently, the operator took itself offline on Friday after the cyber-attack was discovered, with the cloud computing system that was used by the hackers to collect the stolen data was taken offline on Saturday. Colonial's data did not appear to have been transferred from that system anywhere else, potentially limiting the hackers' leverage to extort or further embarrass the company. <\/p>\n\n\n\n

On Sunday, Colonial said that although its four main pipelines remain offline, some smaller lines between terminals and delivery points were now operational. The US government has now relaxed rules on fuel being transported by road, meaning drivers in 18 states can work extra or more flexible hours when transporting refined petroleum products.<\/p>\n\n\n\n

While US fuel prices at the pump were largely unaffected on Monday, there are fears that could change if the shutdown is prolonged. <\/p>\n\n\n\n

\"The fact that the US government has quickly issued emergency legislation to relax rules on road fuel transportation highlights how concerning this attack is...\"<\/p>Lewis Jones, Threat Intelligence Analyst, Talion<\/cite><\/blockquote><\/figure>\n\n\n\n

A major disruption<\/strong><\/p>\n\n\n\n

In response to this substantial attack, Lewis Jones, Threat Intelligence Analyst at Talion says: \u201cThis appears to be one of the most disruptive ransomware attacks ever reported, highlighting the vulnerabilities in the energy sector and why it is often targeted by attackers. A long term ransomware negotiation within the energy sector could cause mass disruption and means that the likelihood of payment is increased. <\/p>\n\n\n\n

\"The fact that US government has quickly issued emergency legislation to relax rules on road fuel transportation highlights how concerning this attack is. A longer term implication of the attack could create a delay in delivery and disruption of the supply chain. This would cause an increase in price at a time when the economy is already fragile due to the current pandemic.\" <\/p>\n\n\n\n

Computer security service, Digital Shadows has claimed that the Colonial attack was indeed helped by the coronavirus pandemic, with more engineers remotely accessing control systems for the pipeline from home. James Chappell, Co-Founder of Digital Shadows, said DarkSide could have bought account login details for remote desktop software such as TeamViewer and Microsoft Remote Desktop.<\/p>\n\n\n\n

\"We're seeing a lot of victims now, this is seriously a big problem,\" said Chappell in a statement. \"The amount of small businesses that are falling victim <\/a>to this. It's becoming a big problem for the economy globally.\"<\/p>\n\n\n\n

\"Cybercriminals don\u2019t really care how important your business is, only how much money they might extract from you,\" comments Tim Mackey Principal Security Strategist at the Synopsys CyRC (Cybersecurity Research Centre). \"This trend can be seen with increasing attacks on municipalities, healthcare systems, and elements of critical infrastructure. Each of these organisations will bring in law enforcement, yet attackers continue to be aggressive in their activities. <\/p>\n\n\n\n

\"While Colonial Pipeline is a US operation, attacks are global in scope. And despite warnings from officials like the US Treasury Department highlighting how ransomware payments are used to fund future criminal activities, victims are often faced with the difficult decision of whether to pay the ransom.\"<\/p>\n\n\n\n

\"The Colonial Pipeline attack reinforces the need to update legacy systems running today\u2019s critical infrastructure networks...\"<\/p>Lior Div, CEO and Co-founder, Cybereason<\/cite><\/blockquote><\/figure>\n\n\n\n

Remaining critical <\/strong><\/p>\n\n\n\n

\u201cThese \u2018Cyber Physical\u2019 attacks are a big deal, because they demonstrate just how fragile the provision of critical services are into society,\" says Andy Norton European Cyber Risk Officer at Armis. \"A few weeks ago a water treatment plant<\/a> was compromised leading to the potential for poisoning of the water. Now, 45% of the US oil energy provision has been switched off to the East coast. Prolonged shortages in critical services lead to civil unrest, economic pressures, and a general lack of confidence in public administration.\" <\/p>\n\n\n\n

Lior Div, CEO and Co-founder of Cybereason also comments: \"The SolarWinds<\/a> and Microsoft Exchange Server<\/a> attacks were unparalleled in their scope, successfully infiltrating and compromising virtually every US government agency and a wide array of medium and large private sector companies. The Colonial Pipeline attack reinforces the need to update legacy systems running today\u2019s critical infrastructure networks.<\/p>\n\n\n\n

\"If the public and private sectors can work together to solve complex cybersecurity issues, and at the same time accurately identify the threat actors and bring them to account for their actions, it will go a long way in reversing the adversary advantage and enable defenders to retake the high ground. There is also another significant opportunity here as well to cooperate on a global scale to develop extradition laws that enable cyber crimes and cyber espionage to be prosecuted more effectively.\u201d<\/p>\n\n\n\n

Mackey agrees, stating: \"Avoiding becoming a victim of ransomware requires organisations to have a comprehensive cybersecurity plan in place that fully captures the risks of each software component, its role and lifecycle, and its deployment configuration and usage assumptions. Armed with this basic information, and an exhaustive inventory, it becomes possible to determine how each component might play a role in an attempted ransomware attack. <\/p>\n\n\n\n

\"An effort like the one impacting Colonial Pipeline is likely the result of multiple weaknesses in process and cyber-defences that were ultimately successfully exploited. With the age of some industrial software systems far exceeding that of commercial software, it\u2019s likely that older software wasn\u2019t designed to limit exposure to modern threats like ransomware attacks. <\/p>\n\n\n\n

\"While the age of the software has limited impact on its serviceability, threat models and defensive protections need to keep pace with new threats \u2013 something that can only be done if all weaknesses present in each component are known and accounted for. After all, if a criminal can identify your weaknesses faster than you can, luck is rarely on your side.\u201d<\/p>\n\n\n\n

\"While this is indeed a financial disaster, and will have a significant impact on many, let us also consider that this means that, at least for a time, threat actors had control of those very same IT systems.\"<\/p>Martin Jartelius, CSO, Outpost24<\/cite><\/blockquote><\/figure>\n\n\n\n

Taking back control <\/strong><\/p>\n\n\n\n

US government officials are currently working with Colonial to help it recover while scrambling to avoid more severe fuel supply disruptions should the outage continue. Whether the pipeline stays shut that long in turn depends on how deeply the hackers penetrated Colonial\u2019s network - and how soon cybersecurity experts can pull them out.<\/p>\n\n\n\n

\"As so many times before when talking about ransomware \u2013 to lock a system with ransomware you need a good degree of control of that system,\" says Martin Jartelius, CSO at Outpost24. \"While this is indeed a financial disaster, and will have a significant impact on many, let us also consider that this means that, at least for a time, threat actors had control of those very same IT systems. Preventive security, as well as segmentation, are critical for those kinds of environments.\"<\/p>\n\n\n\n

\"One thing to note here is that ransomware has to announce itself to be successful,\" adds Tim Erlin, VP at Tripwire. \"In industrial environments, cyber events aren\u2019t always this visible. Increasing visibility into industrial networks becomes more important as attackers continue to target critical infrastructure.\u201d<\/p>\n\n\n\n

Brad Brooks, CEO and President of OneLogin, rightfully concludes: \"This attack represents just how quickly the stakes are escalating on Cybersecurity, with controlling and knowing who has access to your IT systems a board level priority for every company. We are moving from an invisible Cold War that was focused on stealing data to a highly visible hot war that has real implications for physical property and people\u2019s lives.\u201d<\/p>\n","post_title":"Ransomware roundtable | A threat in the pipeline","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"ransomware-roundtable-a-threat-in-the-pipeline","to_ping":"","pinged":"","post_modified":"2021-05-10 18:12:55","post_modified_gmt":"2021-05-10 17:12:55","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=6024","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4871,"post_author":"3","post_date":"2021-02-09 19:22:22","post_date_gmt":"2021-02-09 19:22:22","post_content":"Detectives assigned to the Digital Forensics Unit at Pinellas County Sheriff\u2019s Office are investigating an unlawful computer software intrusion at the City of Oldsmar\u2019s water treatment plant. While the cyber attack was unsuccessful, it does highlight the need for cybersecurity tools in critical infrastructure applications.\n\nOn Friday, February 5, 2021, the Pinellas County Sheriff\u2019s Office was notified by the City of Oldsmar that its computer system had been remotely accessed at 8:00am and 1:30pm by an unknown suspect. According to detectives, the City of Oldsmar\u2019s computer system at the water treatment plant allows for remote access by authorised users to troubleshoot any system problems from other locations.\n\nThe initial intrusion was brief and not cause for concern due to supervisors regularly accessing the system remotely to monitor the system. At 1:30, a plant operator witnessed a second remote access user opening various functions in the system that control the amount of sodium hydroxide in the water. The operator noted the remote access user raised the levels of sodium hydroxide in the water from 100 parts per million to 11,100 parts per million. The operator immediately reduced the levels to their appropriate amount. Sodium hydroxide is used in small amounts to control acidity, but a large amount could have caused major problems in the water.\n\nThe initial investigation revealed that the hacker remotely accessed the treatment plant\u2019s computer for approximately 3 to 5 minutes. Speaking at a press conference about the cyber attack, Sheriff Bob Gualtieri stated: \u201cAt no time was there a significant effect on the water being treated, and more importantly the public was never in danger.\u201d\n\nCommenting on the attack, Andrea Carcano, co-founder at Nozomi Networks stated: \u201cUnfortunately, this attack plays into a troubling trend we\u2019ve been following over the last year. As the pandemic forced critical infrastructure organisations to quickly shift to remote access options to keep systems up and running, we\u2019ve seen threats rise and bad actors reach new lows \u2013 setting their sights on life threatening targets. Fortunately, in this case, operators monitoring Oldsmar\u2019s treatment plant spotted the attack and were able to respond before anyone could be harmed. But it\u2019s a stark reminder that with limited cybersecurity resources and few regulations water utilities are vulnerable to attack. When it comes critical infrastructure, operational resilience must a top priority and advances in AI-powered OT security and network monitoring are available to give operators the network visibility they need to quickly spot trouble and respond before harm is done.\u201d\n\n\u201cThis targeted attack appears to have started by the \u2018bad actor\u2019 getting access to a vulnerable network\/system and working their way through the network trying to find the next weak access point while gathering data and understanding how the organisation operates along the way,\u201d added Niamh Muldoon, Global Data Protection Officer at OneLogin. \u201cIn this instance, understanding the information assets, applying not only MFA but enhanced multi-factor authentication, would have reduced the risk of this unauthorised attack materializing. It\u2019s a critical part of the MFA policy to enforce time limits for end-users and their trusted devices to re-authenticate, requiring them not only to validate themselves but also the identity of the device trying to access critical systems\/applications and the network. Without knowing more of the details, applying enhanced MFA to the execution of critical actions particularly for IT and systems administrators would have reduced the associated risk further. Having logging in place, and understanding logged events would support with the associated monitoring and alerting events. After the event has happened, crisis management is critical for successfully managing the attack response to reduce business impact and consequences, and it appears the Florida agency has done that.\u201d\n\n\u201cWhile this incident will rightfully cause concern, it appears that likelihood of real damage was minimal due to the fail safes in place,\u201d observes Tim Erlin, VP at Tripwire. \u201cThere are real impacts to be worried about, and actions to be taken, but this doesn\u2019t appear to be a sophisticated or novel attack. From a cybersecurity standpoint, we should be particularly concerned about how the attacker was able to authenticate into the remote access software. That entry point should be very well protected, given that it provides access to such obviously sensitive capabilities. Protecting remote access into industrial systems where these types of changes can be made should be a high priority for any industrial environment.\u201d\n\nLocal, State, and Federal investigators are working together to identify those responsible and the investigation is ongoing. Other utility providers have been informed of the intrusion, so they can take their own protective measures.","post_title":"Florida water system cyber attack highlights role of cybersecurity in critical infrastructure","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"florida-water-system-cyber-attack-highlights-role-of-cybersecurity-in-critical-infrastructure","to_ping":"","pinged":"","post_modified":"2021-02-09 19:22:25","post_modified_gmt":"2021-02-09 19:22:25","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4871","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4178,"post_author":"3","post_date":"2020-12-07 14:52:36","post_date_gmt":"2020-12-07 14:52:36","post_content":"Nozomi Networks and Chinook Systems have partnered to provide advanced cybersecurity solutions to protect industrial and critical infrastructure facilities across North America. Under the deal, Chinook will offer Nozomi Networks\u2019 complete portfolio of OT and IoT security solutions.\n\n\u201cFacilities that fully leverage their OT systems deliver tremendous returns when it comes to energy and operational savings, the safety and comfort of occupants and lower total cost of ownership,\u201d said Chinook\u2019s President, Wanda Lenkewich. \u201cAt the same time, the network connectivity that enables these systems, also introduces new and growing cyber threats. Partnering with Nozomi Networks allows Chinook to support clients with an integrated, comprehensive cybersecurity solution that ensures cyber threats are actively discovered, monitored and managed.\u201d\n\n\u201cWe are absolutely delighted to team with Chinook to help industrial and critical infrastructure facilities meet new requirements for secure connectivity across OT, IT and IoT networks,\u201d said Chet Namboodri, Vice President, Worldwide Business Development and Channel Sales at Nozomi. \u201cWe\u2019ve already worked together to deliver on a number of joint customer engagements in both the government and commercial sectors. Partnering with Chinook accelerates our joint efforts to make sure facility-related control and building management systems are safe from cyber threats.\u201d\n\nwww.nozominetworks.com<\/a>\n\nwww.chinooksystems.com<\/a>\n\n ","post_title":"Nozomi Networks and Chinook Systems partner for OT and IoT security solutions","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"nozomi-networks-and-chinook-systems-partner-for-ot-and-iot-security-solutions","to_ping":"","pinged":"","post_modified":"2020-12-07 14:52:40","post_modified_gmt":"2020-12-07 14:52:40","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4178","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4140,"post_author":"3","post_date":"2020-12-03 11:07:21","post_date_gmt":"2020-12-03 11:07:21","post_content":"Civil Nuclear Constabulary (CNC) police officers based at Harwell have launched Project Servator a collaborative community approach to policing. Project Servator aims to disrupt a range of criminal activity, including terrorism, while providing a reassuring presence for the public.\n\nCNC\u2019s officers are experienced and specially trained to spot the tell-tale signs that someone is planning or preparing to commit an illegal act. It works with other police forces, local businesses and the public to protect the Harwell site and the surrounding area and everyone who lives, works or visits there and to make it a difficult place for terrorists and other criminals to operate. Project Servator has been successful in gathering intelligence that has assisted Counter Terrorism Units across the UK in investigating and preventing acts of terror.\n\nProject Servator\u2019s patrols are highly visible and can happen at any time and in any location. Officers will talk to the public and local businesses to let them know what they\u2019re doing and remind them to be vigilant, trust their instincts and report any suspicious or unusual behaviour.\n\n\u201cWe are deploying these additional tactics to further complement the operational activity that exists in and around our Operational Policing Units,\u201d explained Supt Donna Jones, who is leading on the implementation of the project across the Constabulary. \u201cOur aim is to build upon relationships with partners as well as businesses and communities. These tactics are not new but allow us to have a focus on community engagement and encourage people to be our extra eyes and ears. This is not restricted to the Harwell site but also extends to the surrounding area. We are aware of the vast amount of information members of our community have and they are aware of what is out of the ordinary. All we ask is that they report any suspicions to us and we\u2019ll do the rest. The deployments will be unpredictable and our tactics will vary from one deployment to the next. The aim is to work with our local communities to deter any hostile threat.\u201d\n\nwww.gov.uk\/government\/organisations\/civil-nuclear-constabulary<\/a>","post_title":"CNC Harwell launches Project Servator","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"cnc-harwell-launches-project-servator","to_ping":"","pinged":"","post_modified":"2020-12-03 11:07:23","post_modified_gmt":"2020-12-03 11:07:23","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4140","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4102,"post_author":"3","post_date":"2020-11-30 17:30:23","post_date_gmt":"2020-11-30 17:30:23","post_content":"Radiflow and Mitsubishi Electric UK are collaborating to address the needs of IEC62443 cyber security standards in the Critical Infrastructure and Industrial Automation markets. The companys believe that the combination of the automation knowledge and tools of Mitsubishi Electric UK with the cyber security and IEC 62443 compliance skills of Radiflow will provide a holistic view of a client\u2019s risk posture.\n\nRadiflow will also provide Mitsubishi Electric UK customers with a consultancy service for cyber security, which includes the provision of OT security risk assessments, provision of Radiflow intrusion detection software and general advice on alignment with IEC 62443-3. In addition, the solution is intended to help customers to support asset owners in satisfying the requirements of the NIS Directive along with due diligence in alignment with CPNI (Centre for the Protection of National Infrastructure) best practice.\n\n\u201cOur new collaboration with Radiflow provides expertise in the field of OT cyber security which compliments and broadens the services that we offer our customers through the Mitsubishi Electric UK System Service Operation,\u201d said David Bean, Solutions Manager for Mitsubishi Electric UK. \u201cThere is a growing demand for solutions that address the requirements of cyber security in the OT space and we are looking forward to delivering those solutions and building our relationship further with the team at Radiflow.\u201d\n\n\u201cRadiflow sees huge value for OT organisations to have cyber security services and solutions aligned with their automation systems,\u201d added Ilan Barda, Founder and CEO of Radiflow. \u201cBy combining the automation knowledge and tools of Mitsubishi with the OT cyber security skills and tools of Radiflow, we are able to provide a holistic view of an organisation\u2019s OT risk posture.\u201d\n\nwww.radiflow.com<\/a>","post_title":"Radiflow and Mitsubishi Electric UK collaborate on cyber security standards","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"radiflow-and-mitsubishi-electric-uk-collaborate-on-cyber-security-standards","to_ping":"","pinged":"","post_modified":"2020-11-30 17:30:25","post_modified_gmt":"2020-11-30 17:30:25","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4102","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":3359,"post_author":"3","post_date":"2020-10-16 17:11:16","post_date_gmt":"2020-10-16 16:11:16","post_content":"Senstar explains how its products can be applied to protect the full range of upstream, midstream, and downstream facilities in the oil and gas industry.","post_title":"Senstar explains its security solutions for oil and gas","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"senstar-explains-its-security-solutions-for-oil-and-gas","to_ping":"","pinged":"","post_modified":"2020-10-16 17:11:17","post_modified_gmt":"2020-10-16 16:11:17","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=3359","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"}],"next":false,"prev":false,"total_page":1},"paged":1,"column_class":"jeg_col_2o3","class":"epic_block_14"};

\n

The US government issued an emergency legislation on Sunday after The Colonial Pipeline (located in Alpharetta, Georgia) was hit by a severe ransomware attack. The largest fuel pipeline in the US, the Colonial Pipeline carries 2.5 million barrels a day - 45% of the East Coast's supply of diesel, petrol and jet fuel.<\/p>\n\n\n\n

Sources said the ransomware attack was likely to have been caused by a cyber-criminal gang called DarkSide, who infiltrated Colonial's network and locked the data on some computers and servers, demanding a ransom on Friday. The gang tried to take almost 100 gigabytes of data hostage, threatening to leak it onto the internet, but the FBI and other government agencies worked with private companies to respond. <\/p>\n\n\n\n

Subsequently, the operator took itself offline on Friday after the cyber-attack was discovered, with the cloud computing system that was used by the hackers to collect the stolen data was taken offline on Saturday. Colonial's data did not appear to have been transferred from that system anywhere else, potentially limiting the hackers' leverage to extort or further embarrass the company. <\/p>\n\n\n\n

On Sunday, Colonial said that although its four main pipelines remain offline, some smaller lines between terminals and delivery points were now operational. The US government has now relaxed rules on fuel being transported by road, meaning drivers in 18 states can work extra or more flexible hours when transporting refined petroleum products.<\/p>\n\n\n\n

While US fuel prices at the pump were largely unaffected on Monday, there are fears that could change if the shutdown is prolonged. <\/p>\n\n\n\n

\"The fact that the US government has quickly issued emergency legislation to relax rules on road fuel transportation highlights how concerning this attack is...\"<\/p>Lewis Jones, Threat Intelligence Analyst, Talion<\/cite><\/blockquote><\/figure>\n\n\n\n

A major disruption<\/strong><\/p>\n\n\n\n

In response to this substantial attack, Lewis Jones, Threat Intelligence Analyst at Talion says: \u201cThis appears to be one of the most disruptive ransomware attacks ever reported, highlighting the vulnerabilities in the energy sector and why it is often targeted by attackers. A long term ransomware negotiation within the energy sector could cause mass disruption and means that the likelihood of payment is increased. <\/p>\n\n\n\n

\"The fact that US government has quickly issued emergency legislation to relax rules on road fuel transportation highlights how concerning this attack is. A longer term implication of the attack could create a delay in delivery and disruption of the supply chain. This would cause an increase in price at a time when the economy is already fragile due to the current pandemic.\" <\/p>\n\n\n\n

Computer security service, Digital Shadows has claimed that the Colonial attack was indeed helped by the coronavirus pandemic, with more engineers remotely accessing control systems for the pipeline from home. James Chappell, Co-Founder of Digital Shadows, said DarkSide could have bought account login details for remote desktop software such as TeamViewer and Microsoft Remote Desktop.<\/p>\n\n\n\n

\"We're seeing a lot of victims now, this is seriously a big problem,\" said Chappell in a statement. \"The amount of small businesses that are falling victim <\/a>to this. It's becoming a big problem for the economy globally.\"<\/p>\n\n\n\n

\"Cybercriminals don\u2019t really care how important your business is, only how much money they might extract from you,\" comments Tim Mackey Principal Security Strategist at the Synopsys CyRC (Cybersecurity Research Centre). \"This trend can be seen with increasing attacks on municipalities, healthcare systems, and elements of critical infrastructure. Each of these organisations will bring in law enforcement, yet attackers continue to be aggressive in their activities. <\/p>\n\n\n\n

\"While Colonial Pipeline is a US operation, attacks are global in scope. And despite warnings from officials like the US Treasury Department highlighting how ransomware payments are used to fund future criminal activities, victims are often faced with the difficult decision of whether to pay the ransom.\"<\/p>\n\n\n\n

\"The Colonial Pipeline attack reinforces the need to update legacy systems running today\u2019s critical infrastructure networks...\"<\/p>Lior Div, CEO and Co-founder, Cybereason<\/cite><\/blockquote><\/figure>\n\n\n\n

Remaining critical <\/strong><\/p>\n\n\n\n

\u201cThese \u2018Cyber Physical\u2019 attacks are a big deal, because they demonstrate just how fragile the provision of critical services are into society,\" says Andy Norton European Cyber Risk Officer at Armis. \"A few weeks ago a water treatment plant<\/a> was compromised leading to the potential for poisoning of the water. Now, 45% of the US oil energy provision has been switched off to the East coast. Prolonged shortages in critical services lead to civil unrest, economic pressures, and a general lack of confidence in public administration.\" <\/p>\n\n\n\n

Lior Div, CEO and Co-founder of Cybereason also comments: \"The SolarWinds<\/a> and Microsoft Exchange Server<\/a> attacks were unparalleled in their scope, successfully infiltrating and compromising virtually every US government agency and a wide array of medium and large private sector companies. The Colonial Pipeline attack reinforces the need to update legacy systems running today\u2019s critical infrastructure networks.<\/p>\n\n\n\n

\"If the public and private sectors can work together to solve complex cybersecurity issues, and at the same time accurately identify the threat actors and bring them to account for their actions, it will go a long way in reversing the adversary advantage and enable defenders to retake the high ground. There is also another significant opportunity here as well to cooperate on a global scale to develop extradition laws that enable cyber crimes and cyber espionage to be prosecuted more effectively.\u201d<\/p>\n\n\n\n

Mackey agrees, stating: \"Avoiding becoming a victim of ransomware requires organisations to have a comprehensive cybersecurity plan in place that fully captures the risks of each software component, its role and lifecycle, and its deployment configuration and usage assumptions. Armed with this basic information, and an exhaustive inventory, it becomes possible to determine how each component might play a role in an attempted ransomware attack. <\/p>\n\n\n\n

\"An effort like the one impacting Colonial Pipeline is likely the result of multiple weaknesses in process and cyber-defences that were ultimately successfully exploited. With the age of some industrial software systems far exceeding that of commercial software, it\u2019s likely that older software wasn\u2019t designed to limit exposure to modern threats like ransomware attacks. <\/p>\n\n\n\n

\"While the age of the software has limited impact on its serviceability, threat models and defensive protections need to keep pace with new threats \u2013 something that can only be done if all weaknesses present in each component are known and accounted for. After all, if a criminal can identify your weaknesses faster than you can, luck is rarely on your side.\u201d<\/p>\n\n\n\n

\"While this is indeed a financial disaster, and will have a significant impact on many, let us also consider that this means that, at least for a time, threat actors had control of those very same IT systems.\"<\/p>Martin Jartelius, CSO, Outpost24<\/cite><\/blockquote><\/figure>\n\n\n\n

Taking back control <\/strong><\/p>\n\n\n\n

US government officials are currently working with Colonial to help it recover while scrambling to avoid more severe fuel supply disruptions should the outage continue. Whether the pipeline stays shut that long in turn depends on how deeply the hackers penetrated Colonial\u2019s network - and how soon cybersecurity experts can pull them out.<\/p>\n\n\n\n

\"As so many times before when talking about ransomware \u2013 to lock a system with ransomware you need a good degree of control of that system,\" says Martin Jartelius, CSO at Outpost24. \"While this is indeed a financial disaster, and will have a significant impact on many, let us also consider that this means that, at least for a time, threat actors had control of those very same IT systems. Preventive security, as well as segmentation, are critical for those kinds of environments.\"<\/p>\n\n\n\n

\"One thing to note here is that ransomware has to announce itself to be successful,\" adds Tim Erlin, VP at Tripwire. \"In industrial environments, cyber events aren\u2019t always this visible. Increasing visibility into industrial networks becomes more important as attackers continue to target critical infrastructure.\u201d<\/p>\n\n\n\n

