Cyber Strategy
Cyber Secure
Cyber Operations
Cyber Response
Cyber ResilienceSecurity of Critical Infrastructure - Supply Chain Attacks
Author: Shah Sheikh, CTO / CISO – Cybersecurity Advisory and Architecture
Security of Critical Infrastructure - Supply Chain Attacks
Author:
Shah Sheikh, CTO / CISO – Cybersecurity Advisory and Architecture
The Critical Infrastructure in a Connected World
Due to the rise of digitalization, hybrid work, and rapid adoption of new emerging technologies, new cyber threats arose that pose an increased danger and that are already putting many businesses and organizations on their knees. Most notably, malware attacks have proliferated and employ more sophisticated techniques to become more successful. Most of the damage has been done by ransomware and certain wiper malware.
Even though hybrid-work and new tech services allow for greater opportunities at a reduced cost, new threats, unfortunately, follow the trend and are targeting operational technology such as Industrial Control Systems (ICS) and other critical environments. A major focus is now pointed at the critical infrastructure systems in a race to increase the overall security defenses as new technology is being adopted.
Since new technology always brings improvements and benefits, many industries that use ICS have started adopting the Cloud and IoT devices and using the technology to their advantage. But with a decrease in production costs and an increase in output and quality, new cyber-attack vectors have been opened by the adoption of new technology. Hackers are actively exploiting the ICS due to their presence in many critical infrastructure facilities that generate electricity, manage water waste, and process oil and gas chemicals and food.
One of the main challenges facing critical infrastructure today is the new and emerging technology being adopted by the industries that bring along with them a whole new set of vulnerabilities. Cyber security teams now must focus on general IT systems and ICS systems to keep an industry afloat and safe from cyber-attacks. IT and cyber security teams now need to cooperate and set different priorities for each system leveraging network connectivity of critical infrastructure with day-to-day IT solutions. Considering the number of cyberattacks on critical infrastructure has more than doubled, the room for error is slim as the consequences of a successful cyberattack on ICS and critical infrastructure goes beyond a financial fine.
The Critical Infrastructure in a Connected World
Due to the rise of digitalization, hybrid work, and rapid adoption of new emerging technologies, new cyber threats arose that pose an increased danger and that are already putting many businesses and organizations on their knees. Most notably, malware attacks have proliferated and employ more sophisticated techniques to become more successful. Most of the damage has been done by ransomware and certain wiper malware.
Even though hybrid-work and new tech services allow for greater opportunities at a reduced cost, new threats, unfortunately, follow the trend and are targeting operational technology such as Industrial Control Systems (ICS) and other critical environments. A major focus is now pointed at the critical infrastructure systems in a race to increase the overall security defenses as new technology is being adopted.
Since new technology always brings improvements and benefits, many industries that use ICS have started adopting the Cloud and IoT devices and using the technology to their advantage. But with a decrease in production costs and an increase in output and quality, new cyber-attack vectors have been opened by the adoption of new technology. Hackers are actively exploiting the ICS due to their presence in many critical infrastructure facilities that generate electricity, manage water waste, and process oil and gas chemicals and food.
One of the main challenges facing critical infrastructure today is the new and emerging technology being adopted by the industries that bring along with them a whole new set of vulnerabilities. Cyber security teams now must focus on general IT systems and ICS systems to keep an industry afloat and safe from cyber-attacks. IT and cyber security teams now need to cooperate and set different priorities for each system leveraging network connectivity of critical infrastructure with day-to-day IT solutions. Considering the number of cyberattacks on critical infrastructure has more than doubled, the room for error is slim as the consequences of a successful cyberattack on ICS and critical infrastructure goes beyond a financial fine.
Supply Chain Attacks
Supply Chain Attacks
Critical Infrastructure and the Supply Chain Attacks
Supply chain attacks are much harder to detect and prevent since there is already a trusting relationship established between an organization and its suppliers. This becomes a scary scenario when critical infrastructure is involved due to the consequences a successful attack implies.
Imagine a company such as Schneider, a producer of industrial equipment that connects manufacturing, water wastage systems, oil and gas pipelines, and electric grids to a network that gets compromised. The side effects could be unimaginable. A recent announcement by Schneider in the past year revealed the company’s programmable logic controllers contained a vulnerability that could allow hackers to take control of numerous industrial systems. Unfortunately, due to the design flaws, a perfect patch does not exist to remediate the vulnerability. Previous exploitation of Schneider equipment worth noting occurred in 2017 when the Saudi gas and oil facilities were compromised due to a vulnerability in Schneider’s equipment.
