The ICS-CERT issued a new Monitor report that revealed a surge of brute force attacks against control systems mainly belonging to the energy sector.
The ICS-CERT issued a new Monitor report that revealed an intensification for brute force attacks against control systems mainly belonging to the energy sector. The ICS-CERT received notification for more than 200 cyber attacks against critical infrastructure operators between October 2012 and May 2013.
Analyzing the sectors hit by the cyber attacks it is possible to note that 53% (111) of the offensives targeted control systems in Energy sector followed by Critical Manufacturing Industry at 17% (32). According the ICS-CERT the victims were targeted by mostly by watering hole attacks, SQL injection, and spear phishing. ICS-CERT reported an increase of brute force attacks against a gas compressor station owner, the attack campaign fortunately didn’t result in any actual breaches. Lila Kee, North American Energy Standards Board member highlighted the fact that ICS-CERT report is the demonstration of the concrete risk of cyber attacks against critical infrastructures and in particular against the energy sector.
The theme of cyber security for critical infrastructures is highly debated, cyber threats could hit foreign countries causing loss of human lives identically to a conventional attack, government are facing with a silently and unpredictable menace that could be conducted by state-sponsored hackers or cyber criminals with the different purposes, sabotage  or cyber espionage. The fact that the attempts were failed should not make us feel safe, the situation is critical and the level of alert must be high, cyber security of critical infrastructures is a must for any government like reinforced by this report. To deal with spear-phishing firms must develop a security training program that will prepare the employees for the possible vector attacks and the main social engineering techniques.


In this scenario we will expect that the number of attacks will increase also in the next years, however the increased level of awareness and the high interest in the matter could avoid serious consequences.
NISAC experts analyze—using modeling and simulation capabilities—critical infrastructure, along with their interdependencies, vulnerabilities, and complexities.
Natural disasters or imposed threats require NISAC analysts to employ their knowledge of different infrastructure along with a variety of capabilities, including modeling and simulation, to provide real-time assistance to decision makers. The Department of Homeland Security’s National Infrastructure Simulation and Analysis Center (NISAC), jointly housed at Sandia and Los Alamos national laboratories, studies how hurricanes and other disasters disrupt critical infrastructure, such as roads, electricity and water systems. A swath analysis looks at how a hurricane might interrupt critical services and at impacts to infrastructure specific to an area, such as petroleum and petrochemical industries in Houston or financial services in New York City. The analyses — also useful in other natural disasters — consider impacts to the infrastructure, the population and the economy, Pless said. Identifying the procedural details of computer backups, data restoration methods, and minimum software requirements are crucial to re-establish technology related critical business processes. The ICS-CERT issued an official alert on its secure portal about the attacks against the gas compressor plant providing also the 10 IP addresses being used in the offensives.
ICS-CERT posted an alert on the US-CERT secure portal (Control Systems Center), containing 10 IP addresses, to warn other critical infrastructure asset owners, especially in the natural gas industry, to watch for similar activity.


Kee confirmed the need to rapidly report that incidents and share data on attacks to prevent further damage. NISAC’s analyses complement those done by the Department of Energy or other agencies by providing unique evaluations of how damage to one type of infrastructure, such as power lines, would impact other infrastructures. A company’s business continuity plan (BCP) should include processes related to critical technologies that may be lost or suspended during an incident.
The exercise environment allows stakeholders to simulate real-world situations, to improve communications and coordination, and to increase the effectiveness of broad-based critical infrastructure protection capabilities without the consequences of real cyber event. That alert elicited additional reports from critical infrastructure owners who, using the indicators in the alert, had discovered similar brute force attempts to compromise their networks.
As the designated sector-specific agency for the energy infrastructure sector, DOE’s Office of Electricity Delivery and Energy Reliability helps prepare for and respond to energy-related emergencies like Hurricane Sandy. These types of exercises can also be used to educate employees on technological policies and procedures used to offset cyber attack strategies.



Hurricane watch cancun
Emergency alert message rogers
How to prepare for a hurricane list


Comments

  1. 18.08.2014 at 19:25:29


    For action small is getting carried out not create an electric.

    Author: BI_CO
  2. 18.08.2014 at 19:53:12


    Well not have even thought about, like an Emergency.

    Author: EzoP
  3. 18.08.2014 at 16:38:53


    Developed for smartphones to make the device firms in the United States, we're the critical infrastructure attacks only a single that.

    Author: Admin_088