Brad Brooks, CEO and President of OneLogin, rightfully concludes: \"This attack represents just how quickly the stakes are escalating on Cybersecurity, with controlling and knowing who has access to your IT systems a board level priority for every company. We are moving from an invisible Cold War that was focused on stealing data to a highly visible hot war that has real implications for physical property and people\u2019s lives.\u201d<\/p>\n","post_title":"Ransomware roundtable | A threat in the pipeline","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"ransomware-roundtable-a-threat-in-the-pipeline","to_ping":"","pinged":"","post_modified":"2021-05-10 18:12:55","post_modified_gmt":"2021-05-10 17:12:55","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=6024","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4871,"post_author":"3","post_date":"2021-02-09 19:22:22","post_date_gmt":"2021-02-09 19:22:22","post_content":"Detectives assigned to the Digital Forensics Unit at Pinellas County Sheriff\u2019s Office are investigating an unlawful computer software intrusion at the City of Oldsmar\u2019s water treatment plant. While the cyber attack was unsuccessful, it does highlight the need for cybersecurity tools in critical infrastructure applications.\n\nOn Friday, February 5, 2021, the Pinellas County Sheriff\u2019s Office was notified by the City of Oldsmar that its computer system had been remotely accessed at 8:00am and 1:30pm by an unknown suspect. According to detectives, the City of Oldsmar\u2019s computer system at the water treatment plant allows for remote access by authorised users to troubleshoot any system problems from other locations.\n\nThe initial intrusion was brief and not cause for concern due to supervisors regularly accessing the system remotely to monitor the system. At 1:30, a plant operator witnessed a second remote access user opening various functions in the system that control the amount of sodium hydroxide in the water. The operator noted the remote access user raised the levels of sodium hydroxide in the water from 100 parts per million to 11,100 parts per million. The operator immediately reduced the levels to their appropriate amount. Sodium hydroxide is used in small amounts to control acidity, but a large amount could have caused major problems in the water.\n\nThe initial investigation revealed that the hacker remotely accessed the treatment plant\u2019s computer for approximately 3 to 5 minutes. Speaking at a press conference about the cyber attack, Sheriff Bob Gualtieri stated: \u201cAt no time was there a significant effect on the water being treated, and more importantly the public was never in danger.\u201d\n\nCommenting on the attack, Andrea Carcano, co-founder at Nozomi Networks stated: \u201cUnfortunately, this attack plays into a troubling trend we\u2019ve been following over the last year. As the pandemic forced critical infrastructure organisations to quickly shift to remote access options to keep systems up and running, we\u2019ve seen threats rise and bad actors reach new lows \u2013 setting their sights on life threatening targets. Fortunately, in this case, operators monitoring Oldsmar\u2019s treatment plant spotted the attack and were able to respond before anyone could be harmed. But it\u2019s a stark reminder that with limited cybersecurity resources and few regulations water utilities are vulnerable to attack. When it comes critical infrastructure, operational resilience must a top priority and advances in AI-powered OT security and network monitoring are available to give operators the network visibility they need to quickly spot trouble and respond before harm is done.\u201d\n\n\u201cThis targeted attack appears to have started by the \u2018bad actor\u2019 getting access to a vulnerable network\/system and working their way through the network trying to find the next weak access point while gathering data and understanding how the organisation operates along the way,\u201d added Niamh Muldoon, Global Data Protection Officer at OneLogin. \u201cIn this instance, understanding the information assets, applying not only MFA but enhanced multi-factor authentication, would have reduced the risk of this unauthorised attack materializing. It\u2019s a critical part of the MFA policy to enforce time limits for end-users and their trusted devices to re-authenticate, requiring them not only to validate themselves but also the identity of the device trying to access critical systems\/applications and the network. Without knowing more of the details, applying enhanced MFA to the execution of critical actions particularly for IT and systems administrators would have reduced the associated risk further. Having logging in place, and understanding logged events would support with the associated monitoring and alerting events. After the event has happened, crisis management is critical for successfully managing the attack response to reduce business impact and consequences, and it appears the Florida agency has done that.\u201d\n\n\u201cWhile this incident will rightfully cause concern, it appears that likelihood of real damage was minimal due to the fail safes in place,\u201d observes Tim Erlin, VP at Tripwire. \u201cThere are real impacts to be worried about, and actions to be taken, but this doesn\u2019t appear to be a sophisticated or novel attack. From a cybersecurity standpoint, we should be particularly concerned about how the attacker was able to authenticate into the remote access software. That entry point should be very well protected, given that it provides access to such obviously sensitive capabilities. Protecting remote access into industrial systems where these types of changes can be made should be a high priority for any industrial environment.\u201d\n\nLocal, State, and Federal investigators are working together to identify those responsible and the investigation is ongoing. Other utility providers have been informed of the intrusion, so they can take their own protective measures.","post_title":"Florida water system cyber attack highlights role of cybersecurity in critical infrastructure","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"florida-water-system-cyber-attack-highlights-role-of-cybersecurity-in-critical-infrastructure","to_ping":"","pinged":"","post_modified":"2021-02-09 19:22:25","post_modified_gmt":"2021-02-09 19:22:25","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4871","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4178,"post_author":"3","post_date":"2020-12-07 14:52:36","post_date_gmt":"2020-12-07 14:52:36","post_content":"Nozomi Networks and Chinook Systems have partnered to provide advanced cybersecurity solutions to protect industrial and critical infrastructure facilities across North America. Under the deal, Chinook will offer Nozomi Networks\u2019 complete portfolio of OT and IoT security solutions.\n\n\u201cFacilities that fully leverage their OT systems deliver tremendous returns when it comes to energy and operational savings, the safety and comfort of occupants and lower total cost of ownership,\u201d said Chinook\u2019s President, Wanda Lenkewich. \u201cAt the same time, the network connectivity that enables these systems, also introduces new and growing cyber threats. Partnering with Nozomi Networks allows Chinook to support clients with an integrated, comprehensive cybersecurity solution that ensures cyber threats are actively discovered, monitored and managed.\u201d\n\n\u201cWe are absolutely delighted to team with Chinook to help industrial and critical infrastructure facilities meet new requirements for secure connectivity across OT, IT and IoT networks,\u201d said Chet Namboodri, Vice President, Worldwide Business Development and Channel Sales at Nozomi. \u201cWe\u2019ve already worked together to deliver on a number of joint customer engagements in both the government and commercial sectors. Partnering with Chinook accelerates our joint efforts to make sure facility-related control and building management systems are safe from cyber threats.\u201d\n\nwww.nozominetworks.com<\/a>\n\nwww.chinooksystems.com<\/a>\n\n ","post_title":"Nozomi Networks and Chinook Systems partner for OT and IoT security solutions","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"nozomi-networks-and-chinook-systems-partner-for-ot-and-iot-security-solutions","to_ping":"","pinged":"","post_modified":"2020-12-07 14:52:40","post_modified_gmt":"2020-12-07 14:52:40","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4178","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4140,"post_author":"3","post_date":"2020-12-03 11:07:21","post_date_gmt":"2020-12-03 11:07:21","post_content":"Civil Nuclear Constabulary (CNC) police officers based at Harwell have launched Project Servator a collaborative community approach to policing. Project Servator aims to disrupt a range of criminal activity, including terrorism, while providing a reassuring presence for the public.\n\nCNC\u2019s officers are experienced and specially trained to spot the tell-tale signs that someone is planning or preparing to commit an illegal act. It works with other police forces, local businesses and the public to protect the Harwell site and the surrounding area and everyone who lives, works or visits there and to make it a difficult place for terrorists and other criminals to operate. Project Servator has been successful in gathering intelligence that has assisted Counter Terrorism Units across the UK in investigating and preventing acts of terror.\n\nProject Servator\u2019s patrols are highly visible and can happen at any time and in any location. Officers will talk to the public and local businesses to let them know what they\u2019re doing and remind them to be vigilant, trust their instincts and report any suspicious or unusual behaviour.\n\n\u201cWe are deploying these additional tactics to further complement the operational activity that exists in and around our Operational Policing Units,\u201d explained Supt Donna Jones, who is leading on the implementation of the project across the Constabulary. \u201cOur aim is to build upon relationships with partners as well as businesses and communities. These tactics are not new but allow us to have a focus on community engagement and encourage people to be our extra eyes and ears. This is not restricted to the Harwell site but also extends to the surrounding area. We are aware of the vast amount of information members of our community have and they are aware of what is out of the ordinary. All we ask is that they report any suspicions to us and we\u2019ll do the rest. The deployments will be unpredictable and our tactics will vary from one deployment to the next. The aim is to work with our local communities to deter any hostile threat.\u201d\n\nwww.gov.uk\/government\/organisations\/civil-nuclear-constabulary<\/a>","post_title":"CNC Harwell launches Project Servator","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"cnc-harwell-launches-project-servator","to_ping":"","pinged":"","post_modified":"2020-12-03 11:07:23","post_modified_gmt":"2020-12-03 11:07:23","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4140","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4102,"post_author":"3","post_date":"2020-11-30 17:30:23","post_date_gmt":"2020-11-30 17:30:23","post_content":"Radiflow and Mitsubishi Electric UK are collaborating to address the needs of IEC62443 cyber security standards in the Critical Infrastructure and Industrial Automation markets. The companys believe that the combination of the automation knowledge and tools of Mitsubishi Electric UK with the cyber security and IEC 62443 compliance skills of Radiflow will provide a holistic view of a client\u2019s risk posture.\n\nRadiflow will also provide Mitsubishi Electric UK customers with a consultancy service for cyber security, which includes the provision of OT security risk assessments, provision of Radiflow intrusion detection software and general advice on alignment with IEC 62443-3. In addition, the solution is intended to help customers to support asset owners in satisfying the requirements of the NIS Directive along with due diligence in alignment with CPNI (Centre for the Protection of National Infrastructure) best practice.\n\n\u201cOur new collaboration with Radiflow provides expertise in the field of OT cyber security which compliments and broadens the services that we offer our customers through the Mitsubishi Electric UK System Service Operation,\u201d said David Bean, Solutions Manager for Mitsubishi Electric UK. \u201cThere is a growing demand for solutions that address the requirements of cyber security in the OT space and we are looking forward to delivering those solutions and building our relationship further with the team at Radiflow.\u201d\n\n\u201cRadiflow sees huge value for OT organisations to have cyber security services and solutions aligned with their automation systems,\u201d added Ilan Barda, Founder and CEO of Radiflow. \u201cBy combining the automation knowledge and tools of Mitsubishi with the OT cyber security skills and tools of Radiflow, we are able to provide a holistic view of an organisation\u2019s OT risk posture.\u201d\n\nwww.radiflow.com<\/a>","post_title":"Radiflow and Mitsubishi Electric UK collaborate on cyber security standards","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"radiflow-and-mitsubishi-electric-uk-collaborate-on-cyber-security-standards","to_ping":"","pinged":"","post_modified":"2020-11-30 17:30:25","post_modified_gmt":"2020-11-30 17:30:25","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4102","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":3359,"post_author":"3","post_date":"2020-10-16 17:11:16","post_date_gmt":"2020-10-16 16:11:16","post_content":"Senstar explains how its products can be applied to protect the full range of upstream, midstream, and downstream facilities in the oil and gas industry.","post_title":"Senstar explains its security solutions for oil and gas","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"senstar-explains-its-security-solutions-for-oil-and-gas","to_ping":"","pinged":"","post_modified":"2020-10-16 17:11:17","post_modified_gmt":"2020-10-16 16:11:17","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=3359","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"}],"next":false,"prev":false,"total_page":1},"paged":1,"column_class":"jeg_col_2o3","class":"epic_block_14"};

\n

The latest roundtable discussion from Security on Screen analyses the Colonial Pipeline's major ransomware attack and how it highlights the risk ransomware can pose, not just to businesses, but to critical national industrial infrastructure <\/em><\/p>\n\n\n\n

The US government issued an emergency legislation on Sunday after The Colonial Pipeline (located in Alpharetta, Georgia) was hit by a severe ransomware attack. The largest fuel pipeline in the US, the Colonial Pipeline carries 2.5 million barrels a day - 45% of the East Coast's supply of diesel, petrol and jet fuel.<\/p>\n\n\n\n

Sources said the ransomware attack was likely to have been caused by a cyber-criminal gang called DarkSide, who infiltrated Colonial's network and locked the data on some computers and servers, demanding a ransom on Friday. The gang tried to take almost 100 gigabytes of data hostage, threatening to leak it onto the internet, but the FBI and other government agencies worked with private companies to respond. <\/p>\n\n\n\n

Subsequently, the operator took itself offline on Friday after the cyber-attack was discovered, with the cloud computing system that was used by the hackers to collect the stolen data was taken offline on Saturday. Colonial's data did not appear to have been transferred from that system anywhere else, potentially limiting the hackers' leverage to extort or further embarrass the company. <\/p>\n\n\n\n

On Sunday, Colonial said that although its four main pipelines remain offline, some smaller lines between terminals and delivery points were now operational. The US government has now relaxed rules on fuel being transported by road, meaning drivers in 18 states can work extra or more flexible hours when transporting refined petroleum products.<\/p>\n\n\n\n

While US fuel prices at the pump were largely unaffected on Monday, there are fears that could change if the shutdown is prolonged. <\/p>\n\n\n\n

\"The fact that the US government has quickly issued emergency legislation to relax rules on road fuel transportation highlights how concerning this attack is...\"<\/p>Lewis Jones, Threat Intelligence Analyst, Talion<\/cite><\/blockquote><\/figure>\n\n\n\n

A major disruption<\/strong><\/p>\n\n\n\n

In response to this substantial attack, Lewis Jones, Threat Intelligence Analyst at Talion says: \u201cThis appears to be one of the most disruptive ransomware attacks ever reported, highlighting the vulnerabilities in the energy sector and why it is often targeted by attackers. A long term ransomware negotiation within the energy sector could cause mass disruption and means that the likelihood of payment is increased. <\/p>\n\n\n\n

\"The fact that US government has quickly issued emergency legislation to relax rules on road fuel transportation highlights how concerning this attack is. A longer term implication of the attack could create a delay in delivery and disruption of the supply chain. This would cause an increase in price at a time when the economy is already fragile due to the current pandemic.\" <\/p>\n\n\n\n

Computer security service, Digital Shadows has claimed that the Colonial attack was indeed helped by the coronavirus pandemic, with more engineers remotely accessing control systems for the pipeline from home. James Chappell, Co-Founder of Digital Shadows, said DarkSide could have bought account login details for remote desktop software such as TeamViewer and Microsoft Remote Desktop.<\/p>\n\n\n\n

\"We're seeing a lot of victims now, this is seriously a big problem,\" said Chappell in a statement. \"The amount of small businesses that are falling victim <\/a>to this. It's becoming a big problem for the economy globally.\"<\/p>\n\n\n\n

\"Cybercriminals don\u2019t really care how important your business is, only how much money they might extract from you,\" comments Tim Mackey Principal Security Strategist at the Synopsys CyRC (Cybersecurity Research Centre). \"This trend can be seen with increasing attacks on municipalities, healthcare systems, and elements of critical infrastructure. Each of these organisations will bring in law enforcement, yet attackers continue to be aggressive in their activities. <\/p>\n\n\n\n

\"While Colonial Pipeline is a US operation, attacks are global in scope. And despite warnings from officials like the US Treasury Department highlighting how ransomware payments are used to fund future criminal activities, victims are often faced with the difficult decision of whether to pay the ransom.\"<\/p>\n\n\n\n

\"The Colonial Pipeline attack reinforces the need to update legacy systems running today\u2019s critical infrastructure networks...\"<\/p>Lior Div, CEO and Co-founder, Cybereason<\/cite><\/blockquote><\/figure>\n\n\n\n

Remaining critical <\/strong><\/p>\n\n\n\n

\u201cThese \u2018Cyber Physical\u2019 attacks are a big deal, because they demonstrate just how fragile the provision of critical services are into society,\" says Andy Norton European Cyber Risk Officer at Armis. \"A few weeks ago a water treatment plant<\/a> was compromised leading to the potential for poisoning of the water. Now, 45% of the US oil energy provision has been switched off to the East coast. Prolonged shortages in critical services lead to civil unrest, economic pressures, and a general lack of confidence in public administration.\" <\/p>\n\n\n\n

Lior Div, CEO and Co-founder of Cybereason also comments: \"The SolarWinds<\/a> and Microsoft Exchange Server<\/a> attacks were unparalleled in their scope, successfully infiltrating and compromising virtually every US government agency and a wide array of medium and large private sector companies. The Colonial Pipeline attack reinforces the need to update legacy systems running today\u2019s critical infrastructure networks.<\/p>\n\n\n\n

\"If the public and private sectors can work together to solve complex cybersecurity issues, and at the same time accurately identify the threat actors and bring them to account for their actions, it will go a long way in reversing the adversary advantage and enable defenders to retake the high ground. There is also another significant opportunity here as well to cooperate on a global scale to develop extradition laws that enable cyber crimes and cyber espionage to be prosecuted more effectively.\u201d<\/p>\n\n\n\n

Mackey agrees, stating: \"Avoiding becoming a victim of ransomware requires organisations to have a comprehensive cybersecurity plan in place that fully captures the risks of each software component, its role and lifecycle, and its deployment configuration and usage assumptions. Armed with this basic information, and an exhaustive inventory, it becomes possible to determine how each component might play a role in an attempted ransomware attack. <\/p>\n\n\n\n

\"An effort like the one impacting Colonial Pipeline is likely the result of multiple weaknesses in process and cyber-defences that were ultimately successfully exploited. With the age of some industrial software systems far exceeding that of commercial software, it\u2019s likely that older software wasn\u2019t designed to limit exposure to modern threats like ransomware attacks. <\/p>\n\n\n\n

\"While the age of the software has limited impact on its serviceability, threat models and defensive protections need to keep pace with new threats \u2013 something that can only be done if all weaknesses present in each component are known and accounted for. After all, if a criminal can identify your weaknesses faster than you can, luck is rarely on your side.\u201d<\/p>\n\n\n\n

\"While this is indeed a financial disaster, and will have a significant impact on many, let us also consider that this means that, at least for a time, threat actors had control of those very same IT systems.\"<\/p>Martin Jartelius, CSO, Outpost24<\/cite><\/blockquote><\/figure>\n\n\n\n

Taking back control <\/strong><\/p>\n\n\n\n

US government officials are currently working with Colonial to help it recover while scrambling to avoid more severe fuel supply disruptions should the outage continue. Whether the pipeline stays shut that long in turn depends on how deeply the hackers penetrated Colonial\u2019s network - and how soon cybersecurity experts can pull them out.<\/p>\n\n\n\n

\"As so many times before when talking about ransomware \u2013 to lock a system with ransomware you need a good degree of control of that system,\" says Martin Jartelius, CSO at Outpost24. \"While this is indeed a financial disaster, and will have a significant impact on many, let us also consider that this means that, at least for a time, threat actors had control of those very same IT systems. Preventive security, as well as segmentation, are critical for those kinds of environments.\"<\/p>\n\n\n\n

\"One thing to note here is that ransomware has to announce itself to be successful,\" adds Tim Erlin, VP at Tripwire. \"In industrial environments, cyber events aren\u2019t always this visible. Increasing visibility into industrial networks becomes more important as attackers continue to target critical infrastructure.\u201d<\/p>\n\n\n\n

Brad Brooks, CEO and President of OneLogin, rightfully concludes: \"This attack represents just how quickly the stakes are escalating on Cybersecurity, with controlling and knowing who has access to your IT systems a board level priority for every company. We are moving from an invisible Cold War that was focused on stealing data to a highly visible hot war that has real implications for physical property and people\u2019s lives.\u201d<\/p>\n","post_title":"Ransomware roundtable | A threat in the pipeline","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"ransomware-roundtable-a-threat-in-the-pipeline","to_ping":"","pinged":"","post_modified":"2021-05-10 18:12:55","post_modified_gmt":"2021-05-10 17:12:55","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=6024","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4871,"post_author":"3","post_date":"2021-02-09 19:22:22","post_date_gmt":"2021-02-09 19:22:22","post_content":"Detectives assigned to the Digital Forensics Unit at Pinellas County Sheriff\u2019s Office are investigating an unlawful computer software intrusion at the City of Oldsmar\u2019s water treatment plant. While the cyber attack was unsuccessful, it does highlight the need for cybersecurity tools in critical infrastructure applications.\n\nOn Friday, February 5, 2021, the Pinellas County Sheriff\u2019s Office was notified by the City of Oldsmar that its computer system had been remotely accessed at 8:00am and 1:30pm by an unknown suspect. According to detectives, the City of Oldsmar\u2019s computer system at the water treatment plant allows for remote access by authorised users to troubleshoot any system problems from other locations.\n\nThe initial intrusion was brief and not cause for concern due to supervisors regularly accessing the system remotely to monitor the system. At 1:30, a plant operator witnessed a second remote access user opening various functions in the system that control the amount of sodium hydroxide in the water. The operator noted the remote access user raised the levels of sodium hydroxide in the water from 100 parts per million to 11,100 parts per million. The operator immediately reduced the levels to their appropriate amount. Sodium hydroxide is used in small amounts to control acidity, but a large amount could have caused major problems in the water.\n\nThe initial investigation revealed that the hacker remotely accessed the treatment plant\u2019s computer for approximately 3 to 5 minutes. Speaking at a press conference about the cyber attack, Sheriff Bob Gualtieri stated: \u201cAt no time was there a significant effect on the water being treated, and more importantly the public was never in danger.\u201d\n\nCommenting on the attack, Andrea Carcano, co-founder at Nozomi Networks stated: \u201cUnfortunately, this attack plays into a troubling trend we\u2019ve been following over the last year. As the pandemic forced critical infrastructure organisations to quickly shift to remote access options to keep systems up and running, we\u2019ve seen threats rise and bad actors reach new lows \u2013 setting their sights on life threatening targets. Fortunately, in this case, operators monitoring Oldsmar\u2019s treatment plant spotted the attack and were able to respond before anyone could be harmed. But it\u2019s a stark reminder that with limited cybersecurity resources and few regulations water utilities are vulnerable to attack. When it comes critical infrastructure, operational resilience must a top priority and advances in AI-powered OT security and network monitoring are available to give operators the network visibility they need to quickly spot trouble and respond before harm is done.\u201d\n\n\u201cThis targeted attack appears to have started by the \u2018bad actor\u2019 getting access to a vulnerable network\/system and working their way through the network trying to find the next weak access point while gathering data and understanding how the organisation operates along the way,\u201d added Niamh Muldoon, Global Data Protection Officer at OneLogin. \u201cIn this instance, understanding the information assets, applying not only MFA but enhanced multi-factor authentication, would have reduced the risk of this unauthorised attack materializing. It\u2019s a critical part of the MFA policy to enforce time limits for end-users and their trusted devices to re-authenticate, requiring them not only to validate themselves but also the identity of the device trying to access critical systems\/applications and the network. Without knowing more of the details, applying enhanced MFA to the execution of critical actions particularly for IT and systems administrators would have reduced the associated risk further. Having logging in place, and understanding logged events would support with the associated monitoring and alerting events. After the event has happened, crisis management is critical for successfully managing the attack response to reduce business impact and consequences, and it appears the Florida agency has done that.\u201d\n\n\u201cWhile this incident will rightfully cause concern, it appears that likelihood of real damage was minimal due to the fail safes in place,\u201d observes Tim Erlin, VP at Tripwire. \u201cThere are real impacts to be worried about, and actions to be taken, but this doesn\u2019t appear to be a sophisticated or novel attack. From a cybersecurity standpoint, we should be particularly concerned about how the attacker was able to authenticate into the remote access software. That entry point should be very well protected, given that it provides access to such obviously sensitive capabilities. Protecting remote access into industrial systems where these types of changes can be made should be a high priority for any industrial environment.\u201d\n\nLocal, State, and Federal investigators are working together to identify those responsible and the investigation is ongoing. Other utility providers have been informed of the intrusion, so they can take their own protective measures.","post_title":"Florida water system cyber attack highlights role of cybersecurity in critical infrastructure","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"florida-water-system-cyber-attack-highlights-role-of-cybersecurity-in-critical-infrastructure","to_ping":"","pinged":"","post_modified":"2021-02-09 19:22:25","post_modified_gmt":"2021-02-09 19:22:25","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4871","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4178,"post_author":"3","post_date":"2020-12-07 14:52:36","post_date_gmt":"2020-12-07 14:52:36","post_content":"Nozomi Networks and Chinook Systems have partnered to provide advanced cybersecurity solutions to protect industrial and critical infrastructure facilities across North America. Under the deal, Chinook will offer Nozomi Networks\u2019 complete portfolio of OT and IoT security solutions.\n\n\u201cFacilities that fully leverage their OT systems deliver tremendous returns when it comes to energy and operational savings, the safety and comfort of occupants and lower total cost of ownership,\u201d said Chinook\u2019s President, Wanda Lenkewich. \u201cAt the same time, the network connectivity that enables these systems, also introduces new and growing cyber threats. Partnering with Nozomi Networks allows Chinook to support clients with an integrated, comprehensive cybersecurity solution that ensures cyber threats are actively discovered, monitored and managed.\u201d\n\n\u201cWe are absolutely delighted to team with Chinook to help industrial and critical infrastructure facilities meet new requirements for secure connectivity across OT, IT and IoT networks,\u201d said Chet Namboodri, Vice President, Worldwide Business Development and Channel Sales at Nozomi. \u201cWe\u2019ve already worked together to deliver on a number of joint customer engagements in both the government and commercial sectors. Partnering with Chinook accelerates our joint efforts to make sure facility-related control and building management systems are safe from cyber threats.\u201d\n\nwww.nozominetworks.com<\/a>\n\nwww.chinooksystems.com<\/a>\n\n ","post_title":"Nozomi Networks and Chinook Systems partner for OT and IoT security solutions","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"nozomi-networks-and-chinook-systems-partner-for-ot-and-iot-security-solutions","to_ping":"","pinged":"","post_modified":"2020-12-07 14:52:40","post_modified_gmt":"2020-12-07 14:52:40","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4178","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4140,"post_author":"3","post_date":"2020-12-03 11:07:21","post_date_gmt":"2020-12-03 11:07:21","post_content":"Civil Nuclear Constabulary (CNC) police officers based at Harwell have launched Project Servator a collaborative community approach to policing. Project Servator aims to disrupt a range of criminal activity, including terrorism, while providing a reassuring presence for the public.\n\nCNC\u2019s officers are experienced and specially trained to spot the tell-tale signs that someone is planning or preparing to commit an illegal act. It works with other police forces, local businesses and the public to protect the Harwell site and the surrounding area and everyone who lives, works or visits there and to make it a difficult place for terrorists and other criminals to operate. Project Servator has been successful in gathering intelligence that has assisted Counter Terrorism Units across the UK in investigating and preventing acts of terror.\n\nProject Servator\u2019s patrols are highly visible and can happen at any time and in any location. Officers will talk to the public and local businesses to let them know what they\u2019re doing and remind them to be vigilant, trust their instincts and report any suspicious or unusual behaviour.\n\n\u201cWe are deploying these additional tactics to further complement the operational activity that exists in and around our Operational Policing Units,\u201d explained Supt Donna Jones, who is leading on the implementation of the project across the Constabulary. \u201cOur aim is to build upon relationships with partners as well as businesses and communities. These tactics are not new but allow us to have a focus on community engagement and encourage people to be our extra eyes and ears. This is not restricted to the Harwell site but also extends to the surrounding area. We are aware of the vast amount of information members of our community have and they are aware of what is out of the ordinary. All we ask is that they report any suspicions to us and we\u2019ll do the rest. The deployments will be unpredictable and our tactics will vary from one deployment to the next. The aim is to work with our local communities to deter any hostile threat.\u201d\n\nwww.gov.uk\/government\/organisations\/civil-nuclear-constabulary<\/a>","post_title":"CNC Harwell launches Project Servator","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"cnc-harwell-launches-project-servator","to_ping":"","pinged":"","post_modified":"2020-12-03 11:07:23","post_modified_gmt":"2020-12-03 11:07:23","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4140","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4102,"post_author":"3","post_date":"2020-11-30 17:30:23","post_date_gmt":"2020-11-30 17:30:23","post_content":"Radiflow and Mitsubishi Electric UK are collaborating to address the needs of IEC62443 cyber security standards in the Critical Infrastructure and Industrial Automation markets. The companys believe that the combination of the automation knowledge and tools of Mitsubishi Electric UK with the cyber security and IEC 62443 compliance skills of Radiflow will provide a holistic view of a client\u2019s risk posture.\n\nRadiflow will also provide Mitsubishi Electric UK customers with a consultancy service for cyber security, which includes the provision of OT security risk assessments, provision of Radiflow intrusion detection software and general advice on alignment with IEC 62443-3. In addition, the solution is intended to help customers to support asset owners in satisfying the requirements of the NIS Directive along with due diligence in alignment with CPNI (Centre for the Protection of National Infrastructure) best practice.\n\n\u201cOur new collaboration with Radiflow provides expertise in the field of OT cyber security which compliments and broadens the services that we offer our customers through the Mitsubishi Electric UK System Service Operation,\u201d said David Bean, Solutions Manager for Mitsubishi Electric UK. \u201cThere is a growing demand for solutions that address the requirements of cyber security in the OT space and we are looking forward to delivering those solutions and building our relationship further with the team at Radiflow.\u201d\n\n\u201cRadiflow sees huge value for OT organisations to have cyber security services and solutions aligned with their automation systems,\u201d added Ilan Barda, Founder and CEO of Radiflow. \u201cBy combining the automation knowledge and tools of Mitsubishi with the OT cyber security skills and tools of Radiflow, we are able to provide a holistic view of an organisation\u2019s OT risk posture.\u201d\n\nwww.radiflow.com<\/a>","post_title":"Radiflow and Mitsubishi Electric UK collaborate on cyber security standards","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"radiflow-and-mitsubishi-electric-uk-collaborate-on-cyber-security-standards","to_ping":"","pinged":"","post_modified":"2020-11-30 17:30:25","post_modified_gmt":"2020-11-30 17:30:25","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4102","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":3359,"post_author":"3","post_date":"2020-10-16 17:11:16","post_date_gmt":"2020-10-16 16:11:16","post_content":"Senstar explains how its products can be applied to protect the full range of upstream, midstream, and downstream facilities in the oil and gas industry.","post_title":"Senstar explains its security solutions for oil and gas","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"senstar-explains-its-security-solutions-for-oil-and-gas","to_ping":"","pinged":"","post_modified":"2020-10-16 17:11:17","post_modified_gmt":"2020-10-16 16:11:17","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=3359","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"}],"next":false,"prev":false,"total_page":1},"paged":1,"column_class":"jeg_col_2o3","class":"epic_block_14"};

\n

For more Intersec news, click here<\/a> <\/p>\n","post_title":"Synectics multi-streams and multi-tasks at Intersec 2025","post_excerpt":"","post_status":"publish","comment_status":"closed","ping_status":"closed","post_password":"","post_name":"synectics-multi-streams-and-multi-tasks","to_ping":"","pinged":"","post_modified":"2025-01-20 15:37:34","post_modified_gmt":"2025-01-20 15:37:34","post_content_filtered":"","post_parent":0,"guid":"https:\/\/securityonscreen.com\/?p=25336","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":7381,"post_author":"3","post_date":"2021-08-13 16:10:10","post_date_gmt":"2021-08-13 15:10:10","post_content":"PowerVision Tech has released its new industrial drone system \u2014 PowerVision True Unmanned Aerial Solution. The solution integrates the PowerVision Dock, PowerEgg X 8K drone and the PowerVision Cloud web-based software platform. This solution can be used widely across countless applications, such as powerline inspections, environmental compliance, O&G asset inspections, facility security, GIS, surveying, and mapping.\n\nThe PowerVision True Unmanned Aerial Solution weighs 15.8kg in a 570\u00d7400\u00d7250mm form factor. This compact design allows the entire solution to be deployed by a single person, without special tools or equipment. Powered by artificial intelligence, the PowerVision True Unmanned Aerial System streamlines the drone\u2019s takeoff, flight, dynamic mission and return to the charging dock autonomously. A single installed solution can cover an area with a radius of 3.1 miles (5km). Multiple units can be connected and installed in an area to cover large-scale infrastructure projects or assets.\n\nTo meet the requirements for outdoor operations, PowerVision Dock is IP55-rated to resist dust and water in different environments. With the help of an intelligent temperature control system, it can still perform at an ambient temperature between 20\u2103 and 45\u2103. The onboard intelligent system monitors real-time temperatures, precipitation and wind to secure operational safety.\n\nThe PowerEgg X 8K uses a 1\/2-inch CMOS sensor to capture 48-megapixel photos and 8K UHD videos, all with 4x lossless zoom. Optimisations to the propellers, ESC, and the entire system have been made to achieve a 34-minute flight time. PowerEgg X 8K supports dual-band communication (2.4\/5.8GHz), interference detection and avoidance, dynamic frequency switching, anti-disturbance and real-time FHD image transmission with a max transmission distance of 7.5miles(12km). The PowerEgg X 8K can withstand the wind up to Level 7 on the Beaufort Scale (Near Gale) and fly in adverse weather conditions. A newly designed supplementary landing light automatically triggers under low light conditions to secure the take-off and landing.\n\nIn order to meet the special demands for the power industry, the PowerVision True Unmanned Aerial Solution also supports centimetre-level positioning, solar power supply and transmission extension antennas.\n\nwww.powervision.me<\/a>","post_title":"PowerVision introduces its True Unmanned Aerial Solution","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"powervision-introduces-its-true-unmanned-aerial-solution","to_ping":"","pinged":"","post_modified":"2021-08-13 16:10:16","post_modified_gmt":"2021-08-13 15:10:16","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=7381","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":6024,"post_author":"48","post_date":"2021-05-10 17:00:22","post_date_gmt":"2021-05-10 16:00:22","post_content":"\n

The latest roundtable discussion from Security on Screen analyses the Colonial Pipeline's major ransomware attack and how it highlights the risk ransomware can pose, not just to businesses, but to critical national industrial infrastructure <\/em><\/p>\n\n\n\n

The US government issued an emergency legislation on Sunday after The Colonial Pipeline (located in Alpharetta, Georgia) was hit by a severe ransomware attack. The largest fuel pipeline in the US, the Colonial Pipeline carries 2.5 million barrels a day - 45% of the East Coast's supply of diesel, petrol and jet fuel.<\/p>\n\n\n\n

Sources said the ransomware attack was likely to have been caused by a cyber-criminal gang called DarkSide, who infiltrated Colonial's network and locked the data on some computers and servers, demanding a ransom on Friday. The gang tried to take almost 100 gigabytes of data hostage, threatening to leak it onto the internet, but the FBI and other government agencies worked with private companies to respond. <\/p>\n\n\n\n