Another industry giant with an extensive foothold in energy, electricity, automation, and digitalization is Siemens. The company also produces equipment for use in various ICS systems. Recently, more than 25 vulnerabilities have been published by Siemens regarding their programmable logic controllers being vulnerable to attacks that can crash the controllers. The effects of a successful exploit that can render Siemens’ equipment inoperable could also prove to be devastating. Even though this has not happened yet, Siemens has been involved with a few data breach reports in the past few years.
Siemens has also published a list of vulnerabilities in its products that exist due to the presence of third-party components. Successful exploits of some of these vulnerabilities could lead to remote code execution and data exfiltration. Siemens is one of the biggest producers of energy-related and power generation and transmission technology, vulnerabilities in their products are not to be taken lightly. A successful compromise of any of Siemens’ equipment and software could lead to a wide range of consequences for the energy sector and power grids throughout the world.
The security of the critical infrastructure needs to be stronger and more comprehensive than ever before. The levels of connectedness and digitalization of these systems are growing rapidly with cloud technology as the leader in adoption. With increasing cyber-attacks on critical infrastructure and focus on supply chain attacks, industry-leading organizations must provide secure equipment and solutions to protect critical infrastructure throughout the world. The operability of IT systems and ICS systems needs to be optimal to maintain cyber security defenses which have become a challenge for the IT and security teams to operate and protect.
The fact remains we will most likely continue to see successful cyberattacks on critical infrastructure with hopes of being able to lessen the damage with appropriate security solutions and dedicated cybersecurity staff.
Critical Infrastructure and the Supply Chain Attacks
Supply chain attacks are much harder to detect and prevent since there is already a trusting relationship established between an organization and its suppliers. This becomes a scary scenario when critical infrastructure is involved due to the consequences a successful attack implies.
Imagine a company such as Schneider, a producer of industrial equipment that connects manufacturing, water wastage systems, oil and gas pipelines, and electric grids to a network that gets compromised. The side effects could be unimaginable. A recent announcement by Schneider in the past year revealed the company’s programmable logic controllers contained a vulnerability that could allow hackers to take control of numerous industrial systems. Unfortunately, due to the design flaws, a perfect patch does not exist to remediate the vulnerability. Previous exploitation of Schneider equipment worth noting occurred in 2017 when the Saudi gas and oil facilities were compromised due to a vulnerability in Schneider’s equipment.
Another industry giant with an extensive foothold in energy, electricity, automation, and digitalization is Siemens. The company also produces equipment for use in various ICS systems. Recently, more than 25 vulnerabilities have been published by Siemens regarding their programmable logic controllers being vulnerable to attacks that can crash the controllers. The effects of a successful exploit that can render Siemens’ equipment inoperable could also prove to be devastating. Even though this has not happened yet, Siemens has been involved with a few data breach reports in the past few years.
Siemens has also published a list of vulnerabilities in its products that exist due to the presence of third-party components. Successful exploits of some of these vulnerabilities could lead to remote code execution and data exfiltration. Siemens is one of the biggest producers of energy-related and power generation and transmission technology, vulnerabilities in their products are not to be taken lightly. A successful compromise of any of Siemens’ equipment and software could lead to a wide range of consequences for the energy sector and power grids throughout the world.
The security of the critical infrastructure needs to be stronger and more comprehensive than ever before. The levels of connectedness and digitalization of these systems are growing rapidly with cloud technology as the leader in adoption. With increasing cyber-attacks on critical infrastructure and focus on supply chain attacks, industry-leading organizations must provide secure equipment and solutions to protect critical infrastructure throughout the world. The operability of IT systems and ICS systems needs to be optimal to maintain cyber security defenses which have become a challenge for the IT and security teams to operate and protect.
The fact remains we will most likely continue to see successful cyberattacks on critical infrastructure with hopes of being able to lessen the damage with appropriate security solutions and dedicated cybersecurity staff.
Qualifying Supply Chain Risks
DTS takes great pride in pioneering TPRM (Third-Party Risk Management) and Supply Chain Risks methodology and approach. We have written some great articles to provide further information. Get in touch today to take control of your supply chain risks.
Third Party Risk Management – Click here to read
Managing Third Party and Supply Chain Security – Click here to read
Qualifying Supply Chain Risks
DTS takes great pride in pioneering TPRM (Third-Party Risk Management) and Supply Chain Risks methodology and approach. We have written some great articles to provide further information. Get in touch today to take control of your supply chain risks.
Third Party Risk Management – Click here to read
Managing Third Party and Supply Chain Security – Click here to read
See also:
Dubai