Subsequently, the operator took itself offline on Friday after the cyber-attack was discovered, with the cloud computing system that was used by the hackers to collect the stolen data was taken offline on Saturday. Colonial's data did not appear to have been transferred from that system anywhere else, potentially limiting the hackers' leverage to extort or further embarrass the company. <\/p>\n\n\n\n

On Sunday, Colonial said that although its four main pipelines remain offline, some smaller lines between terminals and delivery points were now operational. The US government has now relaxed rules on fuel being transported by road, meaning drivers in 18 states can work extra or more flexible hours when transporting refined petroleum products.<\/p>\n\n\n\n

While US fuel prices at the pump were largely unaffected on Monday, there are fears that could change if the shutdown is prolonged. <\/p>\n\n\n\n

\"The fact that the US government has quickly issued emergency legislation to relax rules on road fuel transportation highlights how concerning this attack is...\"<\/p>Lewis Jones, Threat Intelligence Analyst, Talion<\/cite><\/blockquote><\/figure>\n\n\n\n

A major disruption<\/strong><\/p>\n\n\n\n

In response to this substantial attack, Lewis Jones, Threat Intelligence Analyst at Talion says: \u201cThis appears to be one of the most disruptive ransomware attacks ever reported, highlighting the vulnerabilities in the energy sector and why it is often targeted by attackers. A long term ransomware negotiation within the energy sector could cause mass disruption and means that the likelihood of payment is increased. <\/p>\n\n\n\n

\"The fact that US government has quickly issued emergency legislation to relax rules on road fuel transportation highlights how concerning this attack is. A longer term implication of the attack could create a delay in delivery and disruption of the supply chain. This would cause an increase in price at a time when the economy is already fragile due to the current pandemic.\" <\/p>\n\n\n\n

Computer security service, Digital Shadows has claimed that the Colonial attack was indeed helped by the coronavirus pandemic, with more engineers remotely accessing control systems for the pipeline from home. James Chappell, Co-Founder of Digital Shadows, said DarkSide could have bought account login details for remote desktop software such as TeamViewer and Microsoft Remote Desktop.<\/p>\n\n\n\n

\"We're seeing a lot of victims now, this is seriously a big problem,\" said Chappell in a statement. \"The amount of small businesses that are falling victim <\/a>to this. It's becoming a big problem for the economy globally.\"<\/p>\n\n\n\n

\"Cybercriminals don\u2019t really care how important your business is, only how much money they might extract from you,\" comments Tim Mackey Principal Security Strategist at the Synopsys CyRC (Cybersecurity Research Centre). \"This trend can be seen with increasing attacks on municipalities, healthcare systems, and elements of critical infrastructure. Each of these organisations will bring in law enforcement, yet attackers continue to be aggressive in their activities. <\/p>\n\n\n\n

\"While Colonial Pipeline is a US operation, attacks are global in scope. And despite warnings from officials like the US Treasury Department highlighting how ransomware payments are used to fund future criminal activities, victims are often faced with the difficult decision of whether to pay the ransom.\"<\/p>\n\n\n\n

\"The Colonial Pipeline attack reinforces the need to update legacy systems running today\u2019s critical infrastructure networks...\"<\/p>Lior Div, CEO and Co-founder, Cybereason<\/cite><\/blockquote><\/figure>\n\n\n\n

Remaining critical <\/strong><\/p>\n\n\n\n

\u201cThese \u2018Cyber Physical\u2019 attacks are a big deal, because they demonstrate just how fragile the provision of critical services are into society,\" says Andy Norton European Cyber Risk Officer at Armis. \"A few weeks ago a water treatment plant<\/a> was compromised leading to the potential for poisoning of the water. Now, 45% of the US oil energy provision has been switched off to the East coast. Prolonged shortages in critical services lead to civil unrest, economic pressures, and a general lack of confidence in public administration.\" <\/p>\n\n\n\n

Lior Div, CEO and Co-founder of Cybereason also comments: \"The SolarWinds<\/a> and Microsoft Exchange Server<\/a> attacks were unparalleled in their scope, successfully infiltrating and compromising virtually every US government agency and a wide array of medium and large private sector companies. The Colonial Pipeline attack reinforces the need to update legacy systems running today\u2019s critical infrastructure networks.<\/p>\n\n\n\n

\"If the public and private sectors can work together to solve complex cybersecurity issues, and at the same time accurately identify the threat actors and bring them to account for their actions, it will go a long way in reversing the adversary advantage and enable defenders to retake the high ground. There is also another significant opportunity here as well to cooperate on a global scale to develop extradition laws that enable cyber crimes and cyber espionage to be prosecuted more effectively.\u201d<\/p>\n\n\n\n

Mackey agrees, stating: \"Avoiding becoming a victim of ransomware requires organisations to have a comprehensive cybersecurity plan in place that fully captures the risks of each software component, its role and lifecycle, and its deployment configuration and usage assumptions. Armed with this basic information, and an exhaustive inventory, it becomes possible to determine how each component might play a role in an attempted ransomware attack. <\/p>\n\n\n\n

\"An effort like the one impacting Colonial Pipeline is likely the result of multiple weaknesses in process and cyber-defences that were ultimately successfully exploited. With the age of some industrial software systems far exceeding that of commercial software, it\u2019s likely that older software wasn\u2019t designed to limit exposure to modern threats like ransomware attacks. <\/p>\n\n\n\n

\"While the age of the software has limited impact on its serviceability, threat models and defensive protections need to keep pace with new threats \u2013 something that can only be done if all weaknesses present in each component are known and accounted for. After all, if a criminal can identify your weaknesses faster than you can, luck is rarely on your side.\u201d<\/p>\n\n\n\n

\"While this is indeed a financial disaster, and will have a significant impact on many, let us also consider that this means that, at least for a time, threat actors had control of those very same IT systems.\"<\/p>Martin Jartelius, CSO, Outpost24<\/cite><\/blockquote><\/figure>\n\n\n\n

Taking back control <\/strong><\/p>\n\n\n\n

US government officials are currently working with Colonial to help it recover while scrambling to avoid more severe fuel supply disruptions should the outage continue. Whether the pipeline stays shut that long in turn depends on how deeply the hackers penetrated Colonial\u2019s network - and how soon cybersecurity experts can pull them out.<\/p>\n\n\n\n

\"As so many times before when talking about ransomware \u2013 to lock a system with ransomware you need a good degree of control of that system,\" says Martin Jartelius, CSO at Outpost24. \"While this is indeed a financial disaster, and will have a significant impact on many, let us also consider that this means that, at least for a time, threat actors had control of those very same IT systems. Preventive security, as well as segmentation, are critical for those kinds of environments.\"<\/p>\n\n\n\n

\"One thing to note here is that ransomware has to announce itself to be successful,\" adds Tim Erlin, VP at Tripwire. \"In industrial environments, cyber events aren\u2019t always this visible. Increasing visibility into industrial networks becomes more important as attackers continue to target critical infrastructure.\u201d<\/p>\n\n\n\n

Brad Brooks, CEO and President of OneLogin, rightfully concludes: \"This attack represents just how quickly the stakes are escalating on Cybersecurity, with controlling and knowing who has access to your IT systems a board level priority for every company. We are moving from an invisible Cold War that was focused on stealing data to a highly visible hot war that has real implications for physical property and people\u2019s lives.\u201d<\/p>\n","post_title":"Ransomware roundtable | A threat in the pipeline","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"ransomware-roundtable-a-threat-in-the-pipeline","to_ping":"","pinged":"","post_modified":"2021-05-10 18:12:55","post_modified_gmt":"2021-05-10 17:12:55","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=6024","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4871,"post_author":"3","post_date":"2021-02-09 19:22:22","post_date_gmt":"2021-02-09 19:22:22","post_content":"Detectives assigned to the Digital Forensics Unit at Pinellas County Sheriff\u2019s Office are investigating an unlawful computer software intrusion at the City of Oldsmar\u2019s water treatment plant. While the cyber attack was unsuccessful, it does highlight the need for cybersecurity tools in critical infrastructure applications.\n\nOn Friday, February 5, 2021, the Pinellas County Sheriff\u2019s Office was notified by the City of Oldsmar that its computer system had been remotely accessed at 8:00am and 1:30pm by an unknown suspect. According to detectives, the City of Oldsmar\u2019s computer system at the water treatment plant allows for remote access by authorised users to troubleshoot any system problems from other locations.\n\nThe initial intrusion was brief and not cause for concern due to supervisors regularly accessing the system remotely to monitor the system. At 1:30, a plant operator witnessed a second remote access user opening various functions in the system that control the amount of sodium hydroxide in the water. The operator noted the remote access user raised the levels of sodium hydroxide in the water from 100 parts per million to 11,100 parts per million. The operator immediately reduced the levels to their appropriate amount. Sodium hydroxide is used in small amounts to control acidity, but a large amount could have caused major problems in the water.\n\nThe initial investigation revealed that the hacker remotely accessed the treatment plant\u2019s computer for approximately 3 to 5 minutes. Speaking at a press conference about the cyber attack, Sheriff Bob Gualtieri stated: \u201cAt no time was there a significant effect on the water being treated, and more importantly the public was never in danger.\u201d\n\nCommenting on the attack, Andrea Carcano, co-founder at Nozomi Networks stated: \u201cUnfortunately, this attack plays into a troubling trend we\u2019ve been following over the last year. As the pandemic forced critical infrastructure organisations to quickly shift to remote access options to keep systems up and running, we\u2019ve seen threats rise and bad actors reach new lows \u2013 setting their sights on life threatening targets. Fortunately, in this case, operators monitoring Oldsmar\u2019s treatment plant spotted the attack and were able to respond before anyone could be harmed. But it\u2019s a stark reminder that with limited cybersecurity resources and few regulations water utilities are vulnerable to attack. When it comes critical infrastructure, operational resilience must a top priority and advances in AI-powered OT security and network monitoring are available to give operators the network visibility they need to quickly spot trouble and respond before harm is done.\u201d\n\n\u201cThis targeted attack appears to have started by the \u2018bad actor\u2019 getting access to a vulnerable network\/system and working their way through the network trying to find the next weak access point while gathering data and understanding how the organisation operates along the way,\u201d added Niamh Muldoon, Global Data Protection Officer at OneLogin. \u201cIn this instance, understanding the information assets, applying not only MFA but enhanced multi-factor authentication, would have reduced the risk of this unauthorised attack materializing. It\u2019s a critical part of the MFA policy to enforce time limits for end-users and their trusted devices to re-authenticate, requiring them not only to validate themselves but also the identity of the device trying to access critical systems\/applications and the network. Without knowing more of the details, applying enhanced MFA to the execution of critical actions particularly for IT and systems administrators would have reduced the associated risk further. Having logging in place, and understanding logged events would support with the associated monitoring and alerting events. After the event has happened, crisis management is critical for successfully managing the attack response to reduce business impact and consequences, and it appears the Florida agency has done that.\u201d\n\n\u201cWhile this incident will rightfully cause concern, it appears that likelihood of real damage was minimal due to the fail safes in place,\u201d observes Tim Erlin, VP at Tripwire. \u201cThere are real impacts to be worried about, and actions to be taken, but this doesn\u2019t appear to be a sophisticated or novel attack. From a cybersecurity standpoint, we should be particularly concerned about how the attacker was able to authenticate into the remote access software. That entry point should be very well protected, given that it provides access to such obviously sensitive capabilities. Protecting remote access into industrial systems where these types of changes can be made should be a high priority for any industrial environment.\u201d\n\nLocal, State, and Federal investigators are working together to identify those responsible and the investigation is ongoing. Other utility providers have been informed of the intrusion, so they can take their own protective measures.","post_title":"Florida water system cyber attack highlights role of cybersecurity in critical infrastructure","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"florida-water-system-cyber-attack-highlights-role-of-cybersecurity-in-critical-infrastructure","to_ping":"","pinged":"","post_modified":"2021-02-09 19:22:25","post_modified_gmt":"2021-02-09 19:22:25","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4871","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4178,"post_author":"3","post_date":"2020-12-07 14:52:36","post_date_gmt":"2020-12-07 14:52:36","post_content":"Nozomi Networks and Chinook Systems have partnered to provide advanced cybersecurity solutions to protect industrial and critical infrastructure facilities across North America. Under the deal, Chinook will offer Nozomi Networks\u2019 complete portfolio of OT and IoT security solutions.\n\n\u201cFacilities that fully leverage their OT systems deliver tremendous returns when it comes to energy and operational savings, the safety and comfort of occupants and lower total cost of ownership,\u201d said Chinook\u2019s President, Wanda Lenkewich. \u201cAt the same time, the network connectivity that enables these systems, also introduces new and growing cyber threats. Partnering with Nozomi Networks allows Chinook to support clients with an integrated, comprehensive cybersecurity solution that ensures cyber threats are actively discovered, monitored and managed.\u201d\n\n\u201cWe are absolutely delighted to team with Chinook to help industrial and critical infrastructure facilities meet new requirements for secure connectivity across OT, IT and IoT networks,\u201d said Chet Namboodri, Vice President, Worldwide Business Development and Channel Sales at Nozomi. \u201cWe\u2019ve already worked together to deliver on a number of joint customer engagements in both the government and commercial sectors. Partnering with Chinook accelerates our joint efforts to make sure facility-related control and building management systems are safe from cyber threats.\u201d\n\nwww.nozominetworks.com<\/a>\n\nwww.chinooksystems.com<\/a>\n\n ","post_title":"Nozomi Networks and Chinook Systems partner for OT and IoT security solutions","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"nozomi-networks-and-chinook-systems-partner-for-ot-and-iot-security-solutions","to_ping":"","pinged":"","post_modified":"2020-12-07 14:52:40","post_modified_gmt":"2020-12-07 14:52:40","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4178","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4140,"post_author":"3","post_date":"2020-12-03 11:07:21","post_date_gmt":"2020-12-03 11:07:21","post_content":"Civil Nuclear Constabulary (CNC) police officers based at Harwell have launched Project Servator a collaborative community approach to policing. Project Servator aims to disrupt a range of criminal activity, including terrorism, while providing a reassuring presence for the public.\n\nCNC\u2019s officers are experienced and specially trained to spot the tell-tale signs that someone is planning or preparing to commit an illegal act. It works with other police forces, local businesses and the public to protect the Harwell site and the surrounding area and everyone who lives, works or visits there and to make it a difficult place for terrorists and other criminals to operate. Project Servator has been successful in gathering intelligence that has assisted Counter Terrorism Units across the UK in investigating and preventing acts of terror.\n\nProject Servator\u2019s patrols are highly visible and can happen at any time and in any location. Officers will talk to the public and local businesses to let them know what they\u2019re doing and remind them to be vigilant, trust their instincts and report any suspicious or unusual behaviour.\n\n\u201cWe are deploying these additional tactics to further complement the operational activity that exists in and around our Operational Policing Units,\u201d explained Supt Donna Jones, who is leading on the implementation of the project across the Constabulary. \u201cOur aim is to build upon relationships with partners as well as businesses and communities. These tactics are not new but allow us to have a focus on community engagement and encourage people to be our extra eyes and ears. This is not restricted to the Harwell site but also extends to the surrounding area. We are aware of the vast amount of information members of our community have and they are aware of what is out of the ordinary. All we ask is that they report any suspicions to us and we\u2019ll do the rest. The deployments will be unpredictable and our tactics will vary from one deployment to the next. The aim is to work with our local communities to deter any hostile threat.\u201d\n\nwww.gov.uk\/government\/organisations\/civil-nuclear-constabulary<\/a>","post_title":"CNC Harwell launches Project Servator","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"cnc-harwell-launches-project-servator","to_ping":"","pinged":"","post_modified":"2020-12-03 11:07:23","post_modified_gmt":"2020-12-03 11:07:23","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4140","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4102,"post_author":"3","post_date":"2020-11-30 17:30:23","post_date_gmt":"2020-11-30 17:30:23","post_content":"Radiflow and Mitsubishi Electric UK are collaborating to address the needs of IEC62443 cyber security standards in the Critical Infrastructure and Industrial Automation markets. The companys believe that the combination of the automation knowledge and tools of Mitsubishi Electric UK with the cyber security and IEC 62443 compliance skills of Radiflow will provide a holistic view of a client\u2019s risk posture.\n\nRadiflow will also provide Mitsubishi Electric UK customers with a consultancy service for cyber security, which includes the provision of OT security risk assessments, provision of Radiflow intrusion detection software and general advice on alignment with IEC 62443-3. In addition, the solution is intended to help customers to support asset owners in satisfying the requirements of the NIS Directive along with due diligence in alignment with CPNI (Centre for the Protection of National Infrastructure) best practice.\n\n\u201cOur new collaboration with Radiflow provides expertise in the field of OT cyber security which compliments and broadens the services that we offer our customers through the Mitsubishi Electric UK System Service Operation,\u201d said David Bean, Solutions Manager for Mitsubishi Electric UK. \u201cThere is a growing demand for solutions that address the requirements of cyber security in the OT space and we are looking forward to delivering those solutions and building our relationship further with the team at Radiflow.\u201d\n\n\u201cRadiflow sees huge value for OT organisations to have cyber security services and solutions aligned with their automation systems,\u201d added Ilan Barda, Founder and CEO of Radiflow. \u201cBy combining the automation knowledge and tools of Mitsubishi with the OT cyber security skills and tools of Radiflow, we are able to provide a holistic view of an organisation\u2019s OT risk posture.\u201d\n\nwww.radiflow.com<\/a>","post_title":"Radiflow and Mitsubishi Electric UK collaborate on cyber security standards","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"radiflow-and-mitsubishi-electric-uk-collaborate-on-cyber-security-standards","to_ping":"","pinged":"","post_modified":"2020-11-30 17:30:25","post_modified_gmt":"2020-11-30 17:30:25","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4102","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":3359,"post_author":"3","post_date":"2020-10-16 17:11:16","post_date_gmt":"2020-10-16 16:11:16","post_content":"Senstar explains how its products can be applied to protect the full range of upstream, midstream, and downstream facilities in the oil and gas industry.","post_title":"Senstar explains its security solutions for oil and gas","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"senstar-explains-its-security-solutions-for-oil-and-gas","to_ping":"","pinged":"","post_modified":"2020-10-16 17:11:17","post_modified_gmt":"2020-10-16 16:11:17","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=3359","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"}],"next":false,"prev":false,"total_page":1},"paged":1,"column_class":"jeg_col_2o3","class":"epic_block_14"};

\n

Predictive maintenance is a significant offering which reduces site downtime and has long term cost of ownership benefits for customers. Facility managers are empowered to take the right maintenance action at an appropriate time. Integrated maps with Synectics software allow site-mapping and optimisation of work flows as well as rapid site familiarity for new staff. Again, the multi-tasking of the products has financial benefits for users.<\/p>\n\n\n\n

For more Intersec news, click here<\/a> <\/p>\n","post_title":"Synectics multi-streams and multi-tasks at Intersec 2025","post_excerpt":"","post_status":"publish","comment_status":"closed","ping_status":"closed","post_password":"","post_name":"synectics-multi-streams-and-multi-tasks","to_ping":"","pinged":"","post_modified":"2025-01-20 15:37:34","post_modified_gmt":"2025-01-20 15:37:34","post_content_filtered":"","post_parent":0,"guid":"https:\/\/securityonscreen.com\/?p=25336","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":7381,"post_author":"3","post_date":"2021-08-13 16:10:10","post_date_gmt":"2021-08-13 15:10:10","post_content":"PowerVision Tech has released its new industrial drone system \u2014 PowerVision True Unmanned Aerial Solution. The solution integrates the PowerVision Dock, PowerEgg X 8K drone and the PowerVision Cloud web-based software platform. This solution can be used widely across countless applications, such as powerline inspections, environmental compliance, O&G asset inspections, facility security, GIS, surveying, and mapping.\n\nThe PowerVision True Unmanned Aerial Solution weighs 15.8kg in a 570\u00d7400\u00d7250mm form factor. This compact design allows the entire solution to be deployed by a single person, without special tools or equipment. Powered by artificial intelligence, the PowerVision True Unmanned Aerial System streamlines the drone\u2019s takeoff, flight, dynamic mission and return to the charging dock autonomously. A single installed solution can cover an area with a radius of 3.1 miles (5km). Multiple units can be connected and installed in an area to cover large-scale infrastructure projects or assets.\n\nTo meet the requirements for outdoor operations, PowerVision Dock is IP55-rated to resist dust and water in different environments. With the help of an intelligent temperature control system, it can still perform at an ambient temperature between 20\u2103 and 45\u2103. The onboard intelligent system monitors real-time temperatures, precipitation and wind to secure operational safety.\n\nThe PowerEgg X 8K uses a 1\/2-inch CMOS sensor to capture 48-megapixel photos and 8K UHD videos, all with 4x lossless zoom. Optimisations to the propellers, ESC, and the entire system have been made to achieve a 34-minute flight time. PowerEgg X 8K supports dual-band communication (2.4\/5.8GHz), interference detection and avoidance, dynamic frequency switching, anti-disturbance and real-time FHD image transmission with a max transmission distance of 7.5miles(12km). The PowerEgg X 8K can withstand the wind up to Level 7 on the Beaufort Scale (Near Gale) and fly in adverse weather conditions. A newly designed supplementary landing light automatically triggers under low light conditions to secure the take-off and landing.\n\nIn order to meet the special demands for the power industry, the PowerVision True Unmanned Aerial Solution also supports centimetre-level positioning, solar power supply and transmission extension antennas.\n\nwww.powervision.me<\/a>","post_title":"PowerVision introduces its True Unmanned Aerial Solution","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"powervision-introduces-its-true-unmanned-aerial-solution","to_ping":"","pinged":"","post_modified":"2021-08-13 16:10:16","post_modified_gmt":"2021-08-13 15:10:16","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=7381","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":6024,"post_author":"48","post_date":"2021-05-10 17:00:22","post_date_gmt":"2021-05-10 16:00:22","post_content":"\n

The latest roundtable discussion from Security on Screen analyses the Colonial Pipeline's major ransomware attack and how it highlights the risk ransomware can pose, not just to businesses, but to critical national industrial infrastructure <\/em><\/p>\n\n\n\n

The US government issued an emergency legislation on Sunday after The Colonial Pipeline (located in Alpharetta, Georgia) was hit by a severe ransomware attack. The largest fuel pipeline in the US, the Colonial Pipeline carries 2.5 million barrels a day - 45% of the East Coast's supply of diesel, petrol and jet fuel.<\/p>\n\n\n\n

Sources said the ransomware attack was likely to have been caused by a cyber-criminal gang called DarkSide, who infiltrated Colonial's network and locked the data on some computers and servers, demanding a ransom on Friday. The gang tried to take almost 100 gigabytes of data hostage, threatening to leak it onto the internet, but the FBI and other government agencies worked with private companies to respond. <\/p>\n\n\n\n

Subsequently, the operator took itself offline on Friday after the cyber-attack was discovered, with the cloud computing system that was used by the hackers to collect the stolen data was taken offline on Saturday. Colonial's data did not appear to have been transferred from that system anywhere else, potentially limiting the hackers' leverage to extort or further embarrass the company. <\/p>\n\n\n\n

On Sunday, Colonial said that although its four main pipelines remain offline, some smaller lines between terminals and delivery points were now operational. The US government has now relaxed rules on fuel being transported by road, meaning drivers in 18 states can work extra or more flexible hours when transporting refined petroleum products.<\/p>\n\n\n\n

While US fuel prices at the pump were largely unaffected on Monday, there are fears that could change if the shutdown is prolonged. <\/p>\n\n\n\n

\"The fact that the US government has quickly issued emergency legislation to relax rules on road fuel transportation highlights how concerning this attack is...\"<\/p>Lewis Jones, Threat Intelligence Analyst, Talion<\/cite><\/blockquote><\/figure>\n\n\n\n

A major disruption<\/strong><\/p>\n\n\n\n

In response to this substantial attack, Lewis Jones, Threat Intelligence Analyst at Talion says: \u201cThis appears to be one of the most disruptive ransomware attacks ever reported, highlighting the vulnerabilities in the energy sector and why it is often targeted by attackers. A long term ransomware negotiation within the energy sector could cause mass disruption and means that the likelihood of payment is increased. <\/p>\n\n\n\n

\"The fact that US government has quickly issued emergency legislation to relax rules on road fuel transportation highlights how concerning this attack is. A longer term implication of the attack could create a delay in delivery and disruption of the supply chain. This would cause an increase in price at a time when the economy is already fragile due to the current pandemic.\" <\/p>\n\n\n\n

Computer security service, Digital Shadows has claimed that the Colonial attack was indeed helped by the coronavirus pandemic, with more engineers remotely accessing control systems for the pipeline from home. James Chappell, Co-Founder of Digital Shadows, said DarkSide could have bought account login details for remote desktop software such as TeamViewer and Microsoft Remote Desktop.<\/p>\n\n\n\n

\"We're seeing a lot of victims now, this is seriously a big problem,\" said Chappell in a statement. \"The amount of small businesses that are falling victim <\/a>to this. It's becoming a big problem for the economy globally.\"<\/p>\n\n\n\n

\"Cybercriminals don\u2019t really care how important your business is, only how much money they might extract from you,\" comments Tim Mackey Principal Security Strategist at the Synopsys CyRC (Cybersecurity Research Centre). \"This trend can be seen with increasing attacks on municipalities, healthcare systems, and elements of critical infrastructure. Each of these organisations will bring in law enforcement, yet attackers continue to be aggressive in their activities. <\/p>\n\n\n\n

\"While Colonial Pipeline is a US operation, attacks are global in scope. And despite warnings from officials like the US Treasury Department highlighting how ransomware payments are used to fund future criminal activities, victims are often faced with the difficult decision of whether to pay the ransom.\"<\/p>\n\n\n\n

\"The Colonial Pipeline attack reinforces the need to update legacy systems running today\u2019s critical infrastructure networks...\"<\/p>Lior Div, CEO and Co-founder, Cybereason<\/cite><\/blockquote><\/figure>\n\n\n\n

Remaining critical <\/strong><\/p>\n\n\n\n

\u201cThese \u2018Cyber Physical\u2019 attacks are a big deal, because they demonstrate just how fragile the provision of critical services are into society,\" says Andy Norton European Cyber Risk Officer at Armis. \"A few weeks ago a water treatment plant<\/a> was compromised leading to the potential for poisoning of the water. Now, 45% of the US oil energy provision has been switched off to the East coast. Prolonged shortages in critical services lead to civil unrest, economic pressures, and a general lack of confidence in public administration.\" <\/p>\n\n\n\n

Lior Div, CEO and Co-founder of Cybereason also comments: \"The SolarWinds<\/a> and Microsoft Exchange Server<\/a> attacks were unparalleled in their scope, successfully infiltrating and compromising virtually every US government agency and a wide array of medium and large private sector companies. The Colonial Pipeline attack reinforces the need to update legacy systems running today\u2019s critical infrastructure networks.<\/p>\n\n\n\n

\"If the public and private sectors can work together to solve complex cybersecurity issues, and at the same time accurately identify the threat actors and bring them to account for their actions, it will go a long way in reversing the adversary advantage and enable defenders to retake the high ground. There is also another significant opportunity here as well to cooperate on a global scale to develop extradition laws that enable cyber crimes and cyber espionage to be prosecuted more effectively.\u201d<\/p>\n\n\n\n

Mackey agrees, stating: \"Avoiding becoming a victim of ransomware requires organisations to have a comprehensive cybersecurity plan in place that fully captures the risks of each software component, its role and lifecycle, and its deployment configuration and usage assumptions. Armed with this basic information, and an exhaustive inventory, it becomes possible to determine how each component might play a role in an attempted ransomware attack. <\/p>\n\n\n\n

\"An effort like the one impacting Colonial Pipeline is likely the result of multiple weaknesses in process and cyber-defences that were ultimately successfully exploited. With the age of some industrial software systems far exceeding that of commercial software, it\u2019s likely that older software wasn\u2019t designed to limit exposure to modern threats like ransomware attacks. <\/p>\n\n\n\n

\"While the age of the software has limited impact on its serviceability, threat models and defensive protections need to keep pace with new threats \u2013 something that can only be done if all weaknesses present in each component are known and accounted for. After all, if a criminal can identify your weaknesses faster than you can, luck is rarely on your side.\u201d<\/p>\n\n\n\n

\"While this is indeed a financial disaster, and will have a significant impact on many, let us also consider that this means that, at least for a time, threat actors had control of those very same IT systems.\"<\/p>Martin Jartelius, CSO, Outpost24<\/cite><\/blockquote><\/figure>\n\n\n\n

Taking back control <\/strong><\/p>\n\n\n\n

US government officials are currently working with Colonial to help it recover while scrambling to avoid more severe fuel supply disruptions should the outage continue. Whether the pipeline stays shut that long in turn depends on how deeply the hackers penetrated Colonial\u2019s network - and how soon cybersecurity experts can pull them out.<\/p>\n\n\n\n

\"As so many times before when talking about ransomware \u2013 to lock a system with ransomware you need a good degree of control of that system,\" says Martin Jartelius, CSO at Outpost24. \"While this is indeed a financial disaster, and will have a significant impact on many, let us also consider that this means that, at least for a time, threat actors had control of those very same IT systems. Preventive security, as well as segmentation, are critical for those kinds of environments.\"<\/p>\n\n\n\n

\"One thing to note here is that ransomware has to announce itself to be successful,\" adds Tim Erlin, VP at Tripwire. \"In industrial environments, cyber events aren\u2019t always this visible. Increasing visibility into industrial networks becomes more important as attackers continue to target critical infrastructure.\u201d<\/p>\n\n\n\n

Brad Brooks, CEO and President of OneLogin, rightfully concludes: \"This attack represents just how quickly the stakes are escalating on Cybersecurity, with controlling and knowing who has access to your IT systems a board level priority for every company. We are moving from an invisible Cold War that was focused on stealing data to a highly visible hot war that has real implications for physical property and people\u2019s lives.\u201d<\/p>\n","post_title":"Ransomware roundtable | A threat in the pipeline","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"ransomware-roundtable-a-threat-in-the-pipeline","to_ping":"","pinged":"","post_modified":"2021-05-10 18:12:55","post_modified_gmt":"2021-05-10 17:12:55","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=6024","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4871,"post_author":"3","post_date":"2021-02-09 19:22:22","post_date_gmt":"2021-02-09 19:22:22","post_content":"Detectives assigned to the Digital Forensics Unit at Pinellas County Sheriff\u2019s Office are investigating an unlawful computer software intrusion at the City of Oldsmar\u2019s water treatment plant. While the cyber attack was unsuccessful, it does highlight the need for cybersecurity tools in critical infrastructure applications.\n\nOn Friday, February 5, 2021, the Pinellas County Sheriff\u2019s Office was notified by the City of Oldsmar that its computer system had been remotely accessed at 8:00am and 1:30pm by an unknown suspect. According to detectives, the City of Oldsmar\u2019s computer system at the water treatment plant allows for remote access by authorised users to troubleshoot any system problems from other locations.\n\nThe initial intrusion was brief and not cause for concern due to supervisors regularly accessing the system remotely to monitor the system. At 1:30, a plant operator witnessed a second remote access user opening various functions in the system that control the amount of sodium hydroxide in the water. The operator noted the remote access user raised the levels of sodium hydroxide in the water from 100 parts per million to 11,100 parts per million. The operator immediately reduced the levels to their appropriate amount. Sodium hydroxide is used in small amounts to control acidity, but a large amount could have caused major problems in the water.\n\nThe initial investigation revealed that the hacker remotely accessed the treatment plant\u2019s computer for approximately 3 to 5 minutes. Speaking at a press conference about the cyber attack, Sheriff Bob Gualtieri stated: \u201cAt no time was there a significant effect on the water being treated, and more importantly the public was never in danger.\u201d\n\nCommenting on the attack, Andrea Carcano, co-founder at Nozomi Networks stated: \u201cUnfortunately, this attack plays into a troubling trend we\u2019ve been following over the last year. As the pandemic forced critical infrastructure organisations to quickly shift to remote access options to keep systems up and running, we\u2019ve seen threats rise and bad actors reach new lows \u2013 setting their sights on life threatening targets. Fortunately, in this case, operators monitoring Oldsmar\u2019s treatment plant spotted the attack and were able to respond before anyone could be harmed. But it\u2019s a stark reminder that with limited cybersecurity resources and few regulations water utilities are vulnerable to attack. When it comes critical infrastructure, operational resilience must a top priority and advances in AI-powered OT security and network monitoring are available to give operators the network visibility they need to quickly spot trouble and respond before harm is done.\u201d\n\n\u201cThis targeted attack appears to have started by the \u2018bad actor\u2019 getting access to a vulnerable network\/system and working their way through the network trying to find the next weak access point while gathering data and understanding how the organisation operates along the way,\u201d added Niamh Muldoon, Global Data Protection Officer at OneLogin. \u201cIn this instance, understanding the information assets, applying not only MFA but enhanced multi-factor authentication, would have reduced the risk of this unauthorised attack materializing. It\u2019s a critical part of the MFA policy to enforce time limits for end-users and their trusted devices to re-authenticate, requiring them not only to validate themselves but also the identity of the device trying to access critical systems\/applications and the network. Without knowing more of the details, applying enhanced MFA to the execution of critical actions particularly for IT and systems administrators would have reduced the associated risk further. Having logging in place, and understanding logged events would support with the associated monitoring and alerting events. After the event has happened, crisis management is critical for successfully managing the attack response to reduce business impact and consequences, and it appears the Florida agency has done that.\u201d\n\n\u201cWhile this incident will rightfully cause concern, it appears that likelihood of real damage was minimal due to the fail safes in place,\u201d observes Tim Erlin, VP at Tripwire. \u201cThere are real impacts to be worried about, and actions to be taken, but this doesn\u2019t appear to be a sophisticated or novel attack. From a cybersecurity standpoint, we should be particularly concerned about how the attacker was able to authenticate into the remote access software. That entry point should be very well protected, given that it provides access to such obviously sensitive capabilities. Protecting remote access into industrial systems where these types of changes can be made should be a high priority for any industrial environment.\u201d\n\nLocal, State, and Federal investigators are working together to identify those responsible and the investigation is ongoing. Other utility providers have been informed of the intrusion, so they can take their own protective measures.","post_title":"Florida water system cyber attack highlights role of cybersecurity in critical infrastructure","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"florida-water-system-cyber-attack-highlights-role-of-cybersecurity-in-critical-infrastructure","to_ping":"","pinged":"","post_modified":"2021-02-09 19:22:25","post_modified_gmt":"2021-02-09 19:22:25","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4871","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4178,"post_author":"3","post_date":"2020-12-07 14:52:36","post_date_gmt":"2020-12-07 14:52:36","post_content":"Nozomi Networks and Chinook Systems have partnered to provide advanced cybersecurity solutions to protect industrial and critical infrastructure facilities across North America. Under the deal, Chinook will offer Nozomi Networks\u2019 complete portfolio of OT and IoT security solutions.\n\n\u201cFacilities that fully leverage their OT systems deliver tremendous returns when it comes to energy and operational savings, the safety and comfort of occupants and lower total cost of ownership,\u201d said Chinook\u2019s President, Wanda Lenkewich. \u201cAt the same time, the network connectivity that enables these systems, also introduces new and growing cyber threats. Partnering with Nozomi Networks allows Chinook to support clients with an integrated, comprehensive cybersecurity solution that ensures cyber threats are actively discovered, monitored and managed.\u201d\n\n\u201cWe are absolutely delighted to team with Chinook to help industrial and critical infrastructure facilities meet new requirements for secure connectivity across OT, IT and IoT networks,\u201d said Chet Namboodri, Vice President, Worldwide Business Development and Channel Sales at Nozomi. \u201cWe\u2019ve already worked together to deliver on a number of joint customer engagements in both the government and commercial sectors. Partnering with Chinook accelerates our joint efforts to make sure facility-related control and building management systems are safe from cyber threats.\u201d\n\nwww.nozominetworks.com<\/a>\n\nwww.chinooksystems.com<\/a>\n\n ","post_title":"Nozomi Networks and Chinook Systems partner for OT and IoT security solutions","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"nozomi-networks-and-chinook-systems-partner-for-ot-and-iot-security-solutions","to_ping":"","pinged":"","post_modified":"2020-12-07 14:52:40","post_modified_gmt":"2020-12-07 14:52:40","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4178","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4140,"post_author":"3","post_date":"2020-12-03 11:07:21","post_date_gmt":"2020-12-03 11:07:21","post_content":"Civil Nuclear Constabulary (CNC) police officers based at Harwell have launched Project Servator a collaborative community approach to policing. Project Servator aims to disrupt a range of criminal activity, including terrorism, while providing a reassuring presence for the public.\n\nCNC\u2019s officers are experienced and specially trained to spot the tell-tale signs that someone is planning or preparing to commit an illegal act. It works with other police forces, local businesses and the public to protect the Harwell site and the surrounding area and everyone who lives, works or visits there and to make it a difficult place for terrorists and other criminals to operate. Project Servator has been successful in gathering intelligence that has assisted Counter Terrorism Units across the UK in investigating and preventing acts of terror.\n\nProject Servator\u2019s patrols are highly visible and can happen at any time and in any location. Officers will talk to the public and local businesses to let them know what they\u2019re doing and remind them to be vigilant, trust their instincts and report any suspicious or unusual behaviour.\n\n\u201cWe are deploying these additional tactics to further complement the operational activity that exists in and around our Operational Policing Units,\u201d explained Supt Donna Jones, who is leading on the implementation of the project across the Constabulary. \u201cOur aim is to build upon relationships with partners as well as businesses and communities. These tactics are not new but allow us to have a focus on community engagement and encourage people to be our extra eyes and ears. This is not restricted to the Harwell site but also extends to the surrounding area. We are aware of the vast amount of information members of our community have and they are aware of what is out of the ordinary. All we ask is that they report any suspicions to us and we\u2019ll do the rest. The deployments will be unpredictable and our tactics will vary from one deployment to the next. The aim is to work with our local communities to deter any hostile threat.\u201d\n\nwww.gov.uk\/government\/organisations\/civil-nuclear-constabulary<\/a>","post_title":"CNC Harwell launches Project Servator","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"cnc-harwell-launches-project-servator","to_ping":"","pinged":"","post_modified":"2020-12-03 11:07:23","post_modified_gmt":"2020-12-03 11:07:23","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4140","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4102,"post_author":"3","post_date":"2020-11-30 17:30:23","post_date_gmt":"2020-11-30 17:30:23","post_content":"Radiflow and Mitsubishi Electric UK are collaborating to address the needs of IEC62443 cyber security standards in the Critical Infrastructure and Industrial Automation markets. The companys believe that the combination of the automation knowledge and tools of Mitsubishi Electric UK with the cyber security and IEC 62443 compliance skills of Radiflow will provide a holistic view of a client\u2019s risk posture.\n\nRadiflow will also provide Mitsubishi Electric UK customers with a consultancy service for cyber security, which includes the provision of OT security risk assessments, provision of Radiflow intrusion detection software and general advice on alignment with IEC 62443-3. In addition, the solution is intended to help customers to support asset owners in satisfying the requirements of the NIS Directive along with due diligence in alignment with CPNI (Centre for the Protection of National Infrastructure) best practice.\n\n\u201cOur new collaboration with Radiflow provides expertise in the field of OT cyber security which compliments and broadens the services that we offer our customers through the Mitsubishi Electric UK System Service Operation,\u201d said David Bean, Solutions Manager for Mitsubishi Electric UK. \u201cThere is a growing demand for solutions that address the requirements of cyber security in the OT space and we are looking forward to delivering those solutions and building our relationship further with the team at Radiflow.\u201d\n\n\u201cRadiflow sees huge value for OT organisations to have cyber security services and solutions aligned with their automation systems,\u201d added Ilan Barda, Founder and CEO of Radiflow. \u201cBy combining the automation knowledge and tools of Mitsubishi with the OT cyber security skills and tools of Radiflow, we are able to provide a holistic view of an organisation\u2019s OT risk posture.\u201d\n\nwww.radiflow.com<\/a>","post_title":"Radiflow and Mitsubishi Electric UK collaborate on cyber security standards","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"radiflow-and-mitsubishi-electric-uk-collaborate-on-cyber-security-standards","to_ping":"","pinged":"","post_modified":"2020-11-30 17:30:25","post_modified_gmt":"2020-11-30 17:30:25","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4102","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":3359,"post_author":"3","post_date":"2020-10-16 17:11:16","post_date_gmt":"2020-10-16 16:11:16","post_content":"Senstar explains how its products can be applied to protect the full range of upstream, midstream, and downstream facilities in the oil and gas industry.","post_title":"Senstar explains its security solutions for oil and gas","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"senstar-explains-its-security-solutions-for-oil-and-gas","to_ping":"","pinged":"","post_modified":"2020-10-16 17:11:17","post_modified_gmt":"2020-10-16 16:11:17","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=3359","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"}],"next":false,"prev":false,"total_page":1},"paged":1,"column_class":"jeg_col_2o3","class":"epic_block_14"};

\n

The new Synergy AI Suite exploits true intelligence in its video surveillance and analytics tools. A mobile App allows stakeholders of many types to have visibility and take ownership of their sites.<\/p>\n\n\n\n

Predictive maintenance is a significant offering which reduces site downtime and has long term cost of ownership benefits for customers. Facility managers are empowered to take the right maintenance action at an appropriate time. Integrated maps with Synectics software allow site-mapping and optimisation of work flows as well as rapid site familiarity for new staff. Again, the multi-tasking of the products has financial benefits for users.<\/p>\n\n\n\n

For more Intersec news, click here<\/a> <\/p>\n","post_title":"Synectics multi-streams and multi-tasks at Intersec 2025","post_excerpt":"","post_status":"publish","comment_status":"closed","ping_status":"closed","post_password":"","post_name":"synectics-multi-streams-and-multi-tasks","to_ping":"","pinged":"","post_modified":"2025-01-20 15:37:34","post_modified_gmt":"2025-01-20 15:37:34","post_content_filtered":"","post_parent":0,"guid":"https:\/\/securityonscreen.com\/?p=25336","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":7381,"post_author":"3","post_date":"2021-08-13 16:10:10","post_date_gmt":"2021-08-13 15:10:10","post_content":"PowerVision Tech has released its new industrial drone system \u2014 PowerVision True Unmanned Aerial Solution. The solution integrates the PowerVision Dock, PowerEgg X 8K drone and the PowerVision Cloud web-based software platform. This solution can be used widely across countless applications, such as powerline inspections, environmental compliance, O&G asset inspections, facility security, GIS, surveying, and mapping.\n\nThe PowerVision True Unmanned Aerial Solution weighs 15.8kg in a 570\u00d7400\u00d7250mm form factor. This compact design allows the entire solution to be deployed by a single person, without special tools or equipment. Powered by artificial intelligence, the PowerVision True Unmanned Aerial System streamlines the drone\u2019s takeoff, flight, dynamic mission and return to the charging dock autonomously. A single installed solution can cover an area with a radius of 3.1 miles (5km). Multiple units can be connected and installed in an area to cover large-scale infrastructure projects or assets.\n\nTo meet the requirements for outdoor operations, PowerVision Dock is IP55-rated to resist dust and water in different environments. With the help of an intelligent temperature control system, it can still perform at an ambient temperature between 20\u2103 and 45\u2103. The onboard intelligent system monitors real-time temperatures, precipitation and wind to secure operational safety.\n\nThe PowerEgg X 8K uses a 1\/2-inch CMOS sensor to capture 48-megapixel photos and 8K UHD videos, all with 4x lossless zoom. Optimisations to the propellers, ESC, and the entire system have been made to achieve a 34-minute flight time. PowerEgg X 8K supports dual-band communication (2.4\/5.8GHz), interference detection and avoidance, dynamic frequency switching, anti-disturbance and real-time FHD image transmission with a max transmission distance of 7.5miles(12km). The PowerEgg X 8K can withstand the wind up to Level 7 on the Beaufort Scale (Near Gale) and fly in adverse weather conditions. A newly designed supplementary landing light automatically triggers under low light conditions to secure the take-off and landing.\n\nIn order to meet the special demands for the power industry, the PowerVision True Unmanned Aerial Solution also supports centimetre-level positioning, solar power supply and transmission extension antennas.\n\nwww.powervision.me<\/a>","post_title":"PowerVision introduces its True Unmanned Aerial Solution","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"powervision-introduces-its-true-unmanned-aerial-solution","to_ping":"","pinged":"","post_modified":"2021-08-13 16:10:16","post_modified_gmt":"2021-08-13 15:10:16","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=7381","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":6024,"post_author":"48","post_date":"2021-05-10 17:00:22","post_date_gmt":"2021-05-10 16:00:22","post_content":"\n

The latest roundtable discussion from Security on Screen analyses the Colonial Pipeline's major ransomware attack and how it highlights the risk ransomware can pose, not just to businesses, but to critical national industrial infrastructure <\/em><\/p>\n\n\n\n

The US government issued an emergency legislation on Sunday after The Colonial Pipeline (located in Alpharetta, Georgia) was hit by a severe ransomware attack. The largest fuel pipeline in the US, the Colonial Pipeline carries 2.5 million barrels a day - 45% of the East Coast's supply of diesel, petrol and jet fuel.<\/p>\n\n\n\n

Sources said the ransomware attack was likely to have been caused by a cyber-criminal gang called DarkSide, who infiltrated Colonial's network and locked the data on some computers and servers, demanding a ransom on Friday. The gang tried to take almost 100 gigabytes of data hostage, threatening to leak it onto the internet, but the FBI and other government agencies worked with private companies to respond. <\/p>\n\n\n\n

Subsequently, the operator took itself offline on Friday after the cyber-attack was discovered, with the cloud computing system that was used by the hackers to collect the stolen data was taken offline on Saturday. Colonial's data did not appear to have been transferred from that system anywhere else, potentially limiting the hackers' leverage to extort or further embarrass the company. <\/p>\n\n\n\n

On Sunday, Colonial said that although its four main pipelines remain offline, some smaller lines between terminals and delivery points were now operational. The US government has now relaxed rules on fuel being transported by road, meaning drivers in 18 states can work extra or more flexible hours when transporting refined petroleum products.<\/p>\n\n\n\n

While US fuel prices at the pump were largely unaffected on Monday, there are fears that could change if the shutdown is prolonged. <\/p>\n\n\n\n

\"The fact that the US government has quickly issued emergency legislation to relax rules on road fuel transportation highlights how concerning this attack is...\"<\/p>Lewis Jones, Threat Intelligence Analyst, Talion<\/cite><\/blockquote><\/figure>\n\n\n\n

A major disruption<\/strong><\/p>\n\n\n\n

In response to this substantial attack, Lewis Jones, Threat Intelligence Analyst at Talion says: \u201cThis appears to be one of the most disruptive ransomware attacks ever reported, highlighting the vulnerabilities in the energy sector and why it is often targeted by attackers. A long term ransomware negotiation within the energy sector could cause mass disruption and means that the likelihood of payment is increased. <\/p>\n\n\n\n

\"The fact that US government has quickly issued emergency legislation to relax rules on road fuel transportation highlights how concerning this attack is. A longer term implication of the attack could create a delay in delivery and disruption of the supply chain. This would cause an increase in price at a time when the economy is already fragile due to the current pandemic.\" <\/p>\n\n\n\n

Computer security service, Digital Shadows has claimed that the Colonial attack was indeed helped by the coronavirus pandemic, with more engineers remotely accessing control systems for the pipeline from home. James Chappell, Co-Founder of Digital Shadows, said DarkSide could have bought account login details for remote desktop software such as TeamViewer and Microsoft Remote Desktop.<\/p>\n\n\n\n

\"We're seeing a lot of victims now, this is seriously a big problem,\" said Chappell in a statement. \"The amount of small businesses that are falling victim <\/a>to this. It's becoming a big problem for the economy globally.\"<\/p>\n\n\n\n

\"Cybercriminals don\u2019t really care how important your business is, only how much money they might extract from you,\" comments Tim Mackey Principal Security Strategist at the Synopsys CyRC (Cybersecurity Research Centre). \"This trend can be seen with increasing attacks on municipalities, healthcare systems, and elements of critical infrastructure. Each of these organisations will bring in law enforcement, yet attackers continue to be aggressive in their activities. <\/p>\n\n\n\n

\"While Colonial Pipeline is a US operation, attacks are global in scope. And despite warnings from officials like the US Treasury Department highlighting how ransomware payments are used to fund future criminal activities, victims are often faced with the difficult decision of whether to pay the ransom.\"<\/p>\n\n\n\n

\"The Colonial Pipeline attack reinforces the need to update legacy systems running today\u2019s critical infrastructure networks...\"<\/p>Lior Div, CEO and Co-founder, Cybereason<\/cite><\/blockquote><\/figure>\n\n\n\n

Remaining critical <\/strong><\/p>\n\n\n\n

\u201cThese \u2018Cyber Physical\u2019 attacks are a big deal, because they demonstrate just how fragile the provision of critical services are into society,\" says Andy Norton European Cyber Risk Officer at Armis. \"A few weeks ago a water treatment plant<\/a> was compromised leading to the potential for poisoning of the water. Now, 45% of the US oil energy provision has been switched off to the East coast. Prolonged shortages in critical services lead to civil unrest, economic pressures, and a general lack of confidence in public administration.\" <\/p>\n\n\n\n

Lior Div, CEO and Co-founder of Cybereason also comments: \"The SolarWinds<\/a> and Microsoft Exchange Server<\/a> attacks were unparalleled in their scope, successfully infiltrating and compromising virtually every US government agency and a wide array of medium and large private sector companies. The Colonial Pipeline attack reinforces the need to update legacy systems running today\u2019s critical infrastructure networks.<\/p>\n\n\n\n

\"If the public and private sectors can work together to solve complex cybersecurity issues, and at the same time accurately identify the threat actors and bring them to account for their actions, it will go a long way in reversing the adversary advantage and enable defenders to retake the high ground. There is also another significant opportunity here as well to cooperate on a global scale to develop extradition laws that enable cyber crimes and cyber espionage to be prosecuted more effectively.\u201d<\/p>\n\n\n\n

Mackey agrees, stating: \"Avoiding becoming a victim of ransomware requires organisations to have a comprehensive cybersecurity plan in place that fully captures the risks of each software component, its role and lifecycle, and its deployment configuration and usage assumptions. Armed with this basic information, and an exhaustive inventory, it becomes possible to determine how each component might play a role in an attempted ransomware attack. <\/p>\n\n\n\n

\"An effort like the one impacting Colonial Pipeline is likely the result of multiple weaknesses in process and cyber-defences that were ultimately successfully exploited. With the age of some industrial software systems far exceeding that of commercial software, it\u2019s likely that older software wasn\u2019t designed to limit exposure to modern threats like ransomware attacks. <\/p>\n\n\n\n

\"While the age of the software has limited impact on its serviceability, threat models and defensive protections need to keep pace with new threats \u2013 something that can only be done if all weaknesses present in each component are known and accounted for. After all, if a criminal can identify your weaknesses faster than you can, luck is rarely on your side.\u201d<\/p>\n\n\n\n

\"While this is indeed a financial disaster, and will have a significant impact on many, let us also consider that this means that, at least for a time, threat actors had control of those very same IT systems.\"<\/p>Martin Jartelius, CSO, Outpost24<\/cite><\/blockquote><\/figure>\n\n\n\n

Taking back control <\/strong><\/p>\n\n\n\n

US government officials are currently working with Colonial to help it recover while scrambling to avoid more severe fuel supply disruptions should the outage continue. Whether the pipeline stays shut that long in turn depends on how deeply the hackers penetrated Colonial\u2019s network - and how soon cybersecurity experts can pull them out.<\/p>\n\n\n\n

\"As so many times before when talking about ransomware \u2013 to lock a system with ransomware you need a good degree of control of that system,\" says Martin Jartelius, CSO at Outpost24. \"While this is indeed a financial disaster, and will have a significant impact on many, let us also consider that this means that, at least for a time, threat actors had control of those very same IT systems. Preventive security, as well as segmentation, are critical for those kinds of environments.\"<\/p>\n\n\n\n

\"One thing to note here is that ransomware has to announce itself to be successful,\" adds Tim Erlin, VP at Tripwire. \"In industrial environments, cyber events aren\u2019t always this visible. Increasing visibility into industrial networks becomes more important as attackers continue to target critical infrastructure.\u201d<\/p>\n\n\n\n

Brad Brooks, CEO and President of OneLogin, rightfully concludes: \"This attack represents just how quickly the stakes are escalating on Cybersecurity, with controlling and knowing who has access to your IT systems a board level priority for every company. We are moving from an invisible Cold War that was focused on stealing data to a highly visible hot war that has real implications for physical property and people\u2019s lives.\u201d<\/p>\n","post_title":"Ransomware roundtable | A threat in the pipeline","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"ransomware-roundtable-a-threat-in-the-pipeline","to_ping":"","pinged":"","post_modified":"2021-05-10 18:12:55","post_modified_gmt":"2021-05-10 17:12:55","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=6024","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4871,"post_author":"3","post_date":"2021-02-09 19:22:22","post_date_gmt":"2021-02-09 19:22:22","post_content":"Detectives assigned to the Digital Forensics Unit at Pinellas County Sheriff\u2019s Office are investigating an unlawful computer software intrusion at the City of Oldsmar\u2019s water treatment plant. While the cyber attack was unsuccessful, it does highlight the need for cybersecurity tools in critical infrastructure applications.\n\nOn Friday, February 5, 2021, the Pinellas County Sheriff\u2019s Office was notified by the City of Oldsmar that its computer system had been remotely accessed at 8:00am and 1:30pm by an unknown suspect. According to detectives, the City of Oldsmar\u2019s computer system at the water treatment plant allows for remote access by authorised users to troubleshoot any system problems from other locations.\n\nThe initial intrusion was brief and not cause for concern due to supervisors regularly accessing the system remotely to monitor the system. At 1:30, a plant operator witnessed a second remote access user opening various functions in the system that control the amount of sodium hydroxide in the water. The operator noted the remote access user raised the levels of sodium hydroxide in the water from 100 parts per million to 11,100 parts per million. The operator immediately reduced the levels to their appropriate amount. Sodium hydroxide is used in small amounts to control acidity, but a large amount could have caused major problems in the water.\n\nThe initial investigation revealed that the hacker remotely accessed the treatment plant\u2019s computer for approximately 3 to 5 minutes. Speaking at a press conference about the cyber attack, Sheriff Bob Gualtieri stated: \u201cAt no time was there a significant effect on the water being treated, and more importantly the public was never in danger.\u201d\n\nCommenting on the attack, Andrea Carcano, co-founder at Nozomi Networks stated: \u201cUnfortunately, this attack plays into a troubling trend we\u2019ve been following over the last year. As the pandemic forced critical infrastructure organisations to quickly shift to remote access options to keep systems up and running, we\u2019ve seen threats rise and bad actors reach new lows \u2013 setting their sights on life threatening targets. Fortunately, in this case, operators monitoring Oldsmar\u2019s treatment plant spotted the attack and were able to respond before anyone could be harmed. But it\u2019s a stark reminder that with limited cybersecurity resources and few regulations water utilities are vulnerable to attack. When it comes critical infrastructure, operational resilience must a top priority and advances in AI-powered OT security and network monitoring are available to give operators the network visibility they need to quickly spot trouble and respond before harm is done.\u201d\n\n\u201cThis targeted attack appears to have started by the \u2018bad actor\u2019 getting access to a vulnerable network\/system and working their way through the network trying to find the next weak access point while gathering data and understanding how the organisation operates along the way,\u201d added Niamh Muldoon, Global Data Protection Officer at OneLogin. \u201cIn this instance, understanding the information assets, applying not only MFA but enhanced multi-factor authentication, would have reduced the risk of this unauthorised attack materializing. It\u2019s a critical part of the MFA policy to enforce time limits for end-users and their trusted devices to re-authenticate, requiring them not only to validate themselves but also the identity of the device trying to access critical systems\/applications and the network. Without knowing more of the details, applying enhanced MFA to the execution of critical actions particularly for IT and systems administrators would have reduced the associated risk further. Having logging in place, and understanding logged events would support with the associated monitoring and alerting events. After the event has happened, crisis management is critical for successfully managing the attack response to reduce business impact and consequences, and it appears the Florida agency has done that.\u201d\n\n\u201cWhile this incident will rightfully cause concern, it appears that likelihood of real damage was minimal due to the fail safes in place,\u201d observes Tim Erlin, VP at Tripwire. \u201cThere are real impacts to be worried about, and actions to be taken, but this doesn\u2019t appear to be a sophisticated or novel attack. From a cybersecurity standpoint, we should be particularly concerned about how the attacker was able to authenticate into the remote access software. That entry point should be very well protected, given that it provides access to such obviously sensitive capabilities. Protecting remote access into industrial systems where these types of changes can be made should be a high priority for any industrial environment.\u201d\n\nLocal, State, and Federal investigators are working together to identify those responsible and the investigation is ongoing. Other utility providers have been informed of the intrusion, so they can take their own protective measures.","post_title":"Florida water system cyber attack highlights role of cybersecurity in critical infrastructure","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"florida-water-system-cyber-attack-highlights-role-of-cybersecurity-in-critical-infrastructure","to_ping":"","pinged":"","post_modified":"2021-02-09 19:22:25","post_modified_gmt":"2021-02-09 19:22:25","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4871","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4178,"post_author":"3","post_date":"2020-12-07 14:52:36","post_date_gmt":"2020-12-07 14:52:36","post_content":"Nozomi Networks and Chinook Systems have partnered to provide advanced cybersecurity solutions to protect industrial and critical infrastructure facilities across North America. Under the deal, Chinook will offer Nozomi Networks\u2019 complete portfolio of OT and IoT security solutions.\n\n\u201cFacilities that fully leverage their OT systems deliver tremendous returns when it comes to energy and operational savings, the safety and comfort of occupants and lower total cost of ownership,\u201d said Chinook\u2019s President, Wanda Lenkewich. \u201cAt the same time, the network connectivity that enables these systems, also introduces new and growing cyber threats. Partnering with Nozomi Networks allows Chinook to support clients with an integrated, comprehensive cybersecurity solution that ensures cyber threats are actively discovered, monitored and managed.\u201d\n\n\u201cWe are absolutely delighted to team with Chinook to help industrial and critical infrastructure facilities meet new requirements for secure connectivity across OT, IT and IoT networks,\u201d said Chet Namboodri, Vice President, Worldwide Business Development and Channel Sales at Nozomi. \u201cWe\u2019ve already worked together to deliver on a number of joint customer engagements in both the government and commercial sectors. Partnering with Chinook accelerates our joint efforts to make sure facility-related control and building management systems are safe from cyber threats.\u201d\n\nwww.nozominetworks.com<\/a>\n\nwww.chinooksystems.com<\/a>\n\n ","post_title":"Nozomi Networks and Chinook Systems partner for OT and IoT security solutions","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"nozomi-networks-and-chinook-systems-partner-for-ot-and-iot-security-solutions","to_ping":"","pinged":"","post_modified":"2020-12-07 14:52:40","post_modified_gmt":"2020-12-07 14:52:40","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4178","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4140,"post_author":"3","post_date":"2020-12-03 11:07:21","post_date_gmt":"2020-12-03 11:07:21","post_content":"Civil Nuclear Constabulary (CNC) police officers based at Harwell have launched Project Servator a collaborative community approach to policing. Project Servator aims to disrupt a range of criminal activity, including terrorism, while providing a reassuring presence for the public.\n\nCNC\u2019s officers are experienced and specially trained to spot the tell-tale signs that someone is planning or preparing to commit an illegal act. It works with other police forces, local businesses and the public to protect the Harwell site and the surrounding area and everyone who lives, works or visits there and to make it a difficult place for terrorists and other criminals to operate. Project Servator has been successful in gathering intelligence that has assisted Counter Terrorism Units across the UK in investigating and preventing acts of terror.\n\nProject Servator\u2019s patrols are highly visible and can happen at any time and in any location. Officers will talk to the public and local businesses to let them know what they\u2019re doing and remind them to be vigilant, trust their instincts and report any suspicious or unusual behaviour.\n\n\u201cWe are deploying these additional tactics to further complement the operational activity that exists in and around our Operational Policing Units,\u201d explained Supt Donna Jones, who is leading on the implementation of the project across the Constabulary. \u201cOur aim is to build upon relationships with partners as well as businesses and communities. These tactics are not new but allow us to have a focus on community engagement and encourage people to be our extra eyes and ears. This is not restricted to the Harwell site but also extends to the surrounding area. We are aware of the vast amount of information members of our community have and they are aware of what is out of the ordinary. All we ask is that they report any suspicions to us and we\u2019ll do the rest. The deployments will be unpredictable and our tactics will vary from one deployment to the next. The aim is to work with our local communities to deter any hostile threat.\u201d\n\nwww.gov.uk\/government\/organisations\/civil-nuclear-constabulary<\/a>","post_title":"CNC Harwell launches Project Servator","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"cnc-harwell-launches-project-servator","to_ping":"","pinged":"","post_modified":"2020-12-03 11:07:23","post_modified_gmt":"2020-12-03 11:07:23","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4140","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4102,"post_author":"3","post_date":"2020-11-30 17:30:23","post_date_gmt":"2020-11-30 17:30:23","post_content":"Radiflow and Mitsubishi Electric UK are collaborating to address the needs of IEC62443 cyber security standards in the Critical Infrastructure and Industrial Automation markets. The companys believe that the combination of the automation knowledge and tools of Mitsubishi Electric UK with the cyber security and IEC 62443 compliance skills of Radiflow will provide a holistic view of a client\u2019s risk posture.\n\nRadiflow will also provide Mitsubishi Electric UK customers with a consultancy service for cyber security, which includes the provision of OT security risk assessments, provision of Radiflow intrusion detection software and general advice on alignment with IEC 62443-3. In addition, the solution is intended to help customers to support asset owners in satisfying the requirements of the NIS Directive along with due diligence in alignment with CPNI (Centre for the Protection of National Infrastructure) best practice.\n\n\u201cOur new collaboration with Radiflow provides expertise in the field of OT cyber security which compliments and broadens the services that we offer our customers through the Mitsubishi Electric UK System Service Operation,\u201d said David Bean, Solutions Manager for Mitsubishi Electric UK. \u201cThere is a growing demand for solutions that address the requirements of cyber security in the OT space and we are looking forward to delivering those solutions and building our relationship further with the team at Radiflow.\u201d\n\n\u201cRadiflow sees huge value for OT organisations to have cyber security services and solutions aligned with their automation systems,\u201d added Ilan Barda, Founder and CEO of Radiflow. \u201cBy combining the automation knowledge and tools of Mitsubishi with the OT cyber security skills and tools of Radiflow, we are able to provide a holistic view of an organisation\u2019s OT risk posture.\u201d\n\nwww.radiflow.com<\/a>","post_title":"Radiflow and Mitsubishi Electric UK collaborate on cyber security standards","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"radiflow-and-mitsubishi-electric-uk-collaborate-on-cyber-security-standards","to_ping":"","pinged":"","post_modified":"2020-11-30 17:30:25","post_modified_gmt":"2020-11-30 17:30:25","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4102","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":3359,"post_author":"3","post_date":"2020-10-16 17:11:16","post_date_gmt":"2020-10-16 16:11:16","post_content":"Senstar explains how its products can be applied to protect the full range of upstream, midstream, and downstream facilities in the oil and gas industry.","post_title":"Senstar explains its security solutions for oil and gas","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"senstar-explains-its-security-solutions-for-oil-and-gas","to_ping":"","pinged":"","post_modified":"2020-10-16 17:11:17","post_modified_gmt":"2020-10-16 16:11:17","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=3359","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"}],"next":false,"prev":false,"total_page":1},"paged":1,"column_class":"jeg_col_2o3","class":"epic_block_14"};

\n

Telemetry and analytics using best-of-breed proprietary algorithms protect volatile environments. Synectics<\/a> claims that its camera stations will perform in ambient temperatures up to +70\u00b0C without compromise. The products are thus a go-to choice for end-users in major industrial installations including marine.<\/p>\n\n\n\n

The new Synergy AI Suite exploits true intelligence in its video surveillance and analytics tools. A mobile App allows stakeholders of many types to have visibility and take ownership of their sites.<\/p>\n\n\n\n

Predictive maintenance is a significant offering which reduces site downtime and has long term cost of ownership benefits for customers. Facility managers are empowered to take the right maintenance action at an appropriate time. Integrated maps with Synectics software allow site-mapping and optimisation of work flows as well as rapid site familiarity for new staff. Again, the multi-tasking of the products has financial benefits for users.<\/p>\n\n\n\n

For more Intersec news, click here<\/a> <\/p>\n","post_title":"Synectics multi-streams and multi-tasks at Intersec 2025","post_excerpt":"","post_status":"publish","comment_status":"closed","ping_status":"closed","post_password":"","post_name":"synectics-multi-streams-and-multi-tasks","to_ping":"","pinged":"","post_modified":"2025-01-20 15:37:34","post_modified_gmt":"2025-01-20 15:37:34","post_content_filtered":"","post_parent":0,"guid":"https:\/\/securityonscreen.com\/?p=25336","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":7381,"post_author":"3","post_date":"2021-08-13 16:10:10","post_date_gmt":"2021-08-13 15:10:10","post_content":"PowerVision Tech has released its new industrial drone system \u2014 PowerVision True Unmanned Aerial Solution. The solution integrates the PowerVision Dock, PowerEgg X 8K drone and the PowerVision Cloud web-based software platform. This solution can be used widely across countless applications, such as powerline inspections, environmental compliance, O&G asset inspections, facility security, GIS, surveying, and mapping.\n\nThe PowerVision True Unmanned Aerial Solution weighs 15.8kg in a 570\u00d7400\u00d7250mm form factor. This compact design allows the entire solution to be deployed by a single person, without special tools or equipment. Powered by artificial intelligence, the PowerVision True Unmanned Aerial System streamlines the drone\u2019s takeoff, flight, dynamic mission and return to the charging dock autonomously. A single installed solution can cover an area with a radius of 3.1 miles (5km). Multiple units can be connected and installed in an area to cover large-scale infrastructure projects or assets.\n\nTo meet the requirements for outdoor operations, PowerVision Dock is IP55-rated to resist dust and water in different environments. With the help of an intelligent temperature control system, it can still perform at an ambient temperature between 20\u2103 and 45\u2103. The onboard intelligent system monitors real-time temperatures, precipitation and wind to secure operational safety.\n\nThe PowerEgg X 8K uses a 1\/2-inch CMOS sensor to capture 48-megapixel photos and 8K UHD videos, all with 4x lossless zoom. Optimisations to the propellers, ESC, and the entire system have been made to achieve a 34-minute flight time. PowerEgg X 8K supports dual-band communication (2.4\/5.8GHz), interference detection and avoidance, dynamic frequency switching, anti-disturbance and real-time FHD image transmission with a max transmission distance of 7.5miles(12km). The PowerEgg X 8K can withstand the wind up to Level 7 on the Beaufort Scale (Near Gale) and fly in adverse weather conditions. A newly designed supplementary landing light automatically triggers under low light conditions to secure the take-off and landing.\n\nIn order to meet the special demands for the power industry, the PowerVision True Unmanned Aerial Solution also supports centimetre-level positioning, solar power supply and transmission extension antennas.\n\nwww.powervision.me<\/a>","post_title":"PowerVision introduces its True Unmanned Aerial Solution","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"powervision-introduces-its-true-unmanned-aerial-solution","to_ping":"","pinged":"","post_modified":"2021-08-13 16:10:16","post_modified_gmt":"2021-08-13 15:10:16","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=7381","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":6024,"post_author":"48","post_date":"2021-05-10 17:00:22","post_date_gmt":"2021-05-10 16:00:22","post_content":"\n

The latest roundtable discussion from Security on Screen analyses the Colonial Pipeline's major ransomware attack and how it highlights the risk ransomware can pose, not just to businesses, but to critical national industrial infrastructure <\/em><\/p>\n\n\n\n

The US government issued an emergency legislation on Sunday after The Colonial Pipeline (located in Alpharetta, Georgia) was hit by a severe ransomware attack. The largest fuel pipeline in the US, the Colonial Pipeline carries 2.5 million barrels a day - 45% of the East Coast's supply of diesel, petrol and jet fuel.<\/p>\n\n\n\n

Sources said the ransomware attack was likely to have been caused by a cyber-criminal gang called DarkSide, who infiltrated Colonial's network and locked the data on some computers and servers, demanding a ransom on Friday. The gang tried to take almost 100 gigabytes of data hostage, threatening to leak it onto the internet, but the FBI and other government agencies worked with private companies to respond. <\/p>\n\n\n\n

Subsequently, the operator took itself offline on Friday after the cyber-attack was discovered, with the cloud computing system that was used by the hackers to collect the stolen data was taken offline on Saturday. Colonial's data did not appear to have been transferred from that system anywhere else, potentially limiting the hackers' leverage to extort or further embarrass the company. <\/p>\n\n\n\n

On Sunday, Colonial said that although its four main pipelines remain offline, some smaller lines between terminals and delivery points were now operational. The US government has now relaxed rules on fuel being transported by road, meaning drivers in 18 states can work extra or more flexible hours when transporting refined petroleum products.<\/p>\n\n\n\n

While US fuel prices at the pump were largely unaffected on Monday, there are fears that could change if the shutdown is prolonged. <\/p>\n\n\n\n

\"The fact that the US government has quickly issued emergency legislation to relax rules on road fuel transportation highlights how concerning this attack is...\"<\/p>Lewis Jones, Threat Intelligence Analyst, Talion<\/cite><\/blockquote><\/figure>\n\n\n\n

A major disruption<\/strong><\/p>\n\n\n\n

In response to this substantial attack, Lewis Jones, Threat Intelligence Analyst at Talion says: \u201cThis appears to be one of the most disruptive ransomware attacks ever reported, highlighting the vulnerabilities in the energy sector and why it is often targeted by attackers. A long term ransomware negotiation within the energy sector could cause mass disruption and means that the likelihood of payment is increased. <\/p>\n\n\n\n

\"The fact that US government has quickly issued emergency legislation to relax rules on road fuel transportation highlights how concerning this attack is. A longer term implication of the attack could create a delay in delivery and disruption of the supply chain. This would cause an increase in price at a time when the economy is already fragile due to the current pandemic.\" <\/p>\n\n\n\n

Computer security service, Digital Shadows has claimed that the Colonial attack was indeed helped by the coronavirus pandemic, with more engineers remotely accessing control systems for the pipeline from home. James Chappell, Co-Founder of Digital Shadows, said DarkSide could have bought account login details for remote desktop software such as TeamViewer and Microsoft Remote Desktop.<\/p>\n\n\n\n

\"We're seeing a lot of victims now, this is seriously a big problem,\" said Chappell in a statement. \"The amount of small businesses that are falling victim <\/a>to this. It's becoming a big problem for the economy globally.\"<\/p>\n\n\n\n

\"Cybercriminals don\u2019t really care how important your business is, only how much money they might extract from you,\" comments Tim Mackey Principal Security Strategist at the Synopsys CyRC (Cybersecurity Research Centre). \"This trend can be seen with increasing attacks on municipalities, healthcare systems, and elements of critical infrastructure. Each of these organisations will bring in law enforcement, yet attackers continue to be aggressive in their activities. <\/p>\n\n\n\n

\"While Colonial Pipeline is a US operation, attacks are global in scope. And despite warnings from officials like the US Treasury Department highlighting how ransomware payments are used to fund future criminal activities, victims are often faced with the difficult decision of whether to pay the ransom.\"<\/p>\n\n\n\n

\"The Colonial Pipeline attack reinforces the need to update legacy systems running today\u2019s critical infrastructure networks...\"<\/p>Lior Div, CEO and Co-founder, Cybereason<\/cite><\/blockquote><\/figure>\n\n\n\n

Remaining critical <\/strong><\/p>\n\n\n\n

\u201cThese \u2018Cyber Physical\u2019 attacks are a big deal, because they demonstrate just how fragile the provision of critical services are into society,\" says Andy Norton European Cyber Risk Officer at Armis. \"A few weeks ago a water treatment plant<\/a> was compromised leading to the potential for poisoning of the water. Now, 45% of the US oil energy provision has been switched off to the East coast. Prolonged shortages in critical services lead to civil unrest, economic pressures, and a general lack of confidence in public administration.\" <\/p>\n\n\n\n

Lior Div, CEO and Co-founder of Cybereason also comments: \"The SolarWinds<\/a> and Microsoft Exchange Server<\/a> attacks were unparalleled in their scope, successfully infiltrating and compromising virtually every US government agency and a wide array of medium and large private sector companies. The Colonial Pipeline attack reinforces the need to update legacy systems running today\u2019s critical infrastructure networks.<\/p>\n\n\n\n

\"If the public and private sectors can work together to solve complex cybersecurity issues, and at the same time accurately identify the threat actors and bring them to account for their actions, it will go a long way in reversing the adversary advantage and enable defenders to retake the high ground. There is also another significant opportunity here as well to cooperate on a global scale to develop extradition laws that enable cyber crimes and cyber espionage to be prosecuted more effectively.\u201d<\/p>\n\n\n\n

Mackey agrees, stating: \"Avoiding becoming a victim of ransomware requires organisations to have a comprehensive cybersecurity plan in place that fully captures the risks of each software component, its role and lifecycle, and its deployment configuration and usage assumptions. Armed with this basic information, and an exhaustive inventory, it becomes possible to determine how each component might play a role in an attempted ransomware attack. <\/p>\n\n\n\n

\"An effort like the one impacting Colonial Pipeline is likely the result of multiple weaknesses in process and cyber-defences that were ultimately successfully exploited. With the age of some industrial software systems far exceeding that of commercial software, it\u2019s likely that older software wasn\u2019t designed to limit exposure to modern threats like ransomware attacks. <\/p>\n\n\n\n

\"While the age of the software has limited impact on its serviceability, threat models and defensive protections need to keep pace with new threats \u2013 something that can only be done if all weaknesses present in each component are known and accounted for. After all, if a criminal can identify your weaknesses faster than you can, luck is rarely on your side.\u201d<\/p>\n\n\n\n

\"While this is indeed a financial disaster, and will have a significant impact on many, let us also consider that this means that, at least for a time, threat actors had control of those very same IT systems.\"<\/p>Martin Jartelius, CSO, Outpost24<\/cite><\/blockquote><\/figure>\n\n\n\n

Taking back control <\/strong><\/p>\n\n\n\n

US government officials are currently working with Colonial to help it recover while scrambling to avoid more severe fuel supply disruptions should the outage continue. Whether the pipeline stays shut that long in turn depends on how deeply the hackers penetrated Colonial\u2019s network - and how soon cybersecurity experts can pull them out.<\/p>\n\n\n\n

\"As so many times before when talking about ransomware \u2013 to lock a system with ransomware you need a good degree of control of that system,\" says Martin Jartelius, CSO at Outpost24. \"While this is indeed a financial disaster, and will have a significant impact on many, let us also consider that this means that, at least for a time, threat actors had control of those very same IT systems. Preventive security, as well as segmentation, are critical for those kinds of environments.\"<\/p>\n\n\n\n

\"One thing to note here is that ransomware has to announce itself to be successful,\" adds Tim Erlin, VP at Tripwire. \"In industrial environments, cyber events aren\u2019t always this visible. Increasing visibility into industrial networks becomes more important as attackers continue to target critical infrastructure.\u201d<\/p>\n\n\n\n

Brad Brooks, CEO and President of OneLogin, rightfully concludes: \"This attack represents just how quickly the stakes are escalating on Cybersecurity, with controlling and knowing who has access to your IT systems a board level priority for every company. We are moving from an invisible Cold War that was focused on stealing data to a highly visible hot war that has real implications for physical property and people\u2019s lives.\u201d<\/p>\n","post_title":"Ransomware roundtable | A threat in the pipeline","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"ransomware-roundtable-a-threat-in-the-pipeline","to_ping":"","pinged":"","post_modified":"2021-05-10 18:12:55","post_modified_gmt":"2021-05-10 17:12:55","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=6024","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4871,"post_author":"3","post_date":"2021-02-09 19:22:22","post_date_gmt":"2021-02-09 19:22:22","post_content":"Detectives assigned to the Digital Forensics Unit at Pinellas County Sheriff\u2019s Office are investigating an unlawful computer software intrusion at the City of Oldsmar\u2019s water treatment plant. While the cyber attack was unsuccessful, it does highlight the need for cybersecurity tools in critical infrastructure applications.\n\nOn Friday, February 5, 2021, the Pinellas County Sheriff\u2019s Office was notified by the City of Oldsmar that its computer system had been remotely accessed at 8:00am and 1:30pm by an unknown suspect. According to detectives, the City of Oldsmar\u2019s computer system at the water treatment plant allows for remote access by authorised users to troubleshoot any system problems from other locations.\n\nThe initial intrusion was brief and not cause for concern due to supervisors regularly accessing the system remotely to monitor the system. At 1:30, a plant operator witnessed a second remote access user opening various functions in the system that control the amount of sodium hydroxide in the water. The operator noted the remote access user raised the levels of sodium hydroxide in the water from 100 parts per million to 11,100 parts per million. The operator immediately reduced the levels to their appropriate amount. Sodium hydroxide is used in small amounts to control acidity, but a large amount could have caused major problems in the water.\n\nThe initial investigation revealed that the hacker remotely accessed the treatment plant\u2019s computer for approximately 3 to 5 minutes. Speaking at a press conference about the cyber attack, Sheriff Bob Gualtieri stated: \u201cAt no time was there a significant effect on the water being treated, and more importantly the public was never in danger.\u201d\n\nCommenting on the attack, Andrea Carcano, co-founder at Nozomi Networks stated: \u201cUnfortunately, this attack plays into a troubling trend we\u2019ve been following over the last year. As the pandemic forced critical infrastructure organisations to quickly shift to remote access options to keep systems up and running, we\u2019ve seen threats rise and bad actors reach new lows \u2013 setting their sights on life threatening targets. Fortunately, in this case, operators monitoring Oldsmar\u2019s treatment plant spotted the attack and were able to respond before anyone could be harmed. But it\u2019s a stark reminder that with limited cybersecurity resources and few regulations water utilities are vulnerable to attack. When it comes critical infrastructure, operational resilience must a top priority and advances in AI-powered OT security and network monitoring are available to give operators the network visibility they need to quickly spot trouble and respond before harm is done.\u201d\n\n\u201cThis targeted attack appears to have started by the \u2018bad actor\u2019 getting access to a vulnerable network\/system and working their way through the network trying to find the next weak access point while gathering data and understanding how the organisation operates along the way,\u201d added Niamh Muldoon, Global Data Protection Officer at OneLogin. \u201cIn this instance, understanding the information assets, applying not only MFA but enhanced multi-factor authentication, would have reduced the risk of this unauthorised attack materializing. It\u2019s a critical part of the MFA policy to enforce time limits for end-users and their trusted devices to re-authenticate, requiring them not only to validate themselves but also the identity of the device trying to access critical systems\/applications and the network. Without knowing more of the details, applying enhanced MFA to the execution of critical actions particularly for IT and systems administrators would have reduced the associated risk further. Having logging in place, and understanding logged events would support with the associated monitoring and alerting events. After the event has happened, crisis management is critical for successfully managing the attack response to reduce business impact and consequences, and it appears the Florida agency has done that.\u201d\n\n\u201cWhile this incident will rightfully cause concern, it appears that likelihood of real damage was minimal due to the fail safes in place,\u201d observes Tim Erlin, VP at Tripwire. \u201cThere are real impacts to be worried about, and actions to be taken, but this doesn\u2019t appear to be a sophisticated or novel attack. From a cybersecurity standpoint, we should be particularly concerned about how the attacker was able to authenticate into the remote access software. That entry point should be very well protected, given that it provides access to such obviously sensitive capabilities. Protecting remote access into industrial systems where these types of changes can be made should be a high priority for any industrial environment.\u201d\n\nLocal, State, and Federal investigators are working together to identify those responsible and the investigation is ongoing. Other utility providers have been informed of the intrusion, so they can take their own protective measures.","post_title":"Florida water system cyber attack highlights role of cybersecurity in critical infrastructure","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"florida-water-system-cyber-attack-highlights-role-of-cybersecurity-in-critical-infrastructure","to_ping":"","pinged":"","post_modified":"2021-02-09 19:22:25","post_modified_gmt":"2021-02-09 19:22:25","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4871","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4178,"post_author":"3","post_date":"2020-12-07 14:52:36","post_date_gmt":"2020-12-07 14:52:36","post_content":"Nozomi Networks and Chinook Systems have partnered to provide advanced cybersecurity solutions to protect industrial and critical infrastructure facilities across North America. Under the deal, Chinook will offer Nozomi Networks\u2019 complete portfolio of OT and IoT security solutions.\n\n\u201cFacilities that fully leverage their OT systems deliver tremendous returns when it comes to energy and operational savings, the safety and comfort of occupants and lower total cost of ownership,\u201d said Chinook\u2019s President, Wanda Lenkewich. \u201cAt the same time, the network connectivity that enables these systems, also introduces new and growing cyber threats. Partnering with Nozomi Networks allows Chinook to support clients with an integrated, comprehensive cybersecurity solution that ensures cyber threats are actively discovered, monitored and managed.\u201d\n\n\u201cWe are absolutely delighted to team with Chinook to help industrial and critical infrastructure facilities meet new requirements for secure connectivity across OT, IT and IoT networks,\u201d said Chet Namboodri, Vice President, Worldwide Business Development and Channel Sales at Nozomi. \u201cWe\u2019ve already worked together to deliver on a number of joint customer engagements in both the government and commercial sectors. Partnering with Chinook accelerates our joint efforts to make sure facility-related control and building management systems are safe from cyber threats.\u201d\n\nwww.nozominetworks.com<\/a>\n\nwww.chinooksystems.com<\/a>\n\n ","post_title":"Nozomi Networks and Chinook Systems partner for OT and IoT security solutions","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"nozomi-networks-and-chinook-systems-partner-for-ot-and-iot-security-solutions","to_ping":"","pinged":"","post_modified":"2020-12-07 14:52:40","post_modified_gmt":"2020-12-07 14:52:40","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4178","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4140,"post_author":"3","post_date":"2020-12-03 11:07:21","post_date_gmt":"2020-12-03 11:07:21","post_content":"Civil Nuclear Constabulary (CNC) police officers based at Harwell have launched Project Servator a collaborative community approach to policing. Project Servator aims to disrupt a range of criminal activity, including terrorism, while providing a reassuring presence for the public.\n\nCNC\u2019s officers are experienced and specially trained to spot the tell-tale signs that someone is planning or preparing to commit an illegal act. It works with other police forces, local businesses and the public to protect the Harwell site and the surrounding area and everyone who lives, works or visits there and to make it a difficult place for terrorists and other criminals to operate. Project Servator has been successful in gathering intelligence that has assisted Counter Terrorism Units across the UK in investigating and preventing acts of terror.\n\nProject Servator\u2019s patrols are highly visible and can happen at any time and in any location. Officers will talk to the public and local businesses to let them know what they\u2019re doing and remind them to be vigilant, trust their instincts and report any suspicious or unusual behaviour.\n\n\u201cWe are deploying these additional tactics to further complement the operational activity that exists in and around our Operational Policing Units,\u201d explained Supt Donna Jones, who is leading on the implementation of the project across the Constabulary. \u201cOur aim is to build upon relationships with partners as well as businesses and communities. These tactics are not new but allow us to have a focus on community engagement and encourage people to be our extra eyes and ears. This is not restricted to the Harwell site but also extends to the surrounding area. We are aware of the vast amount of information members of our community have and they are aware of what is out of the ordinary. All we ask is that they report any suspicions to us and we\u2019ll do the rest. The deployments will be unpredictable and our tactics will vary from one deployment to the next. The aim is to work with our local communities to deter any hostile threat.\u201d\n\nwww.gov.uk\/government\/organisations\/civil-nuclear-constabulary<\/a>","post_title":"CNC Harwell launches Project Servator","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"cnc-harwell-launches-project-servator","to_ping":"","pinged":"","post_modified":"2020-12-03 11:07:23","post_modified_gmt":"2020-12-03 11:07:23","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4140","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4102,"post_author":"3","post_date":"2020-11-30 17:30:23","post_date_gmt":"2020-11-30 17:30:23","post_content":"Radiflow and Mitsubishi Electric UK are collaborating to address the needs of IEC62443 cyber security standards in the Critical Infrastructure and Industrial Automation markets. The companys believe that the combination of the automation knowledge and tools of Mitsubishi Electric UK with the cyber security and IEC 62443 compliance skills of Radiflow will provide a holistic view of a client\u2019s risk posture.\n\nRadiflow will also provide Mitsubishi Electric UK customers with a consultancy service for cyber security, which includes the provision of OT security risk assessments, provision of Radiflow intrusion detection software and general advice on alignment with IEC 62443-3. In addition, the solution is intended to help customers to support asset owners in satisfying the requirements of the NIS Directive along with due diligence in alignment with CPNI (Centre for the Protection of National Infrastructure) best practice.\n\n\u201cOur new collaboration with Radiflow provides expertise in the field of OT cyber security which compliments and broadens the services that we offer our customers through the Mitsubishi Electric UK System Service Operation,\u201d said David Bean, Solutions Manager for Mitsubishi Electric UK. \u201cThere is a growing demand for solutions that address the requirements of cyber security in the OT space and we are looking forward to delivering those solutions and building our relationship further with the team at Radiflow.\u201d\n\n\u201cRadiflow sees huge value for OT organisations to have cyber security services and solutions aligned with their automation systems,\u201d added Ilan Barda, Founder and CEO of Radiflow. \u201cBy combining the automation knowledge and tools of Mitsubishi with the OT cyber security skills and tools of Radiflow, we are able to provide a holistic view of an organisation\u2019s OT risk posture.\u201d\n\nwww.radiflow.com<\/a>","post_title":"Radiflow and Mitsubishi Electric UK collaborate on cyber security standards","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"radiflow-and-mitsubishi-electric-uk-collaborate-on-cyber-security-standards","to_ping":"","pinged":"","post_modified":"2020-11-30 17:30:25","post_modified_gmt":"2020-11-30 17:30:25","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4102","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":3359,"post_author":"3","post_date":"2020-10-16 17:11:16","post_date_gmt":"2020-10-16 16:11:16","post_content":"Senstar explains how its products can be applied to protect the full range of upstream, midstream, and downstream facilities in the oil and gas industry.","post_title":"Senstar explains its security solutions for oil and gas","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"senstar-explains-its-security-solutions-for-oil-and-gas","to_ping":"","pinged":"","post_modified":"2020-10-16 17:11:17","post_modified_gmt":"2020-10-16 16:11:17","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=3359","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"}],"next":false,"prev":false,"total_page":1},"paged":1,"column_class":"jeg_col_2o3","class":"epic_block_14"};

\n

The solutions are aimed primarily but not exclusively at industries and niche sectors that are mission-critical such as oil & gas, public space, transport and major infrastructure.<\/p>\n\n\n\n

Telemetry and analytics using best-of-breed proprietary algorithms protect volatile environments. Synectics<\/a> claims that its camera stations will perform in ambient temperatures up to +70\u00b0C without compromise. The products are thus a go-to choice for end-users in major industrial installations including marine.<\/p>\n\n\n\n

The new Synergy AI Suite exploits true intelligence in its video surveillance and analytics tools. A mobile App allows stakeholders of many types to have visibility and take ownership of their sites.<\/p>\n\n\n\n

Predictive maintenance is a significant offering which reduces site downtime and has long term cost of ownership benefits for customers. Facility managers are empowered to take the right maintenance action at an appropriate time. Integrated maps with Synectics software allow site-mapping and optimisation of work flows as well as rapid site familiarity for new staff. Again, the multi-tasking of the products has financial benefits for users.<\/p>\n\n\n\n

For more Intersec news, click here<\/a> <\/p>\n","post_title":"Synectics multi-streams and multi-tasks at Intersec 2025","post_excerpt":"","post_status":"publish","comment_status":"closed","ping_status":"closed","post_password":"","post_name":"synectics-multi-streams-and-multi-tasks","to_ping":"","pinged":"","post_modified":"2025-01-20 15:37:34","post_modified_gmt":"2025-01-20 15:37:34","post_content_filtered":"","post_parent":0,"guid":"https:\/\/securityonscreen.com\/?p=25336","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":7381,"post_author":"3","post_date":"2021-08-13 16:10:10","post_date_gmt":"2021-08-13 15:10:10","post_content":"PowerVision Tech has released its new industrial drone system \u2014 PowerVision True Unmanned Aerial Solution. The solution integrates the PowerVision Dock, PowerEgg X 8K drone and the PowerVision Cloud web-based software platform. This solution can be used widely across countless applications, such as powerline inspections, environmental compliance, O&G asset inspections, facility security, GIS, surveying, and mapping.\n\nThe PowerVision True Unmanned Aerial Solution weighs 15.8kg in a 570\u00d7400\u00d7250mm form factor. This compact design allows the entire solution to be deployed by a single person, without special tools or equipment. Powered by artificial intelligence, the PowerVision True Unmanned Aerial System streamlines the drone\u2019s takeoff, flight, dynamic mission and return to the charging dock autonomously. A single installed solution can cover an area with a radius of 3.1 miles (5km). Multiple units can be connected and installed in an area to cover large-scale infrastructure projects or assets.\n\nTo meet the requirements for outdoor operations, PowerVision Dock is IP55-rated to resist dust and water in different environments. With the help of an intelligent temperature control system, it can still perform at an ambient temperature between 20\u2103 and 45\u2103. The onboard intelligent system monitors real-time temperatures, precipitation and wind to secure operational safety.\n\nThe PowerEgg X 8K uses a 1\/2-inch CMOS sensor to capture 48-megapixel photos and 8K UHD videos, all with 4x lossless zoom. Optimisations to the propellers, ESC, and the entire system have been made to achieve a 34-minute flight time. PowerEgg X 8K supports dual-band communication (2.4\/5.8GHz), interference detection and avoidance, dynamic frequency switching, anti-disturbance and real-time FHD image transmission with a max transmission distance of 7.5miles(12km). The PowerEgg X 8K can withstand the wind up to Level 7 on the Beaufort Scale (Near Gale) and fly in adverse weather conditions. A newly designed supplementary landing light automatically triggers under low light conditions to secure the take-off and landing.\n\nIn order to meet the special demands for the power industry, the PowerVision True Unmanned Aerial Solution also supports centimetre-level positioning, solar power supply and transmission extension antennas.\n\nwww.powervision.me<\/a>","post_title":"PowerVision introduces its True Unmanned Aerial Solution","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"powervision-introduces-its-true-unmanned-aerial-solution","to_ping":"","pinged":"","post_modified":"2021-08-13 16:10:16","post_modified_gmt":"2021-08-13 15:10:16","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=7381","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":6024,"post_author":"48","post_date":"2021-05-10 17:00:22","post_date_gmt":"2021-05-10 16:00:22","post_content":"\n

The latest roundtable discussion from Security on Screen analyses the Colonial Pipeline's major ransomware attack and how it highlights the risk ransomware can pose, not just to businesses, but to critical national industrial infrastructure <\/em><\/p>\n\n\n\n

The US government issued an emergency legislation on Sunday after The Colonial Pipeline (located in Alpharetta, Georgia) was hit by a severe ransomware attack. The largest fuel pipeline in the US, the Colonial Pipeline carries 2.5 million barrels a day - 45% of the East Coast's supply of diesel, petrol and jet fuel.<\/p>\n\n\n\n

Sources said the ransomware attack was likely to have been caused by a cyber-criminal gang called DarkSide, who infiltrated Colonial's network and locked the data on some computers and servers, demanding a ransom on Friday. The gang tried to take almost 100 gigabytes of data hostage, threatening to leak it onto the internet, but the FBI and other government agencies worked with private companies to respond. <\/p>\n\n\n\n

Subsequently, the operator took itself offline on Friday after the cyber-attack was discovered, with the cloud computing system that was used by the hackers to collect the stolen data was taken offline on Saturday. Colonial's data did not appear to have been transferred from that system anywhere else, potentially limiting the hackers' leverage to extort or further embarrass the company. <\/p>\n\n\n\n

On Sunday, Colonial said that although its four main pipelines remain offline, some smaller lines between terminals and delivery points were now operational. The US government has now relaxed rules on fuel being transported by road, meaning drivers in 18 states can work extra or more flexible hours when transporting refined petroleum products.<\/p>\n\n\n\n

While US fuel prices at the pump were largely unaffected on Monday, there are fears that could change if the shutdown is prolonged. <\/p>\n\n\n\n

\"The fact that the US government has quickly issued emergency legislation to relax rules on road fuel transportation highlights how concerning this attack is...\"<\/p>Lewis Jones, Threat Intelligence Analyst, Talion<\/cite><\/blockquote><\/figure>\n\n\n\n

A major disruption<\/strong><\/p>\n\n\n\n

In response to this substantial attack, Lewis Jones, Threat Intelligence Analyst at Talion says: \u201cThis appears to be one of the most disruptive ransomware attacks ever reported, highlighting the vulnerabilities in the energy sector and why it is often targeted by attackers. A long term ransomware negotiation within the energy sector could cause mass disruption and means that the likelihood of payment is increased. <\/p>\n\n\n\n

\"The fact that US government has quickly issued emergency legislation to relax rules on road fuel transportation highlights how concerning this attack is. A longer term implication of the attack could create a delay in delivery and disruption of the supply chain. This would cause an increase in price at a time when the economy is already fragile due to the current pandemic.\" <\/p>\n\n\n\n

Computer security service, Digital Shadows has claimed that the Colonial attack was indeed helped by the coronavirus pandemic, with more engineers remotely accessing control systems for the pipeline from home. James Chappell, Co-Founder of Digital Shadows, said DarkSide could have bought account login details for remote desktop software such as TeamViewer and Microsoft Remote Desktop.<\/p>\n\n\n\n

\"We're seeing a lot of victims now, this is seriously a big problem,\" said Chappell in a statement. \"The amount of small businesses that are falling victim <\/a>to this. It's becoming a big problem for the economy globally.\"<\/p>\n\n\n\n

\"Cybercriminals don\u2019t really care how important your business is, only how much money they might extract from you,\" comments Tim Mackey Principal Security Strategist at the Synopsys CyRC (Cybersecurity Research Centre). \"This trend can be seen with increasing attacks on municipalities, healthcare systems, and elements of critical infrastructure. Each of these organisations will bring in law enforcement, yet attackers continue to be aggressive in their activities. <\/p>\n\n\n\n

\"While Colonial Pipeline is a US operation, attacks are global in scope. And despite warnings from officials like the US Treasury Department highlighting how ransomware payments are used to fund future criminal activities, victims are often faced with the difficult decision of whether to pay the ransom.\"<\/p>\n\n\n\n

\"The Colonial Pipeline attack reinforces the need to update legacy systems running today\u2019s critical infrastructure networks...\"<\/p>Lior Div, CEO and Co-founder, Cybereason<\/cite><\/blockquote><\/figure>\n\n\n\n

Remaining critical <\/strong><\/p>\n\n\n\n

\u201cThese \u2018Cyber Physical\u2019 attacks are a big deal, because they demonstrate just how fragile the provision of critical services are into society,\" says Andy Norton European Cyber Risk Officer at Armis. \"A few weeks ago a water treatment plant<\/a> was compromised leading to the potential for poisoning of the water. Now, 45% of the US oil energy provision has been switched off to the East coast. Prolonged shortages in critical services lead to civil unrest, economic pressures, and a general lack of confidence in public administration.\" <\/p>\n\n\n\n

Lior Div, CEO and Co-founder of Cybereason also comments: \"The SolarWinds<\/a> and Microsoft Exchange Server<\/a> attacks were unparalleled in their scope, successfully infiltrating and compromising virtually every US government agency and a wide array of medium and large private sector companies. The Colonial Pipeline attack reinforces the need to update legacy systems running today\u2019s critical infrastructure networks.<\/p>\n\n\n\n

\"If the public and private sectors can work together to solve complex cybersecurity issues, and at the same time accurately identify the threat actors and bring them to account for their actions, it will go a long way in reversing the adversary advantage and enable defenders to retake the high ground. There is also another significant opportunity here as well to cooperate on a global scale to develop extradition laws that enable cyber crimes and cyber espionage to be prosecuted more effectively.\u201d<\/p>\n\n\n\n

Mackey agrees, stating: \"Avoiding becoming a victim of ransomware requires organisations to have a comprehensive cybersecurity plan in place that fully captures the risks of each software component, its role and lifecycle, and its deployment configuration and usage assumptions. Armed with this basic information, and an exhaustive inventory, it becomes possible to determine how each component might play a role in an attempted ransomware attack. <\/p>\n\n\n\n

\"An effort like the one impacting Colonial Pipeline is likely the result of multiple weaknesses in process and cyber-defences that were ultimately successfully exploited. With the age of some industrial software systems far exceeding that of commercial software, it\u2019s likely that older software wasn\u2019t designed to limit exposure to modern threats like ransomware attacks. <\/p>\n\n\n\n

\"While the age of the software has limited impact on its serviceability, threat models and defensive protections need to keep pace with new threats \u2013 something that can only be done if all weaknesses present in each component are known and accounted for. After all, if a criminal can identify your weaknesses faster than you can, luck is rarely on your side.\u201d<\/p>\n\n\n\n

\"While this is indeed a financial disaster, and will have a significant impact on many, let us also consider that this means that, at least for a time, threat actors had control of those very same IT systems.\"<\/p>Martin Jartelius, CSO, Outpost24<\/cite><\/blockquote><\/figure>\n\n\n\n

Taking back control <\/strong><\/p>\n\n\n\n

US government officials are currently working with Colonial to help it recover while scrambling to avoid more severe fuel supply disruptions should the outage continue. Whether the pipeline stays shut that long in turn depends on how deeply the hackers penetrated Colonial\u2019s network - and how soon cybersecurity experts can pull them out.<\/p>\n\n\n\n

\"As so many times before when talking about ransomware \u2013 to lock a system with ransomware you need a good degree of control of that system,\" says Martin Jartelius, CSO at Outpost24. \"While this is indeed a financial disaster, and will have a significant impact on many, let us also consider that this means that, at least for a time, threat actors had control of those very same IT systems. Preventive security, as well as segmentation, are critical for those kinds of environments.\"<\/p>\n\n\n\n

\"One thing to note here is that ransomware has to announce itself to be successful,\" adds Tim Erlin, VP at Tripwire. \"In industrial environments, cyber events aren\u2019t always this visible. Increasing visibility into industrial networks becomes more important as attackers continue to target critical infrastructure.\u201d<\/p>\n\n\n\n

Brad Brooks, CEO and President of OneLogin, rightfully concludes: \"This attack represents just how quickly the stakes are escalating on Cybersecurity, with controlling and knowing who has access to your IT systems a board level priority for every company. We are moving from an invisible Cold War that was focused on stealing data to a highly visible hot war that has real implications for physical property and people\u2019s lives.\u201d<\/p>\n","post_title":"Ransomware roundtable | A threat in the pipeline","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"ransomware-roundtable-a-threat-in-the-pipeline","to_ping":"","pinged":"","post_modified":"2021-05-10 18:12:55","post_modified_gmt":"2021-05-10 17:12:55","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=6024","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4871,"post_author":"3","post_date":"2021-02-09 19:22:22","post_date_gmt":"2021-02-09 19:22:22","post_content":"Detectives assigned to the Digital Forensics Unit at Pinellas County Sheriff\u2019s Office are investigating an unlawful computer software intrusion at the City of Oldsmar\u2019s water treatment plant. While the cyber attack was unsuccessful, it does highlight the need for cybersecurity tools in critical infrastructure applications.\n\nOn Friday, February 5, 2021, the Pinellas County Sheriff\u2019s Office was notified by the City of Oldsmar that its computer system had been remotely accessed at 8:00am and 1:30pm by an unknown suspect. According to detectives, the City of Oldsmar\u2019s computer system at the water treatment plant allows for remote access by authorised users to troubleshoot any system problems from other locations.\n\nThe initial intrusion was brief and not cause for concern due to supervisors regularly accessing the system remotely to monitor the system. At 1:30, a plant operator witnessed a second remote access user opening various functions in the system that control the amount of sodium hydroxide in the water. The operator noted the remote access user raised the levels of sodium hydroxide in the water from 100 parts per million to 11,100 parts per million. The operator immediately reduced the levels to their appropriate amount. Sodium hydroxide is used in small amounts to control acidity, but a large amount could have caused major problems in the water.\n\nThe initial investigation revealed that the hacker remotely accessed the treatment plant\u2019s computer for approximately 3 to 5 minutes. Speaking at a press conference about the cyber attack, Sheriff Bob Gualtieri stated: \u201cAt no time was there a significant effect on the water being treated, and more importantly the public was never in danger.\u201d\n\nCommenting on the attack, Andrea Carcano, co-founder at Nozomi Networks stated: \u201cUnfortunately, this attack plays into a troubling trend we\u2019ve been following over the last year. As the pandemic forced critical infrastructure organisations to quickly shift to remote access options to keep systems up and running, we\u2019ve seen threats rise and bad actors reach new lows \u2013 setting their sights on life threatening targets. Fortunately, in this case, operators monitoring Oldsmar\u2019s treatment plant spotted the attack and were able to respond before anyone could be harmed. But it\u2019s a stark reminder that with limited cybersecurity resources and few regulations water utilities are vulnerable to attack. When it comes critical infrastructure, operational resilience must a top priority and advances in AI-powered OT security and network monitoring are available to give operators the network visibility they need to quickly spot trouble and respond before harm is done.\u201d\n\n\u201cThis targeted attack appears to have started by the \u2018bad actor\u2019 getting access to a vulnerable network\/system and working their way through the network trying to find the next weak access point while gathering data and understanding how the organisation operates along the way,\u201d added Niamh Muldoon, Global Data Protection Officer at OneLogin. \u201cIn this instance, understanding the information assets, applying not only MFA but enhanced multi-factor authentication, would have reduced the risk of this unauthorised attack materializing. It\u2019s a critical part of the MFA policy to enforce time limits for end-users and their trusted devices to re-authenticate, requiring them not only to validate themselves but also the identity of the device trying to access critical systems\/applications and the network. Without knowing more of the details, applying enhanced MFA to the execution of critical actions particularly for IT and systems administrators would have reduced the associated risk further. Having logging in place, and understanding logged events would support with the associated monitoring and alerting events. After the event has happened, crisis management is critical for successfully managing the attack response to reduce business impact and consequences, and it appears the Florida agency has done that.\u201d\n\n\u201cWhile this incident will rightfully cause concern, it appears that likelihood of real damage was minimal due to the fail safes in place,\u201d observes Tim Erlin, VP at Tripwire. \u201cThere are real impacts to be worried about, and actions to be taken, but this doesn\u2019t appear to be a sophisticated or novel attack. From a cybersecurity standpoint, we should be particularly concerned about how the attacker was able to authenticate into the remote access software. That entry point should be very well protected, given that it provides access to such obviously sensitive capabilities. Protecting remote access into industrial systems where these types of changes can be made should be a high priority for any industrial environment.\u201d\n\nLocal, State, and Federal investigators are working together to identify those responsible and the investigation is ongoing. Other utility providers have been informed of the intrusion, so they can take their own protective measures.","post_title":"Florida water system cyber attack highlights role of cybersecurity in critical infrastructure","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"florida-water-system-cyber-attack-highlights-role-of-cybersecurity-in-critical-infrastructure","to_ping":"","pinged":"","post_modified":"2021-02-09 19:22:25","post_modified_gmt":"2021-02-09 19:22:25","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4871","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4178,"post_author":"3","post_date":"2020-12-07 14:52:36","post_date_gmt":"2020-12-07 14:52:36","post_content":"Nozomi Networks and Chinook Systems have partnered to provide advanced cybersecurity solutions to protect industrial and critical infrastructure facilities across North America. Under the deal, Chinook will offer Nozomi Networks\u2019 complete portfolio of OT and IoT security solutions.\n\n\u201cFacilities that fully leverage their OT systems deliver tremendous returns when it comes to energy and operational savings, the safety and comfort of occupants and lower total cost of ownership,\u201d said Chinook\u2019s President, Wanda Lenkewich. \u201cAt the same time, the network connectivity that enables these systems, also introduces new and growing cyber threats. Partnering with Nozomi Networks allows Chinook to support clients with an integrated, comprehensive cybersecurity solution that ensures cyber threats are actively discovered, monitored and managed.\u201d\n\n\u201cWe are absolutely delighted to team with Chinook to help industrial and critical infrastructure facilities meet new requirements for secure connectivity across OT, IT and IoT networks,\u201d said Chet Namboodri, Vice President, Worldwide Business Development and Channel Sales at Nozomi. \u201cWe\u2019ve already worked together to deliver on a number of joint customer engagements in both the government and commercial sectors. Partnering with Chinook accelerates our joint efforts to make sure facility-related control and building management systems are safe from cyber threats.\u201d\n\nwww.nozominetworks.com<\/a>\n\nwww.chinooksystems.com<\/a>\n\n ","post_title":"Nozomi Networks and Chinook Systems partner for OT and IoT security solutions","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"nozomi-networks-and-chinook-systems-partner-for-ot-and-iot-security-solutions","to_ping":"","pinged":"","post_modified":"2020-12-07 14:52:40","post_modified_gmt":"2020-12-07 14:52:40","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4178","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4140,"post_author":"3","post_date":"2020-12-03 11:07:21","post_date_gmt":"2020-12-03 11:07:21","post_content":"Civil Nuclear Constabulary (CNC) police officers based at Harwell have launched Project Servator a collaborative community approach to policing. Project Servator aims to disrupt a range of criminal activity, including terrorism, while providing a reassuring presence for the public.\n\nCNC\u2019s officers are experienced and specially trained to spot the tell-tale signs that someone is planning or preparing to commit an illegal act. It works with other police forces, local businesses and the public to protect the Harwell site and the surrounding area and everyone who lives, works or visits there and to make it a difficult place for terrorists and other criminals to operate. Project Servator has been successful in gathering intelligence that has assisted Counter Terrorism Units across the UK in investigating and preventing acts of terror.\n\nProject Servator\u2019s patrols are highly visible and can happen at any time and in any location. Officers will talk to the public and local businesses to let them know what they\u2019re doing and remind them to be vigilant, trust their instincts and report any suspicious or unusual behaviour.\n\n\u201cWe are deploying these additional tactics to further complement the operational activity that exists in and around our Operational Policing Units,\u201d explained Supt Donna Jones, who is leading on the implementation of the project across the Constabulary. \u201cOur aim is to build upon relationships with partners as well as businesses and communities. These tactics are not new but allow us to have a focus on community engagement and encourage people to be our extra eyes and ears. This is not restricted to the Harwell site but also extends to the surrounding area. We are aware of the vast amount of information members of our community have and they are aware of what is out of the ordinary. All we ask is that they report any suspicions to us and we\u2019ll do the rest. The deployments will be unpredictable and our tactics will vary from one deployment to the next. The aim is to work with our local communities to deter any hostile threat.\u201d\n\nwww.gov.uk\/government\/organisations\/civil-nuclear-constabulary<\/a>","post_title":"CNC Harwell launches Project Servator","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"cnc-harwell-launches-project-servator","to_ping":"","pinged":"","post_modified":"2020-12-03 11:07:23","post_modified_gmt":"2020-12-03 11:07:23","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4140","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4102,"post_author":"3","post_date":"2020-11-30 17:30:23","post_date_gmt":"2020-11-30 17:30:23","post_content":"Radiflow and Mitsubishi Electric UK are collaborating to address the needs of IEC62443 cyber security standards in the Critical Infrastructure and Industrial Automation markets. The companys believe that the combination of the automation knowledge and tools of Mitsubishi Electric UK with the cyber security and IEC 62443 compliance skills of Radiflow will provide a holistic view of a client\u2019s risk posture.\n\nRadiflow will also provide Mitsubishi Electric UK customers with a consultancy service for cyber security, which includes the provision of OT security risk assessments, provision of Radiflow intrusion detection software and general advice on alignment with IEC 62443-3. In addition, the solution is intended to help customers to support asset owners in satisfying the requirements of the NIS Directive along with due diligence in alignment with CPNI (Centre for the Protection of National Infrastructure) best practice.\n\n\u201cOur new collaboration with Radiflow provides expertise in the field of OT cyber security which compliments and broadens the services that we offer our customers through the Mitsubishi Electric UK System Service Operation,\u201d said David Bean, Solutions Manager for Mitsubishi Electric UK. \u201cThere is a growing demand for solutions that address the requirements of cyber security in the OT space and we are looking forward to delivering those solutions and building our relationship further with the team at Radiflow.\u201d\n\n\u201cRadiflow sees huge value for OT organisations to have cyber security services and solutions aligned with their automation systems,\u201d added Ilan Barda, Founder and CEO of Radiflow. \u201cBy combining the automation knowledge and tools of Mitsubishi with the OT cyber security skills and tools of Radiflow, we are able to provide a holistic view of an organisation\u2019s OT risk posture.\u201d\n\nwww.radiflow.com<\/a>","post_title":"Radiflow and Mitsubishi Electric UK collaborate on cyber security standards","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"radiflow-and-mitsubishi-electric-uk-collaborate-on-cyber-security-standards","to_ping":"","pinged":"","post_modified":"2020-11-30 17:30:25","post_modified_gmt":"2020-11-30 17:30:25","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4102","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":3359,"post_author":"3","post_date":"2020-10-16 17:11:16","post_date_gmt":"2020-10-16 16:11:16","post_content":"Senstar explains how its products can be applied to protect the full range of upstream, midstream, and downstream facilities in the oil and gas industry.","post_title":"Senstar explains its security solutions for oil and gas","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"senstar-explains-its-security-solutions-for-oil-and-gas","to_ping":"","pinged":"","post_modified":"2020-10-16 17:11:17","post_modified_gmt":"2020-10-16 16:11:17","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=3359","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"}],"next":false,"prev":false,"total_page":1},"paged":1,"column_class":"jeg_col_2o3","class":"epic_block_14"};

\n

The company offers advanced security and surveillance systems that help protect people, property, communities, and assets worldwide.<\/p>\n\n\n\n

The solutions are aimed primarily but not exclusively at industries and niche sectors that are mission-critical such as oil & gas, public space, transport and major infrastructure.<\/p>\n\n\n\n

Telemetry and analytics using best-of-breed proprietary algorithms protect volatile environments. Synectics<\/a> claims that its camera stations will perform in ambient temperatures up to +70\u00b0C without compromise. The products are thus a go-to choice for end-users in major industrial installations including marine.<\/p>\n\n\n\n

The new Synergy AI Suite exploits true intelligence in its video surveillance and analytics tools. A mobile App allows stakeholders of many types to have visibility and take ownership of their sites.<\/p>\n\n\n\n

Predictive maintenance is a significant offering which reduces site downtime and has long term cost of ownership benefits for customers. Facility managers are empowered to take the right maintenance action at an appropriate time. Integrated maps with Synectics software allow site-mapping and optimisation of work flows as well as rapid site familiarity for new staff. Again, the multi-tasking of the products has financial benefits for users.<\/p>\n\n\n\n

For more Intersec news, click here<\/a> <\/p>\n","post_title":"Synectics multi-streams and multi-tasks at Intersec 2025","post_excerpt":"","post_status":"publish","comment_status":"closed","ping_status":"closed","post_password":"","post_name":"synectics-multi-streams-and-multi-tasks","to_ping":"","pinged":"","post_modified":"2025-01-20 15:37:34","post_modified_gmt":"2025-01-20 15:37:34","post_content_filtered":"","post_parent":0,"guid":"https:\/\/securityonscreen.com\/?p=25336","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":7381,"post_author":"3","post_date":"2021-08-13 16:10:10","post_date_gmt":"2021-08-13 15:10:10","post_content":"PowerVision Tech has released its new industrial drone system \u2014 PowerVision True Unmanned Aerial Solution. The solution integrates the PowerVision Dock, PowerEgg X 8K drone and the PowerVision Cloud web-based software platform. This solution can be used widely across countless applications, such as powerline inspections, environmental compliance, O&G asset inspections, facility security, GIS, surveying, and mapping.\n\nThe PowerVision True Unmanned Aerial Solution weighs 15.8kg in a 570\u00d7400\u00d7250mm form factor. This compact design allows the entire solution to be deployed by a single person, without special tools or equipment. Powered by artificial intelligence, the PowerVision True Unmanned Aerial System streamlines the drone\u2019s takeoff, flight, dynamic mission and return to the charging dock autonomously. A single installed solution can cover an area with a radius of 3.1 miles (5km). Multiple units can be connected and installed in an area to cover large-scale infrastructure projects or assets.\n\nTo meet the requirements for outdoor operations, PowerVision Dock is IP55-rated to resist dust and water in different environments. With the help of an intelligent temperature control system, it can still perform at an ambient temperature between 20\u2103 and 45\u2103. The onboard intelligent system monitors real-time temperatures, precipitation and wind to secure operational safety.\n\nThe PowerEgg X 8K uses a 1\/2-inch CMOS sensor to capture 48-megapixel photos and 8K UHD videos, all with 4x lossless zoom. Optimisations to the propellers, ESC, and the entire system have been made to achieve a 34-minute flight time. PowerEgg X 8K supports dual-band communication (2.4\/5.8GHz), interference detection and avoidance, dynamic frequency switching, anti-disturbance and real-time FHD image transmission with a max transmission distance of 7.5miles(12km). The PowerEgg X 8K can withstand the wind up to Level 7 on the Beaufort Scale (Near Gale) and fly in adverse weather conditions. A newly designed supplementary landing light automatically triggers under low light conditions to secure the take-off and landing.\n\nIn order to meet the special demands for the power industry, the PowerVision True Unmanned Aerial Solution also supports centimetre-level positioning, solar power supply and transmission extension antennas.\n\nwww.powervision.me<\/a>","post_title":"PowerVision introduces its True Unmanned Aerial Solution","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"powervision-introduces-its-true-unmanned-aerial-solution","to_ping":"","pinged":"","post_modified":"2021-08-13 16:10:16","post_modified_gmt":"2021-08-13 15:10:16","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=7381","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":6024,"post_author":"48","post_date":"2021-05-10 17:00:22","post_date_gmt":"2021-05-10 16:00:22","post_content":"\n

The latest roundtable discussion from Security on Screen analyses the Colonial Pipeline's major ransomware attack and how it highlights the risk ransomware can pose, not just to businesses, but to critical national industrial infrastructure <\/em><\/p>\n\n\n\n

The US government issued an emergency legislation on Sunday after The Colonial Pipeline (located in Alpharetta, Georgia) was hit by a severe ransomware attack. The largest fuel pipeline in the US, the Colonial Pipeline carries 2.5 million barrels a day - 45% of the East Coast's supply of diesel, petrol and jet fuel.<\/p>\n\n\n\n

Sources said the ransomware attack was likely to have been caused by a cyber-criminal gang called DarkSide, who infiltrated Colonial's network and locked the data on some computers and servers, demanding a ransom on Friday. The gang tried to take almost 100 gigabytes of data hostage, threatening to leak it onto the internet, but the FBI and other government agencies worked with private companies to respond. <\/p>\n\n\n\n

Subsequently, the operator took itself offline on Friday after the cyber-attack was discovered, with the cloud computing system that was used by the hackers to collect the stolen data was taken offline on Saturday. Colonial's data did not appear to have been transferred from that system anywhere else, potentially limiting the hackers' leverage to extort or further embarrass the company. <\/p>\n\n\n\n

On Sunday, Colonial said that although its four main pipelines remain offline, some smaller lines between terminals and delivery points were now operational. The US government has now relaxed rules on fuel being transported by road, meaning drivers in 18 states can work extra or more flexible hours when transporting refined petroleum products.<\/p>\n\n\n\n

While US fuel prices at the pump were largely unaffected on Monday, there are fears that could change if the shutdown is prolonged. <\/p>\n\n\n\n

\"The fact that the US government has quickly issued emergency legislation to relax rules on road fuel transportation highlights how concerning this attack is...\"<\/p>Lewis Jones, Threat Intelligence Analyst, Talion<\/cite><\/blockquote><\/figure>\n\n\n\n

A major disruption<\/strong><\/p>\n\n\n\n

In response to this substantial attack, Lewis Jones, Threat Intelligence Analyst at Talion says: \u201cThis appears to be one of the most disruptive ransomware attacks ever reported, highlighting the vulnerabilities in the energy sector and why it is often targeted by attackers. A long term ransomware negotiation within the energy sector could cause mass disruption and means that the likelihood of payment is increased. <\/p>\n\n\n\n

\"The fact that US government has quickly issued emergency legislation to relax rules on road fuel transportation highlights how concerning this attack is. A longer term implication of the attack could create a delay in delivery and disruption of the supply chain. This would cause an increase in price at a time when the economy is already fragile due to the current pandemic.\" <\/p>\n\n\n\n

Computer security service, Digital Shadows has claimed that the Colonial attack was indeed helped by the coronavirus pandemic, with more engineers remotely accessing control systems for the pipeline from home. James Chappell, Co-Founder of Digital Shadows, said DarkSide could have bought account login details for remote desktop software such as TeamViewer and Microsoft Remote Desktop.<\/p>\n\n\n\n

\"We're seeing a lot of victims now, this is seriously a big problem,\" said Chappell in a statement. \"The amount of small businesses that are falling victim <\/a>to this. It's becoming a big problem for the economy globally.\"<\/p>\n\n\n\n

\"Cybercriminals don\u2019t really care how important your business is, only how much money they might extract from you,\" comments Tim Mackey Principal Security Strategist at the Synopsys CyRC (Cybersecurity Research Centre). \"This trend can be seen with increasing attacks on municipalities, healthcare systems, and elements of critical infrastructure. Each of these organisations will bring in law enforcement, yet attackers continue to be aggressive in their activities. <\/p>\n\n\n\n

\"While Colonial Pipeline is a US operation, attacks are global in scope. And despite warnings from officials like the US Treasury Department highlighting how ransomware payments are used to fund future criminal activities, victims are often faced with the difficult decision of whether to pay the ransom.\"<\/p>\n\n\n\n

\"The Colonial Pipeline attack reinforces the need to update legacy systems running today\u2019s critical infrastructure networks...\"<\/p>Lior Div, CEO and Co-founder, Cybereason<\/cite><\/blockquote><\/figure>\n\n\n\n

Remaining critical <\/strong><\/p>\n\n\n\n

\u201cThese \u2018Cyber Physical\u2019 attacks are a big deal, because they demonstrate just how fragile the provision of critical services are into society,\" says Andy Norton European Cyber Risk Officer at Armis. \"A few weeks ago a water treatment plant<\/a> was compromised leading to the potential for poisoning of the water. Now, 45% of the US oil energy provision has been switched off to the East coast. Prolonged shortages in critical services lead to civil unrest, economic pressures, and a general lack of confidence in public administration.\" <\/p>\n\n\n\n

Lior Div, CEO and Co-founder of Cybereason also comments: \"The SolarWinds<\/a> and Microsoft Exchange Server<\/a> attacks were unparalleled in their scope, successfully infiltrating and compromising virtually every US government agency and a wide array of medium and large private sector companies. The Colonial Pipeline attack reinforces the need to update legacy systems running today\u2019s critical infrastructure networks.<\/p>\n\n\n\n

\"If the public and private sectors can work together to solve complex cybersecurity issues, and at the same time accurately identify the threat actors and bring them to account for their actions, it will go a long way in reversing the adversary advantage and enable defenders to retake the high ground. There is also another significant opportunity here as well to cooperate on a global scale to develop extradition laws that enable cyber crimes and cyber espionage to be prosecuted more effectively.\u201d<\/p>\n\n\n\n

Mackey agrees, stating: \"Avoiding becoming a victim of ransomware requires organisations to have a comprehensive cybersecurity plan in place that fully captures the risks of each software component, its role and lifecycle, and its deployment configuration and usage assumptions. Armed with this basic information, and an exhaustive inventory, it becomes possible to determine how each component might play a role in an attempted ransomware attack. <\/p>\n\n\n\n

\"An effort like the one impacting Colonial Pipeline is likely the result of multiple weaknesses in process and cyber-defences that were ultimately successfully exploited. With the age of some industrial software systems far exceeding that of commercial software, it\u2019s likely that older software wasn\u2019t designed to limit exposure to modern threats like ransomware attacks. <\/p>\n\n\n\n

\"While the age of the software has limited impact on its serviceability, threat models and defensive protections need to keep pace with new threats \u2013 something that can only be done if all weaknesses present in each component are known and accounted for. After all, if a criminal can identify your weaknesses faster than you can, luck is rarely on your side.\u201d<\/p>\n\n\n\n

\"While this is indeed a financial disaster, and will have a significant impact on many, let us also consider that this means that, at least for a time, threat actors had control of those very same IT systems.\"<\/p>Martin Jartelius, CSO, Outpost24<\/cite><\/blockquote><\/figure>\n\n\n\n

Taking back control <\/strong><\/p>\n\n\n\n

US government officials are currently working with Colonial to help it recover while scrambling to avoid more severe fuel supply disruptions should the outage continue. Whether the pipeline stays shut that long in turn depends on how deeply the hackers penetrated Colonial\u2019s network - and how soon cybersecurity experts can pull them out.<\/p>\n\n\n\n

\"As so many times before when talking about ransomware \u2013 to lock a system with ransomware you need a good degree of control of that system,\" says Martin Jartelius, CSO at Outpost24. \"While this is indeed a financial disaster, and will have a significant impact on many, let us also consider that this means that, at least for a time, threat actors had control of those very same IT systems. Preventive security, as well as segmentation, are critical for those kinds of environments.\"<\/p>\n\n\n\n

\"One thing to note here is that ransomware has to announce itself to be successful,\" adds Tim Erlin, VP at Tripwire. \"In industrial environments, cyber events aren\u2019t always this visible. Increasing visibility into industrial networks becomes more important as attackers continue to target critical infrastructure.\u201d<\/p>\n\n\n\n

Brad Brooks, CEO and President of OneLogin, rightfully concludes: \"This attack represents just how quickly the stakes are escalating on Cybersecurity, with controlling and knowing who has access to your IT systems a board level priority for every company. We are moving from an invisible Cold War that was focused on stealing data to a highly visible hot war that has real implications for physical property and people\u2019s lives.\u201d<\/p>\n","post_title":"Ransomware roundtable | A threat in the pipeline","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"ransomware-roundtable-a-threat-in-the-pipeline","to_ping":"","pinged":"","post_modified":"2021-05-10 18:12:55","post_modified_gmt":"2021-05-10 17:12:55","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=6024","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4871,"post_author":"3","post_date":"2021-02-09 19:22:22","post_date_gmt":"2021-02-09 19:22:22","post_content":"Detectives assigned to the Digital Forensics Unit at Pinellas County Sheriff\u2019s Office are investigating an unlawful computer software intrusion at the City of Oldsmar\u2019s water treatment plant. While the cyber attack was unsuccessful, it does highlight the need for cybersecurity tools in critical infrastructure applications.\n\nOn Friday, February 5, 2021, the Pinellas County Sheriff\u2019s Office was notified by the City of Oldsmar that its computer system had been remotely accessed at 8:00am and 1:30pm by an unknown suspect. According to detectives, the City of Oldsmar\u2019s computer system at the water treatment plant allows for remote access by authorised users to troubleshoot any system problems from other locations.\n\nThe initial intrusion was brief and not cause for concern due to supervisors regularly accessing the system remotely to monitor the system. At 1:30, a plant operator witnessed a second remote access user opening various functions in the system that control the amount of sodium hydroxide in the water. The operator noted the remote access user raised the levels of sodium hydroxide in the water from 100 parts per million to 11,100 parts per million. The operator immediately reduced the levels to their appropriate amount. Sodium hydroxide is used in small amounts to control acidity, but a large amount could have caused major problems in the water.\n\nThe initial investigation revealed that the hacker remotely accessed the treatment plant\u2019s computer for approximately 3 to 5 minutes. Speaking at a press conference about the cyber attack, Sheriff Bob Gualtieri stated: \u201cAt no time was there a significant effect on the water being treated, and more importantly the public was never in danger.\u201d\n\nCommenting on the attack, Andrea Carcano, co-founder at Nozomi Networks stated: \u201cUnfortunately, this attack plays into a troubling trend we\u2019ve been following over the last year. As the pandemic forced critical infrastructure organisations to quickly shift to remote access options to keep systems up and running, we\u2019ve seen threats rise and bad actors reach new lows \u2013 setting their sights on life threatening targets. Fortunately, in this case, operators monitoring Oldsmar\u2019s treatment plant spotted the attack and were able to respond before anyone could be harmed. But it\u2019s a stark reminder that with limited cybersecurity resources and few regulations water utilities are vulnerable to attack. When it comes critical infrastructure, operational resilience must a top priority and advances in AI-powered OT security and network monitoring are available to give operators the network visibility they need to quickly spot trouble and respond before harm is done.\u201d\n\n\u201cThis targeted attack appears to have started by the \u2018bad actor\u2019 getting access to a vulnerable network\/system and working their way through the network trying to find the next weak access point while gathering data and understanding how the organisation operates along the way,\u201d added Niamh Muldoon, Global Data Protection Officer at OneLogin. \u201cIn this instance, understanding the information assets, applying not only MFA but enhanced multi-factor authentication, would have reduced the risk of this unauthorised attack materializing. It\u2019s a critical part of the MFA policy to enforce time limits for end-users and their trusted devices to re-authenticate, requiring them not only to validate themselves but also the identity of the device trying to access critical systems\/applications and the network. Without knowing more of the details, applying enhanced MFA to the execution of critical actions particularly for IT and systems administrators would have reduced the associated risk further. Having logging in place, and understanding logged events would support with the associated monitoring and alerting events. After the event has happened, crisis management is critical for successfully managing the attack response to reduce business impact and consequences, and it appears the Florida agency has done that.\u201d\n\n\u201cWhile this incident will rightfully cause concern, it appears that likelihood of real damage was minimal due to the fail safes in place,\u201d observes Tim Erlin, VP at Tripwire. \u201cThere are real impacts to be worried about, and actions to be taken, but this doesn\u2019t appear to be a sophisticated or novel attack. From a cybersecurity standpoint, we should be particularly concerned about how the attacker was able to authenticate into the remote access software. That entry point should be very well protected, given that it provides access to such obviously sensitive capabilities. Protecting remote access into industrial systems where these types of changes can be made should be a high priority for any industrial environment.\u201d\n\nLocal, State, and Federal investigators are working together to identify those responsible and the investigation is ongoing. Other utility providers have been informed of the intrusion, so they can take their own protective measures.","post_title":"Florida water system cyber attack highlights role of cybersecurity in critical infrastructure","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"florida-water-system-cyber-attack-highlights-role-of-cybersecurity-in-critical-infrastructure","to_ping":"","pinged":"","post_modified":"2021-02-09 19:22:25","post_modified_gmt":"2021-02-09 19:22:25","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4871","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4178,"post_author":"3","post_date":"2020-12-07 14:52:36","post_date_gmt":"2020-12-07 14:52:36","post_content":"Nozomi Networks and Chinook Systems have partnered to provide advanced cybersecurity solutions to protect industrial and critical infrastructure facilities across North America. Under the deal, Chinook will offer Nozomi Networks\u2019 complete portfolio of OT and IoT security solutions.\n\n\u201cFacilities that fully leverage their OT systems deliver tremendous returns when it comes to energy and operational savings, the safety and comfort of occupants and lower total cost of ownership,\u201d said Chinook\u2019s President, Wanda Lenkewich. \u201cAt the same time, the network connectivity that enables these systems, also introduces new and growing cyber threats. Partnering with Nozomi Networks allows Chinook to support clients with an integrated, comprehensive cybersecurity solution that ensures cyber threats are actively discovered, monitored and managed.\u201d\n\n\u201cWe are absolutely delighted to team with Chinook to help industrial and critical infrastructure facilities meet new requirements for secure connectivity across OT, IT and IoT networks,\u201d said Chet Namboodri, Vice President, Worldwide Business Development and Channel Sales at Nozomi. \u201cWe\u2019ve already worked together to deliver on a number of joint customer engagements in both the government and commercial sectors. Partnering with Chinook accelerates our joint efforts to make sure facility-related control and building management systems are safe from cyber threats.\u201d\n\nwww.nozominetworks.com<\/a>\n\nwww.chinooksystems.com<\/a>\n\n ","post_title":"Nozomi Networks and Chinook Systems partner for OT and IoT security solutions","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"nozomi-networks-and-chinook-systems-partner-for-ot-and-iot-security-solutions","to_ping":"","pinged":"","post_modified":"2020-12-07 14:52:40","post_modified_gmt":"2020-12-07 14:52:40","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4178","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4140,"post_author":"3","post_date":"2020-12-03 11:07:21","post_date_gmt":"2020-12-03 11:07:21","post_content":"Civil Nuclear Constabulary (CNC) police officers based at Harwell have launched Project Servator a collaborative community approach to policing. Project Servator aims to disrupt a range of criminal activity, including terrorism, while providing a reassuring presence for the public.\n\nCNC\u2019s officers are experienced and specially trained to spot the tell-tale signs that someone is planning or preparing to commit an illegal act. It works with other police forces, local businesses and the public to protect the Harwell site and the surrounding area and everyone who lives, works or visits there and to make it a difficult place for terrorists and other criminals to operate. Project Servator has been successful in gathering intelligence that has assisted Counter Terrorism Units across the UK in investigating and preventing acts of terror.\n\nProject Servator\u2019s patrols are highly visible and can happen at any time and in any location. Officers will talk to the public and local businesses to let them know what they\u2019re doing and remind them to be vigilant, trust their instincts and report any suspicious or unusual behaviour.\n\n\u201cWe are deploying these additional tactics to further complement the operational activity that exists in and around our Operational Policing Units,\u201d explained Supt Donna Jones, who is leading on the implementation of the project across the Constabulary. \u201cOur aim is to build upon relationships with partners as well as businesses and communities. These tactics are not new but allow us to have a focus on community engagement and encourage people to be our extra eyes and ears. This is not restricted to the Harwell site but also extends to the surrounding area. We are aware of the vast amount of information members of our community have and they are aware of what is out of the ordinary. All we ask is that they report any suspicions to us and we\u2019ll do the rest. The deployments will be unpredictable and our tactics will vary from one deployment to the next. The aim is to work with our local communities to deter any hostile threat.\u201d\n\nwww.gov.uk\/government\/organisations\/civil-nuclear-constabulary<\/a>","post_title":"CNC Harwell launches Project Servator","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"cnc-harwell-launches-project-servator","to_ping":"","pinged":"","post_modified":"2020-12-03 11:07:23","post_modified_gmt":"2020-12-03 11:07:23","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4140","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4102,"post_author":"3","post_date":"2020-11-30 17:30:23","post_date_gmt":"2020-11-30 17:30:23","post_content":"Radiflow and Mitsubishi Electric UK are collaborating to address the needs of IEC62443 cyber security standards in the Critical Infrastructure and Industrial Automation markets. The companys believe that the combination of the automation knowledge and tools of Mitsubishi Electric UK with the cyber security and IEC 62443 compliance skills of Radiflow will provide a holistic view of a client\u2019s risk posture.\n\nRadiflow will also provide Mitsubishi Electric UK customers with a consultancy service for cyber security, which includes the provision of OT security risk assessments, provision of Radiflow intrusion detection software and general advice on alignment with IEC 62443-3. In addition, the solution is intended to help customers to support asset owners in satisfying the requirements of the NIS Directive along with due diligence in alignment with CPNI (Centre for the Protection of National Infrastructure) best practice.\n\n\u201cOur new collaboration with Radiflow provides expertise in the field of OT cyber security which compliments and broadens the services that we offer our customers through the Mitsubishi Electric UK System Service Operation,\u201d said David Bean, Solutions Manager for Mitsubishi Electric UK. \u201cThere is a growing demand for solutions that address the requirements of cyber security in the OT space and we are looking forward to delivering those solutions and building our relationship further with the team at Radiflow.\u201d\n\n\u201cRadiflow sees huge value for OT organisations to have cyber security services and solutions aligned with their automation systems,\u201d added Ilan Barda, Founder and CEO of Radiflow. \u201cBy combining the automation knowledge and tools of Mitsubishi with the OT cyber security skills and tools of Radiflow, we are able to provide a holistic view of an organisation\u2019s OT risk posture.\u201d\n\nwww.radiflow.com<\/a>","post_title":"Radiflow and Mitsubishi Electric UK collaborate on cyber security standards","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"radiflow-and-mitsubishi-electric-uk-collaborate-on-cyber-security-standards","to_ping":"","pinged":"","post_modified":"2020-11-30 17:30:25","post_modified_gmt":"2020-11-30 17:30:25","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4102","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":3359,"post_author":"3","post_date":"2020-10-16 17:11:16","post_date_gmt":"2020-10-16 16:11:16","post_content":"Senstar explains how its products can be applied to protect the full range of upstream, midstream, and downstream facilities in the oil and gas industry.","post_title":"Senstar explains its security solutions for oil and gas","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"senstar-explains-its-security-solutions-for-oil-and-gas","to_ping":"","pinged":"","post_modified":"2020-10-16 17:11:17","post_modified_gmt":"2020-10-16 16:11:17","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=3359","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"}],"next":false,"prev":false,"total_page":1},"paged":1,"column_class":"jeg_col_2o3","class":"epic_block_14"};

\n

<\/p>\n\n\n\n

The company offers advanced security and surveillance systems that help protect people, property, communities, and assets worldwide.<\/p>\n\n\n\n

The solutions are aimed primarily but not exclusively at industries and niche sectors that are mission-critical such as oil & gas, public space, transport and major infrastructure.<\/p>\n\n\n\n

Telemetry and analytics using best-of-breed proprietary algorithms protect volatile environments. Synectics<\/a> claims that its camera stations will perform in ambient temperatures up to +70\u00b0C without compromise. The products are thus a go-to choice for end-users in major industrial installations including marine.<\/p>\n\n\n\n

The new Synergy AI Suite exploits true intelligence in its video surveillance and analytics tools. A mobile App allows stakeholders of many types to have visibility and take ownership of their sites.<\/p>\n\n\n\n

Predictive maintenance is a significant offering which reduces site downtime and has long term cost of ownership benefits for customers. Facility managers are empowered to take the right maintenance action at an appropriate time. Integrated maps with Synectics software allow site-mapping and optimisation of work flows as well as rapid site familiarity for new staff. Again, the multi-tasking of the products has financial benefits for users.<\/p>\n\n\n\n

For more Intersec news, click here<\/a> <\/p>\n","post_title":"Synectics multi-streams and multi-tasks at Intersec 2025","post_excerpt":"","post_status":"publish","comment_status":"closed","ping_status":"closed","post_password":"","post_name":"synectics-multi-streams-and-multi-tasks","to_ping":"","pinged":"","post_modified":"2025-01-20 15:37:34","post_modified_gmt":"2025-01-20 15:37:34","post_content_filtered":"","post_parent":0,"guid":"https:\/\/securityonscreen.com\/?p=25336","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":7381,"post_author":"3","post_date":"2021-08-13 16:10:10","post_date_gmt":"2021-08-13 15:10:10","post_content":"PowerVision Tech has released its new industrial drone system \u2014 PowerVision True Unmanned Aerial Solution. The solution integrates the PowerVision Dock, PowerEgg X 8K drone and the PowerVision Cloud web-based software platform. This solution can be used widely across countless applications, such as powerline inspections, environmental compliance, O&G asset inspections, facility security, GIS, surveying, and mapping.\n\nThe PowerVision True Unmanned Aerial Solution weighs 15.8kg in a 570\u00d7400\u00d7250mm form factor. This compact design allows the entire solution to be deployed by a single person, without special tools or equipment. Powered by artificial intelligence, the PowerVision True Unmanned Aerial System streamlines the drone\u2019s takeoff, flight, dynamic mission and return to the charging dock autonomously. A single installed solution can cover an area with a radius of 3.1 miles (5km). Multiple units can be connected and installed in an area to cover large-scale infrastructure projects or assets.\n\nTo meet the requirements for outdoor operations, PowerVision Dock is IP55-rated to resist dust and water in different environments. With the help of an intelligent temperature control system, it can still perform at an ambient temperature between 20\u2103 and 45\u2103. The onboard intelligent system monitors real-time temperatures, precipitation and wind to secure operational safety.\n\nThe PowerEgg X 8K uses a 1\/2-inch CMOS sensor to capture 48-megapixel photos and 8K UHD videos, all with 4x lossless zoom. Optimisations to the propellers, ESC, and the entire system have been made to achieve a 34-minute flight time. PowerEgg X 8K supports dual-band communication (2.4\/5.8GHz), interference detection and avoidance, dynamic frequency switching, anti-disturbance and real-time FHD image transmission with a max transmission distance of 7.5miles(12km). The PowerEgg X 8K can withstand the wind up to Level 7 on the Beaufort Scale (Near Gale) and fly in adverse weather conditions. A newly designed supplementary landing light automatically triggers under low light conditions to secure the take-off and landing.\n\nIn order to meet the special demands for the power industry, the PowerVision True Unmanned Aerial Solution also supports centimetre-level positioning, solar power supply and transmission extension antennas.\n\nwww.powervision.me<\/a>","post_title":"PowerVision introduces its True Unmanned Aerial Solution","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"powervision-introduces-its-true-unmanned-aerial-solution","to_ping":"","pinged":"","post_modified":"2021-08-13 16:10:16","post_modified_gmt":"2021-08-13 15:10:16","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=7381","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":6024,"post_author":"48","post_date":"2021-05-10 17:00:22","post_date_gmt":"2021-05-10 16:00:22","post_content":"\n

The latest roundtable discussion from Security on Screen analyses the Colonial Pipeline's major ransomware attack and how it highlights the risk ransomware can pose, not just to businesses, but to critical national industrial infrastructure <\/em><\/p>\n\n\n\n

The US government issued an emergency legislation on Sunday after The Colonial Pipeline (located in Alpharetta, Georgia) was hit by a severe ransomware attack. The largest fuel pipeline in the US, the Colonial Pipeline carries 2.5 million barrels a day - 45% of the East Coast's supply of diesel, petrol and jet fuel.<\/p>\n\n\n\n

Sources said the ransomware attack was likely to have been caused by a cyber-criminal gang called DarkSide, who infiltrated Colonial's network and locked the data on some computers and servers, demanding a ransom on Friday. The gang tried to take almost 100 gigabytes of data hostage, threatening to leak it onto the internet, but the FBI and other government agencies worked with private companies to respond. <\/p>\n\n\n\n

Subsequently, the operator took itself offline on Friday after the cyber-attack was discovered, with the cloud computing system that was used by the hackers to collect the stolen data was taken offline on Saturday. Colonial's data did not appear to have been transferred from that system anywhere else, potentially limiting the hackers' leverage to extort or further embarrass the company. <\/p>\n\n\n\n

On Sunday, Colonial said that although its four main pipelines remain offline, some smaller lines between terminals and delivery points were now operational. The US government has now relaxed rules on fuel being transported by road, meaning drivers in 18 states can work extra or more flexible hours when transporting refined petroleum products.<\/p>\n\n\n\n

While US fuel prices at the pump were largely unaffected on Monday, there are fears that could change if the shutdown is prolonged. <\/p>\n\n\n\n

\"The fact that the US government has quickly issued emergency legislation to relax rules on road fuel transportation highlights how concerning this attack is...\"<\/p>Lewis Jones, Threat Intelligence Analyst, Talion<\/cite><\/blockquote><\/figure>\n\n\n\n

A major disruption<\/strong><\/p>\n\n\n\n

In response to this substantial attack, Lewis Jones, Threat Intelligence Analyst at Talion says: \u201cThis appears to be one of the most disruptive ransomware attacks ever reported, highlighting the vulnerabilities in the energy sector and why it is often targeted by attackers. A long term ransomware negotiation within the energy sector could cause mass disruption and means that the likelihood of payment is increased. <\/p>\n\n\n\n

\"The fact that US government has quickly issued emergency legislation to relax rules on road fuel transportation highlights how concerning this attack is. A longer term implication of the attack could create a delay in delivery and disruption of the supply chain. This would cause an increase in price at a time when the economy is already fragile due to the current pandemic.\" <\/p>\n\n\n\n

Computer security service, Digital Shadows has claimed that the Colonial attack was indeed helped by the coronavirus pandemic, with more engineers remotely accessing control systems for the pipeline from home. James Chappell, Co-Founder of Digital Shadows, said DarkSide could have bought account login details for remote desktop software such as TeamViewer and Microsoft Remote Desktop.<\/p>\n\n\n\n

\"We're seeing a lot of victims now, this is seriously a big problem,\" said Chappell in a statement. \"The amount of small businesses that are falling victim <\/a>to this. It's becoming a big problem for the economy globally.\"<\/p>\n\n\n\n

\"Cybercriminals don\u2019t really care how important your business is, only how much money they might extract from you,\" comments Tim Mackey Principal Security Strategist at the Synopsys CyRC (Cybersecurity Research Centre). \"This trend can be seen with increasing attacks on municipalities, healthcare systems, and elements of critical infrastructure. Each of these organisations will bring in law enforcement, yet attackers continue to be aggressive in their activities. <\/p>\n\n\n\n

\"While Colonial Pipeline is a US operation, attacks are global in scope. And despite warnings from officials like the US Treasury Department highlighting how ransomware payments are used to fund future criminal activities, victims are often faced with the difficult decision of whether to pay the ransom.\"<\/p>\n\n\n\n

\"The Colonial Pipeline attack reinforces the need to update legacy systems running today\u2019s critical infrastructure networks...\"<\/p>Lior Div, CEO and Co-founder, Cybereason<\/cite><\/blockquote><\/figure>\n\n\n\n

Remaining critical <\/strong><\/p>\n\n\n\n

\u201cThese \u2018Cyber Physical\u2019 attacks are a big deal, because they demonstrate just how fragile the provision of critical services are into society,\" says Andy Norton European Cyber Risk Officer at Armis. \"A few weeks ago a water treatment plant<\/a> was compromised leading to the potential for poisoning of the water. Now, 45% of the US oil energy provision has been switched off to the East coast. Prolonged shortages in critical services lead to civil unrest, economic pressures, and a general lack of confidence in public administration.\" <\/p>\n\n\n\n

Lior Div, CEO and Co-founder of Cybereason also comments: \"The SolarWinds<\/a> and Microsoft Exchange Server<\/a> attacks were unparalleled in their scope, successfully infiltrating and compromising virtually every US government agency and a wide array of medium and large private sector companies. The Colonial Pipeline attack reinforces the need to update legacy systems running today\u2019s critical infrastructure networks.<\/p>\n\n\n\n

\"If the public and private sectors can work together to solve complex cybersecurity issues, and at the same time accurately identify the threat actors and bring them to account for their actions, it will go a long way in reversing the adversary advantage and enable defenders to retake the high ground. There is also another significant opportunity here as well to cooperate on a global scale to develop extradition laws that enable cyber crimes and cyber espionage to be prosecuted more effectively.\u201d<\/p>\n\n\n\n

Mackey agrees, stating: \"Avoiding becoming a victim of ransomware requires organisations to have a comprehensive cybersecurity plan in place that fully captures the risks of each software component, its role and lifecycle, and its deployment configuration and usage assumptions. Armed with this basic information, and an exhaustive inventory, it becomes possible to determine how each component might play a role in an attempted ransomware attack. <\/p>\n\n\n\n

\"An effort like the one impacting Colonial Pipeline is likely the result of multiple weaknesses in process and cyber-defences that were ultimately successfully exploited. With the age of some industrial software systems far exceeding that of commercial software, it\u2019s likely that older software wasn\u2019t designed to limit exposure to modern threats like ransomware attacks. <\/p>\n\n\n\n

\"While the age of the software has limited impact on its serviceability, threat models and defensive protections need to keep pace with new threats \u2013 something that can only be done if all weaknesses present in each component are known and accounted for. After all, if a criminal can identify your weaknesses faster than you can, luck is rarely on your side.\u201d<\/p>\n\n\n\n

\"While this is indeed a financial disaster, and will have a significant impact on many, let us also consider that this means that, at least for a time, threat actors had control of those very same IT systems.\"<\/p>Martin Jartelius, CSO, Outpost24<\/cite><\/blockquote><\/figure>\n\n\n\n

Taking back control <\/strong><\/p>\n\n\n\n

US government officials are currently working with Colonial to help it recover while scrambling to avoid more severe fuel supply disruptions should the outage continue. Whether the pipeline stays shut that long in turn depends on how deeply the hackers penetrated Colonial\u2019s network - and how soon cybersecurity experts can pull them out.<\/p>\n\n\n\n

\"As so many times before when talking about ransomware \u2013 to lock a system with ransomware you need a good degree of control of that system,\" says Martin Jartelius, CSO at Outpost24. \"While this is indeed a financial disaster, and will have a significant impact on many, let us also consider that this means that, at least for a time, threat actors had control of those very same IT systems. Preventive security, as well as segmentation, are critical for those kinds of environments.\"<\/p>\n\n\n\n

\"One thing to note here is that ransomware has to announce itself to be successful,\" adds Tim Erlin, VP at Tripwire. \"In industrial environments, cyber events aren\u2019t always this visible. Increasing visibility into industrial networks becomes more important as attackers continue to target critical infrastructure.\u201d<\/p>\n\n\n\n

Brad Brooks, CEO and President of OneLogin, rightfully concludes: \"This attack represents just how quickly the stakes are escalating on Cybersecurity, with controlling and knowing who has access to your IT systems a board level priority for every company. We are moving from an invisible Cold War that was focused on stealing data to a highly visible hot war that has real implications for physical property and people\u2019s lives.\u201d<\/p>\n","post_title":"Ransomware roundtable | A threat in the pipeline","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"ransomware-roundtable-a-threat-in-the-pipeline","to_ping":"","pinged":"","post_modified":"2021-05-10 18:12:55","post_modified_gmt":"2021-05-10 17:12:55","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=6024","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4871,"post_author":"3","post_date":"2021-02-09 19:22:22","post_date_gmt":"2021-02-09 19:22:22","post_content":"Detectives assigned to the Digital Forensics Unit at Pinellas County Sheriff\u2019s Office are investigating an unlawful computer software intrusion at the City of Oldsmar\u2019s water treatment plant. While the cyber attack was unsuccessful, it does highlight the need for cybersecurity tools in critical infrastructure applications.\n\nOn Friday, February 5, 2021, the Pinellas County Sheriff\u2019s Office was notified by the City of Oldsmar that its computer system had been remotely accessed at 8:00am and 1:30pm by an unknown suspect. According to detectives, the City of Oldsmar\u2019s computer system at the water treatment plant allows for remote access by authorised users to troubleshoot any system problems from other locations.\n\nThe initial intrusion was brief and not cause for concern due to supervisors regularly accessing the system remotely to monitor the system. At 1:30, a plant operator witnessed a second remote access user opening various functions in the system that control the amount of sodium hydroxide in the water. The operator noted the remote access user raised the levels of sodium hydroxide in the water from 100 parts per million to 11,100 parts per million. The operator immediately reduced the levels to their appropriate amount. Sodium hydroxide is used in small amounts to control acidity, but a large amount could have caused major problems in the water.\n\nThe initial investigation revealed that the hacker remotely accessed the treatment plant\u2019s computer for approximately 3 to 5 minutes. Speaking at a press conference about the cyber attack, Sheriff Bob Gualtieri stated: \u201cAt no time was there a significant effect on the water being treated, and more importantly the public was never in danger.\u201d\n\nCommenting on the attack, Andrea Carcano, co-founder at Nozomi Networks stated: \u201cUnfortunately, this attack plays into a troubling trend we\u2019ve been following over the last year. As the pandemic forced critical infrastructure organisations to quickly shift to remote access options to keep systems up and running, we\u2019ve seen threats rise and bad actors reach new lows \u2013 setting their sights on life threatening targets. Fortunately, in this case, operators monitoring Oldsmar\u2019s treatment plant spotted the attack and were able to respond before anyone could be harmed. But it\u2019s a stark reminder that with limited cybersecurity resources and few regulations water utilities are vulnerable to attack. When it comes critical infrastructure, operational resilience must a top priority and advances in AI-powered OT security and network monitoring are available to give operators the network visibility they need to quickly spot trouble and respond before harm is done.\u201d\n\n\u201cThis targeted attack appears to have started by the \u2018bad actor\u2019 getting access to a vulnerable network\/system and working their way through the network trying to find the next weak access point while gathering data and understanding how the organisation operates along the way,\u201d added Niamh Muldoon, Global Data Protection Officer at OneLogin. \u201cIn this instance, understanding the information assets, applying not only MFA but enhanced multi-factor authentication, would have reduced the risk of this unauthorised attack materializing. It\u2019s a critical part of the MFA policy to enforce time limits for end-users and their trusted devices to re-authenticate, requiring them not only to validate themselves but also the identity of the device trying to access critical systems\/applications and the network. Without knowing more of the details, applying enhanced MFA to the execution of critical actions particularly for IT and systems administrators would have reduced the associated risk further. Having logging in place, and understanding logged events would support with the associated monitoring and alerting events. After the event has happened, crisis management is critical for successfully managing the attack response to reduce business impact and consequences, and it appears the Florida agency has done that.\u201d\n\n\u201cWhile this incident will rightfully cause concern, it appears that likelihood of real damage was minimal due to the fail safes in place,\u201d observes Tim Erlin, VP at Tripwire. \u201cThere are real impacts to be worried about, and actions to be taken, but this doesn\u2019t appear to be a sophisticated or novel attack. From a cybersecurity standpoint, we should be particularly concerned about how the attacker was able to authenticate into the remote access software. That entry point should be very well protected, given that it provides access to such obviously sensitive capabilities. Protecting remote access into industrial systems where these types of changes can be made should be a high priority for any industrial environment.\u201d\n\nLocal, State, and Federal investigators are working together to identify those responsible and the investigation is ongoing. Other utility providers have been informed of the intrusion, so they can take their own protective measures.","post_title":"Florida water system cyber attack highlights role of cybersecurity in critical infrastructure","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"florida-water-system-cyber-attack-highlights-role-of-cybersecurity-in-critical-infrastructure","to_ping":"","pinged":"","post_modified":"2021-02-09 19:22:25","post_modified_gmt":"2021-02-09 19:22:25","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4871","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4178,"post_author":"3","post_date":"2020-12-07 14:52:36","post_date_gmt":"2020-12-07 14:52:36","post_content":"Nozomi Networks and Chinook Systems have partnered to provide advanced cybersecurity solutions to protect industrial and critical infrastructure facilities across North America. Under the deal, Chinook will offer Nozomi Networks\u2019 complete portfolio of OT and IoT security solutions.\n\n\u201cFacilities that fully leverage their OT systems deliver tremendous returns when it comes to energy and operational savings, the safety and comfort of occupants and lower total cost of ownership,\u201d said Chinook\u2019s President, Wanda Lenkewich. \u201cAt the same time, the network connectivity that enables these systems, also introduces new and growing cyber threats. Partnering with Nozomi Networks allows Chinook to support clients with an integrated, comprehensive cybersecurity solution that ensures cyber threats are actively discovered, monitored and managed.\u201d\n\n\u201cWe are absolutely delighted to team with Chinook to help industrial and critical infrastructure facilities meet new requirements for secure connectivity across OT, IT and IoT networks,\u201d said Chet Namboodri, Vice President, Worldwide Business Development and Channel Sales at Nozomi. \u201cWe\u2019ve already worked together to deliver on a number of joint customer engagements in both the government and commercial sectors. Partnering with Chinook accelerates our joint efforts to make sure facility-related control and building management systems are safe from cyber threats.\u201d\n\nwww.nozominetworks.com<\/a>\n\nwww.chinooksystems.com<\/a>\n\n ","post_title":"Nozomi Networks and Chinook Systems partner for OT and IoT security solutions","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"nozomi-networks-and-chinook-systems-partner-for-ot-and-iot-security-solutions","to_ping":"","pinged":"","post_modified":"2020-12-07 14:52:40","post_modified_gmt":"2020-12-07 14:52:40","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4178","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4140,"post_author":"3","post_date":"2020-12-03 11:07:21","post_date_gmt":"2020-12-03 11:07:21","post_content":"Civil Nuclear Constabulary (CNC) police officers based at Harwell have launched Project Servator a collaborative community approach to policing. Project Servator aims to disrupt a range of criminal activity, including terrorism, while providing a reassuring presence for the public.\n\nCNC\u2019s officers are experienced and specially trained to spot the tell-tale signs that someone is planning or preparing to commit an illegal act. It works with other police forces, local businesses and the public to protect the Harwell site and the surrounding area and everyone who lives, works or visits there and to make it a difficult place for terrorists and other criminals to operate. Project Servator has been successful in gathering intelligence that has assisted Counter Terrorism Units across the UK in investigating and preventing acts of terror.\n\nProject Servator\u2019s patrols are highly visible and can happen at any time and in any location. Officers will talk to the public and local businesses to let them know what they\u2019re doing and remind them to be vigilant, trust their instincts and report any suspicious or unusual behaviour.\n\n\u201cWe are deploying these additional tactics to further complement the operational activity that exists in and around our Operational Policing Units,\u201d explained Supt Donna Jones, who is leading on the implementation of the project across the Constabulary. \u201cOur aim is to build upon relationships with partners as well as businesses and communities. These tactics are not new but allow us to have a focus on community engagement and encourage people to be our extra eyes and ears. This is not restricted to the Harwell site but also extends to the surrounding area. We are aware of the vast amount of information members of our community have and they are aware of what is out of the ordinary. All we ask is that they report any suspicions to us and we\u2019ll do the rest. The deployments will be unpredictable and our tactics will vary from one deployment to the next. The aim is to work with our local communities to deter any hostile threat.\u201d\n\nwww.gov.uk\/government\/organisations\/civil-nuclear-constabulary<\/a>","post_title":"CNC Harwell launches Project Servator","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"cnc-harwell-launches-project-servator","to_ping":"","pinged":"","post_modified":"2020-12-03 11:07:23","post_modified_gmt":"2020-12-03 11:07:23","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4140","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4102,"post_author":"3","post_date":"2020-11-30 17:30:23","post_date_gmt":"2020-11-30 17:30:23","post_content":"Radiflow and Mitsubishi Electric UK are collaborating to address the needs of IEC62443 cyber security standards in the Critical Infrastructure and Industrial Automation markets. The companys believe that the combination of the automation knowledge and tools of Mitsubishi Electric UK with the cyber security and IEC 62443 compliance skills of Radiflow will provide a holistic view of a client\u2019s risk posture.\n\nRadiflow will also provide Mitsubishi Electric UK customers with a consultancy service for cyber security, which includes the provision of OT security risk assessments, provision of Radiflow intrusion detection software and general advice on alignment with IEC 62443-3. In addition, the solution is intended to help customers to support asset owners in satisfying the requirements of the NIS Directive along with due diligence in alignment with CPNI (Centre for the Protection of National Infrastructure) best practice.\n\n\u201cOur new collaboration with Radiflow provides expertise in the field of OT cyber security which compliments and broadens the services that we offer our customers through the Mitsubishi Electric UK System Service Operation,\u201d said David Bean, Solutions Manager for Mitsubishi Electric UK. \u201cThere is a growing demand for solutions that address the requirements of cyber security in the OT space and we are looking forward to delivering those solutions and building our relationship further with the team at Radiflow.\u201d\n\n\u201cRadiflow sees huge value for OT organisations to have cyber security services and solutions aligned with their automation systems,\u201d added Ilan Barda, Founder and CEO of Radiflow. \u201cBy combining the automation knowledge and tools of Mitsubishi with the OT cyber security skills and tools of Radiflow, we are able to provide a holistic view of an organisation\u2019s OT risk posture.\u201d\n\nwww.radiflow.com<\/a>","post_title":"Radiflow and Mitsubishi Electric UK collaborate on cyber security standards","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"radiflow-and-mitsubishi-electric-uk-collaborate-on-cyber-security-standards","to_ping":"","pinged":"","post_modified":"2020-11-30 17:30:25","post_modified_gmt":"2020-11-30 17:30:25","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4102","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":3359,"post_author":"3","post_date":"2020-10-16 17:11:16","post_date_gmt":"2020-10-16 16:11:16","post_content":"Senstar explains how its products can be applied to protect the full range of upstream, midstream, and downstream facilities in the oil and gas industry.","post_title":"Senstar explains its security solutions for oil and gas","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"senstar-explains-its-security-solutions-for-oil-and-gas","to_ping":"","pinged":"","post_modified":"2020-10-16 17:11:17","post_modified_gmt":"2020-10-16 16:11:17","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=3359","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"}],"next":false,"prev":false,"total_page":1},"paged":1,"column_class":"jeg_col_2o3","class":"epic_block_14"};

\n

Security on Screen visited the Synectics stand (S1, F39<\/strong>) at Intersec 2025, and learnt how the company takes pride in moving beyond security into a multi-stream approach by which its products can multi-task and create operational efficiencies that improve the bottom line of end-users.<\/h4>\n\n\n\n

<\/p>\n\n\n\n

The company offers advanced security and surveillance systems that help protect people, property, communities, and assets worldwide.<\/p>\n\n\n\n

The solutions are aimed primarily but not exclusively at industries and niche sectors that are mission-critical such as oil & gas, public space, transport and major infrastructure.<\/p>\n\n\n\n

Telemetry and analytics using best-of-breed proprietary algorithms protect volatile environments. Synectics<\/a> claims that its camera stations will perform in ambient temperatures up to +70\u00b0C without compromise. The products are thus a go-to choice for end-users in major industrial installations including marine.<\/p>\n\n\n\n

The new Synergy AI Suite exploits true intelligence in its video surveillance and analytics tools. A mobile App allows stakeholders of many types to have visibility and take ownership of their sites.<\/p>\n\n\n\n

Predictive maintenance is a significant offering which reduces site downtime and has long term cost of ownership benefits for customers. Facility managers are empowered to take the right maintenance action at an appropriate time. Integrated maps with Synectics software allow site-mapping and optimisation of work flows as well as rapid site familiarity for new staff. Again, the multi-tasking of the products has financial benefits for users.<\/p>\n\n\n\n

For more Intersec news, click here<\/a> <\/p>\n","post_title":"Synectics multi-streams and multi-tasks at Intersec 2025","post_excerpt":"","post_status":"publish","comment_status":"closed","ping_status":"closed","post_password":"","post_name":"synectics-multi-streams-and-multi-tasks","to_ping":"","pinged":"","post_modified":"2025-01-20 15:37:34","post_modified_gmt":"2025-01-20 15:37:34","post_content_filtered":"","post_parent":0,"guid":"https:\/\/securityonscreen.com\/?p=25336","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":7381,"post_author":"3","post_date":"2021-08-13 16:10:10","post_date_gmt":"2021-08-13 15:10:10","post_content":"PowerVision Tech has released its new industrial drone system \u2014 PowerVision True Unmanned Aerial Solution. The solution integrates the PowerVision Dock, PowerEgg X 8K drone and the PowerVision Cloud web-based software platform. This solution can be used widely across countless applications, such as powerline inspections, environmental compliance, O&G asset inspections, facility security, GIS, surveying, and mapping.\n\nThe PowerVision True Unmanned Aerial Solution weighs 15.8kg in a 570\u00d7400\u00d7250mm form factor. This compact design allows the entire solution to be deployed by a single person, without special tools or equipment. Powered by artificial intelligence, the PowerVision True Unmanned Aerial System streamlines the drone\u2019s takeoff, flight, dynamic mission and return to the charging dock autonomously. A single installed solution can cover an area with a radius of 3.1 miles (5km). Multiple units can be connected and installed in an area to cover large-scale infrastructure projects or assets.\n\nTo meet the requirements for outdoor operations, PowerVision Dock is IP55-rated to resist dust and water in different environments. With the help of an intelligent temperature control system, it can still perform at an ambient temperature between 20\u2103 and 45\u2103. The onboard intelligent system monitors real-time temperatures, precipitation and wind to secure operational safety.\n\nThe PowerEgg X 8K uses a 1\/2-inch CMOS sensor to capture 48-megapixel photos and 8K UHD videos, all with 4x lossless zoom. Optimisations to the propellers, ESC, and the entire system have been made to achieve a 34-minute flight time. PowerEgg X 8K supports dual-band communication (2.4\/5.8GHz), interference detection and avoidance, dynamic frequency switching, anti-disturbance and real-time FHD image transmission with a max transmission distance of 7.5miles(12km). The PowerEgg X 8K can withstand the wind up to Level 7 on the Beaufort Scale (Near Gale) and fly in adverse weather conditions. A newly designed supplementary landing light automatically triggers under low light conditions to secure the take-off and landing.\n\nIn order to meet the special demands for the power industry, the PowerVision True Unmanned Aerial Solution also supports centimetre-level positioning, solar power supply and transmission extension antennas.\n\nwww.powervision.me<\/a>","post_title":"PowerVision introduces its True Unmanned Aerial Solution","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"powervision-introduces-its-true-unmanned-aerial-solution","to_ping":"","pinged":"","post_modified":"2021-08-13 16:10:16","post_modified_gmt":"2021-08-13 15:10:16","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=7381","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":6024,"post_author":"48","post_date":"2021-05-10 17:00:22","post_date_gmt":"2021-05-10 16:00:22","post_content":"\n

The latest roundtable discussion from Security on Screen analyses the Colonial Pipeline's major ransomware attack and how it highlights the risk ransomware can pose, not just to businesses, but to critical national industrial infrastructure <\/em><\/p>\n\n\n\n

The US government issued an emergency legislation on Sunday after The Colonial Pipeline (located in Alpharetta, Georgia) was hit by a severe ransomware attack. The largest fuel pipeline in the US, the Colonial Pipeline carries 2.5 million barrels a day - 45% of the East Coast's supply of diesel, petrol and jet fuel.<\/p>\n\n\n\n

Sources said the ransomware attack was likely to have been caused by a cyber-criminal gang called DarkSide, who infiltrated Colonial's network and locked the data on some computers and servers, demanding a ransom on Friday. The gang tried to take almost 100 gigabytes of data hostage, threatening to leak it onto the internet, but the FBI and other government agencies worked with private companies to respond. <\/p>\n\n\n\n

Subsequently, the operator took itself offline on Friday after the cyber-attack was discovered, with the cloud computing system that was used by the hackers to collect the stolen data was taken offline on Saturday. Colonial's data did not appear to have been transferred from that system anywhere else, potentially limiting the hackers' leverage to extort or further embarrass the company. <\/p>\n\n\n\n

On Sunday, Colonial said that although its four main pipelines remain offline, some smaller lines between terminals and delivery points were now operational. The US government has now relaxed rules on fuel being transported by road, meaning drivers in 18 states can work extra or more flexible hours when transporting refined petroleum products.<\/p>\n\n\n\n

While US fuel prices at the pump were largely unaffected on Monday, there are fears that could change if the shutdown is prolonged. <\/p>\n\n\n\n

\"The fact that the US government has quickly issued emergency legislation to relax rules on road fuel transportation highlights how concerning this attack is...\"<\/p>Lewis Jones, Threat Intelligence Analyst, Talion<\/cite><\/blockquote><\/figure>\n\n\n\n

A major disruption<\/strong><\/p>\n\n\n\n

In response to this substantial attack, Lewis Jones, Threat Intelligence Analyst at Talion says: \u201cThis appears to be one of the most disruptive ransomware attacks ever reported, highlighting the vulnerabilities in the energy sector and why it is often targeted by attackers. A long term ransomware negotiation within the energy sector could cause mass disruption and means that the likelihood of payment is increased. <\/p>\n\n\n\n

\"The fact that US government has quickly issued emergency legislation to relax rules on road fuel transportation highlights how concerning this attack is. A longer term implication of the attack could create a delay in delivery and disruption of the supply chain. This would cause an increase in price at a time when the economy is already fragile due to the current pandemic.\" <\/p>\n\n\n\n

Computer security service, Digital Shadows has claimed that the Colonial attack was indeed helped by the coronavirus pandemic, with more engineers remotely accessing control systems for the pipeline from home. James Chappell, Co-Founder of Digital Shadows, said DarkSide could have bought account login details for remote desktop software such as TeamViewer and Microsoft Remote Desktop.<\/p>\n\n\n\n

\"We're seeing a lot of victims now, this is seriously a big problem,\" said Chappell in a statement. \"The amount of small businesses that are falling victim <\/a>to this. It's becoming a big problem for the economy globally.\"<\/p>\n\n\n\n

\"Cybercriminals don\u2019t really care how important your business is, only how much money they might extract from you,\" comments Tim Mackey Principal Security Strategist at the Synopsys CyRC (Cybersecurity Research Centre). \"This trend can be seen with increasing attacks on municipalities, healthcare systems, and elements of critical infrastructure. Each of these organisations will bring in law enforcement, yet attackers continue to be aggressive in their activities. <\/p>\n\n\n\n

\"While Colonial Pipeline is a US operation, attacks are global in scope. And despite warnings from officials like the US Treasury Department highlighting how ransomware payments are used to fund future criminal activities, victims are often faced with the difficult decision of whether to pay the ransom.\"<\/p>\n\n\n\n

\"The Colonial Pipeline attack reinforces the need to update legacy systems running today\u2019s critical infrastructure networks...\"<\/p>Lior Div, CEO and Co-founder, Cybereason<\/cite><\/blockquote><\/figure>\n\n\n\n

Remaining critical <\/strong><\/p>\n\n\n\n

\u201cThese \u2018Cyber Physical\u2019 attacks are a big deal, because they demonstrate just how fragile the provision of critical services are into society,\" says Andy Norton European Cyber Risk Officer at Armis. \"A few weeks ago a water treatment plant<\/a> was compromised leading to the potential for poisoning of the water. Now, 45% of the US oil energy provision has been switched off to the East coast. Prolonged shortages in critical services lead to civil unrest, economic pressures, and a general lack of confidence in public administration.\" <\/p>\n\n\n\n

Lior Div, CEO and Co-founder of Cybereason also comments: \"The SolarWinds<\/a> and Microsoft Exchange Server<\/a> attacks were unparalleled in their scope, successfully infiltrating and compromising virtually every US government agency and a wide array of medium and large private sector companies. The Colonial Pipeline attack reinforces the need to update legacy systems running today\u2019s critical infrastructure networks.<\/p>\n\n\n\n

\"If the public and private sectors can work together to solve complex cybersecurity issues, and at the same time accurately identify the threat actors and bring them to account for their actions, it will go a long way in reversing the adversary advantage and enable defenders to retake the high ground. There is also another significant opportunity here as well to cooperate on a global scale to develop extradition laws that enable cyber crimes and cyber espionage to be prosecuted more effectively.\u201d<\/p>\n\n\n\n

Mackey agrees, stating: \"Avoiding becoming a victim of ransomware requires organisations to have a comprehensive cybersecurity plan in place that fully captures the risks of each software component, its role and lifecycle, and its deployment configuration and usage assumptions. Armed with this basic information, and an exhaustive inventory, it becomes possible to determine how each component might play a role in an attempted ransomware attack. <\/p>\n\n\n\n

\"An effort like the one impacting Colonial Pipeline is likely the result of multiple weaknesses in process and cyber-defences that were ultimately successfully exploited. With the age of some industrial software systems far exceeding that of commercial software, it\u2019s likely that older software wasn\u2019t designed to limit exposure to modern threats like ransomware attacks. <\/p>\n\n\n\n

\"While the age of the software has limited impact on its serviceability, threat models and defensive protections need to keep pace with new threats \u2013 something that can only be done if all weaknesses present in each component are known and accounted for. After all, if a criminal can identify your weaknesses faster than you can, luck is rarely on your side.\u201d<\/p>\n\n\n\n

\"While this is indeed a financial disaster, and will have a significant impact on many, let us also consider that this means that, at least for a time, threat actors had control of those very same IT systems.\"<\/p>Martin Jartelius, CSO, Outpost24<\/cite><\/blockquote><\/figure>\n\n\n\n

Taking back control <\/strong><\/p>\n\n\n\n

US government officials are currently working with Colonial to help it recover while scrambling to avoid more severe fuel supply disruptions should the outage continue. Whether the pipeline stays shut that long in turn depends on how deeply the hackers penetrated Colonial\u2019s network - and how soon cybersecurity experts can pull them out.<\/p>\n\n\n\n

\"As so many times before when talking about ransomware \u2013 to lock a system with ransomware you need a good degree of control of that system,\" says Martin Jartelius, CSO at Outpost24. \"While this is indeed a financial disaster, and will have a significant impact on many, let us also consider that this means that, at least for a time, threat actors had control of those very same IT systems. Preventive security, as well as segmentation, are critical for those kinds of environments.\"<\/p>\n\n\n\n

\"One thing to note here is that ransomware has to announce itself to be successful,\" adds Tim Erlin, VP at Tripwire. \"In industrial environments, cyber events aren\u2019t always this visible. Increasing visibility into industrial networks becomes more important as attackers continue to target critical infrastructure.\u201d<\/p>\n\n\n\n

Brad Brooks, CEO and President of OneLogin, rightfully concludes: \"This attack represents just how quickly the stakes are escalating on Cybersecurity, with controlling and knowing who has access to your IT systems a board level priority for every company. We are moving from an invisible Cold War that was focused on stealing data to a highly visible hot war that has real implications for physical property and people\u2019s lives.\u201d<\/p>\n","post_title":"Ransomware roundtable | A threat in the pipeline","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"ransomware-roundtable-a-threat-in-the-pipeline","to_ping":"","pinged":"","post_modified":"2021-05-10 18:12:55","post_modified_gmt":"2021-05-10 17:12:55","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=6024","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4871,"post_author":"3","post_date":"2021-02-09 19:22:22","post_date_gmt":"2021-02-09 19:22:22","post_content":"Detectives assigned to the Digital Forensics Unit at Pinellas County Sheriff\u2019s Office are investigating an unlawful computer software intrusion at the City of Oldsmar\u2019s water treatment plant. While the cyber attack was unsuccessful, it does highlight the need for cybersecurity tools in critical infrastructure applications.\n\nOn Friday, February 5, 2021, the Pinellas County Sheriff\u2019s Office was notified by the City of Oldsmar that its computer system had been remotely accessed at 8:00am and 1:30pm by an unknown suspect. According to detectives, the City of Oldsmar\u2019s computer system at the water treatment plant allows for remote access by authorised users to troubleshoot any system problems from other locations.\n\nThe initial intrusion was brief and not cause for concern due to supervisors regularly accessing the system remotely to monitor the system. At 1:30, a plant operator witnessed a second remote access user opening various functions in the system that control the amount of sodium hydroxide in the water. The operator noted the remote access user raised the levels of sodium hydroxide in the water from 100 parts per million to 11,100 parts per million. The operator immediately reduced the levels to their appropriate amount. Sodium hydroxide is used in small amounts to control acidity, but a large amount could have caused major problems in the water.\n\nThe initial investigation revealed that the hacker remotely accessed the treatment plant\u2019s computer for approximately 3 to 5 minutes. Speaking at a press conference about the cyber attack, Sheriff Bob Gualtieri stated: \u201cAt no time was there a significant effect on the water being treated, and more importantly the public was never in danger.\u201d\n\nCommenting on the attack, Andrea Carcano, co-founder at Nozomi Networks stated: \u201cUnfortunately, this attack plays into a troubling trend we\u2019ve been following over the last year. As the pandemic forced critical infrastructure organisations to quickly shift to remote access options to keep systems up and running, we\u2019ve seen threats rise and bad actors reach new lows \u2013 setting their sights on life threatening targets. Fortunately, in this case, operators monitoring Oldsmar\u2019s treatment plant spotted the attack and were able to respond before anyone could be harmed. But it\u2019s a stark reminder that with limited cybersecurity resources and few regulations water utilities are vulnerable to attack. When it comes critical infrastructure, operational resilience must a top priority and advances in AI-powered OT security and network monitoring are available to give operators the network visibility they need to quickly spot trouble and respond before harm is done.\u201d\n\n\u201cThis targeted attack appears to have started by the \u2018bad actor\u2019 getting access to a vulnerable network\/system and working their way through the network trying to find the next weak access point while gathering data and understanding how the organisation operates along the way,\u201d added Niamh Muldoon, Global Data Protection Officer at OneLogin. \u201cIn this instance, understanding the information assets, applying not only MFA but enhanced multi-factor authentication, would have reduced the risk of this unauthorised attack materializing. It\u2019s a critical part of the MFA policy to enforce time limits for end-users and their trusted devices to re-authenticate, requiring them not only to validate themselves but also the identity of the device trying to access critical systems\/applications and the network. Without knowing more of the details, applying enhanced MFA to the execution of critical actions particularly for IT and systems administrators would have reduced the associated risk further. Having logging in place, and understanding logged events would support with the associated monitoring and alerting events. After the event has happened, crisis management is critical for successfully managing the attack response to reduce business impact and consequences, and it appears the Florida agency has done that.\u201d\n\n\u201cWhile this incident will rightfully cause concern, it appears that likelihood of real damage was minimal due to the fail safes in place,\u201d observes Tim Erlin, VP at Tripwire. \u201cThere are real impacts to be worried about, and actions to be taken, but this doesn\u2019t appear to be a sophisticated or novel attack. From a cybersecurity standpoint, we should be particularly concerned about how the attacker was able to authenticate into the remote access software. That entry point should be very well protected, given that it provides access to such obviously sensitive capabilities. Protecting remote access into industrial systems where these types of changes can be made should be a high priority for any industrial environment.\u201d\n\nLocal, State, and Federal investigators are working together to identify those responsible and the investigation is ongoing. Other utility providers have been informed of the intrusion, so they can take their own protective measures.","post_title":"Florida water system cyber attack highlights role of cybersecurity in critical infrastructure","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"florida-water-system-cyber-attack-highlights-role-of-cybersecurity-in-critical-infrastructure","to_ping":"","pinged":"","post_modified":"2021-02-09 19:22:25","post_modified_gmt":"2021-02-09 19:22:25","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4871","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4178,"post_author":"3","post_date":"2020-12-07 14:52:36","post_date_gmt":"2020-12-07 14:52:36","post_content":"Nozomi Networks and Chinook Systems have partnered to provide advanced cybersecurity solutions to protect industrial and critical infrastructure facilities across North America. Under the deal, Chinook will offer Nozomi Networks\u2019 complete portfolio of OT and IoT security solutions.\n\n\u201cFacilities that fully leverage their OT systems deliver tremendous returns when it comes to energy and operational savings, the safety and comfort of occupants and lower total cost of ownership,\u201d said Chinook\u2019s President, Wanda Lenkewich. \u201cAt the same time, the network connectivity that enables these systems, also introduces new and growing cyber threats. Partnering with Nozomi Networks allows Chinook to support clients with an integrated, comprehensive cybersecurity solution that ensures cyber threats are actively discovered, monitored and managed.\u201d\n\n\u201cWe are absolutely delighted to team with Chinook to help industrial and critical infrastructure facilities meet new requirements for secure connectivity across OT, IT and IoT networks,\u201d said Chet Namboodri, Vice President, Worldwide Business Development and Channel Sales at Nozomi. \u201cWe\u2019ve already worked together to deliver on a number of joint customer engagements in both the government and commercial sectors. Partnering with Chinook accelerates our joint efforts to make sure facility-related control and building management systems are safe from cyber threats.\u201d\n\nwww.nozominetworks.com<\/a>\n\nwww.chinooksystems.com<\/a>\n\n ","post_title":"Nozomi Networks and Chinook Systems partner for OT and IoT security solutions","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"nozomi-networks-and-chinook-systems-partner-for-ot-and-iot-security-solutions","to_ping":"","pinged":"","post_modified":"2020-12-07 14:52:40","post_modified_gmt":"2020-12-07 14:52:40","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4178","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4140,"post_author":"3","post_date":"2020-12-03 11:07:21","post_date_gmt":"2020-12-03 11:07:21","post_content":"Civil Nuclear Constabulary (CNC) police officers based at Harwell have launched Project Servator a collaborative community approach to policing. Project Servator aims to disrupt a range of criminal activity, including terrorism, while providing a reassuring presence for the public.\n\nCNC\u2019s officers are experienced and specially trained to spot the tell-tale signs that someone is planning or preparing to commit an illegal act. It works with other police forces, local businesses and the public to protect the Harwell site and the surrounding area and everyone who lives, works or visits there and to make it a difficult place for terrorists and other criminals to operate. Project Servator has been successful in gathering intelligence that has assisted Counter Terrorism Units across the UK in investigating and preventing acts of terror.\n\nProject Servator\u2019s patrols are highly visible and can happen at any time and in any location. Officers will talk to the public and local businesses to let them know what they\u2019re doing and remind them to be vigilant, trust their instincts and report any suspicious or unusual behaviour.\n\n\u201cWe are deploying these additional tactics to further complement the operational activity that exists in and around our Operational Policing Units,\u201d explained Supt Donna Jones, who is leading on the implementation of the project across the Constabulary. \u201cOur aim is to build upon relationships with partners as well as businesses and communities. These tactics are not new but allow us to have a focus on community engagement and encourage people to be our extra eyes and ears. This is not restricted to the Harwell site but also extends to the surrounding area. We are aware of the vast amount of information members of our community have and they are aware of what is out of the ordinary. All we ask is that they report any suspicions to us and we\u2019ll do the rest. The deployments will be unpredictable and our tactics will vary from one deployment to the next. The aim is to work with our local communities to deter any hostile threat.\u201d\n\nwww.gov.uk\/government\/organisations\/civil-nuclear-constabulary<\/a>","post_title":"CNC Harwell launches Project Servator","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"cnc-harwell-launches-project-servator","to_ping":"","pinged":"","post_modified":"2020-12-03 11:07:23","post_modified_gmt":"2020-12-03 11:07:23","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4140","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":4102,"post_author":"3","post_date":"2020-11-30 17:30:23","post_date_gmt":"2020-11-30 17:30:23","post_content":"Radiflow and Mitsubishi Electric UK are collaborating to address the needs of IEC62443 cyber security standards in the Critical Infrastructure and Industrial Automation markets. The companys believe that the combination of the automation knowledge and tools of Mitsubishi Electric UK with the cyber security and IEC 62443 compliance skills of Radiflow will provide a holistic view of a client\u2019s risk posture.\n\nRadiflow will also provide Mitsubishi Electric UK customers with a consultancy service for cyber security, which includes the provision of OT security risk assessments, provision of Radiflow intrusion detection software and general advice on alignment with IEC 62443-3. In addition, the solution is intended to help customers to support asset owners in satisfying the requirements of the NIS Directive along with due diligence in alignment with CPNI (Centre for the Protection of National Infrastructure) best practice.\n\n\u201cOur new collaboration with Radiflow provides expertise in the field of OT cyber security which compliments and broadens the services that we offer our customers through the Mitsubishi Electric UK System Service Operation,\u201d said David Bean, Solutions Manager for Mitsubishi Electric UK. \u201cThere is a growing demand for solutions that address the requirements of cyber security in the OT space and we are looking forward to delivering those solutions and building our relationship further with the team at Radiflow.\u201d\n\n\u201cRadiflow sees huge value for OT organisations to have cyber security services and solutions aligned with their automation systems,\u201d added Ilan Barda, Founder and CEO of Radiflow. \u201cBy combining the automation knowledge and tools of Mitsubishi with the OT cyber security skills and tools of Radiflow, we are able to provide a holistic view of an organisation\u2019s OT risk posture.\u201d\n\nwww.radiflow.com<\/a>","post_title":"Radiflow and Mitsubishi Electric UK collaborate on cyber security standards","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"radiflow-and-mitsubishi-electric-uk-collaborate-on-cyber-security-standards","to_ping":"","pinged":"","post_modified":"2020-11-30 17:30:25","post_modified_gmt":"2020-11-30 17:30:25","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=4102","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"},{"ID":3359,"post_author":"3","post_date":"2020-10-16 17:11:16","post_date_gmt":"2020-10-16 16:11:16","post_content":"Senstar explains how its products can be applied to protect the full range of upstream, midstream, and downstream facilities in the oil and gas industry.","post_title":"Senstar explains its security solutions for oil and gas","post_excerpt":"","post_status":"publish","comment_status":"open","ping_status":"open","post_password":"","post_name":"senstar-explains-its-security-solutions-for-oil-and-gas","to_ping":"","pinged":"","post_modified":"2020-10-16 17:11:17","post_modified_gmt":"2020-10-16 16:11:17","post_content_filtered":"","post_parent":0,"guid":"http:\/\/securityonscre.wpenginepowered.com\/?p=3359","menu_order":0,"post_type":"post","post_mime_type":"","comment_count":"0","filter":"raw"}],"next":false,"prev":false,"total_page":1},"paged":1,"column_class":"jeg_col_2o3","class":"epic_block_14"};

Utilities

SITE MENU

Main Menu
Main Menu
Main Menu
Main Menu
Main Menu

READY TO TALK?

BOOK A MEETING

CONTACT US

+31 (0) 53 23 40 650
+44 (0) 7841 693979
sayhello@securityonscreen.com
Security on Screen B.V. Broekhoekweg 34, 7581 PT Losser, The Netherlands
Linkedin Twitter Facebook

FOLLOW US & SUBSCRIBE

Enter your email and subscribe to our newsletter

Copyright © 2022 Security on Screen by the Security Industry Group
Privacy Policy

Scroll to Top