Software Integrity

Archive for the 'Critical Infrastructure Security' Category

 

US vows to go on cyber offense

The original version of this article was published in Forbes. We’re all familiar with saber rattling. But this is the digital age. Welcome to the world of cyber rattling. This version of it comes in two policy papers from the U.S. government: the White House Cyber Policy and the Department of Defense (DoD) Cyber Strategy. One of […]

Continue Reading...

Posted in Critical Infrastructure Security, Government Security

 

Ukraine dodges attack, but VPNFilter threat remains

Ukraine had been warned. So it was prepared. And the result, according to the government’s intelligence branch, the Security Service of Ukraine (SBU), is that it was able to detect and thwart a cyber attack that used the now notorious VPNFilter malware against the Auly Chlorine Distillation Station, which supplies chlorine to 23 provinces of […]

Continue Reading...

Posted in Critical Infrastructure Security, Internet of Things

 

TRITON attack: A failure this time, but still ominous

Yet another cyber attack on a critical infrastructure installation ought to send yet another warning to operators of industrial control systems (ICS) that it is long past time to, as they say, harden their defenses. The attack, reportedly on a facility somewhere in the Middle East, was reported in early December by the Mandiant division […]

Continue Reading...

Posted in Critical Infrastructure Security, Data Breach

 

Achieve critical infrastructure security with modern networking

Our energy and water infrastructure holds up the world we know, but very few understand how delicate it can be. There is a constant demand to monitor and protect this infrastructure, whose components often have been running nonstop for decades, with few understanding how they work. This hole in the safety net that protects these […]

Continue Reading...

Posted in Critical Infrastructure Security

 

Smart devices, smart grids, and cyber security

A recent “Innovation Spotlight” in the IEEE XPLORE Digital Library announced “a first-of-its-kind charger that allows plug-in electric vehicles (PEVs) to deliver excess capacity to the power grid and recharge during off-peak hours.” Promising new technologies often evoke questions about security. Suppose a bad actor exploits the connection somehow and brings down portions of the […]

Continue Reading...

Posted in Critical Infrastructure Security, Government Security, Maturity Model (BSIMM), Security Standards and Compliance

 

Command injection vulnerability in Locus Energy Solar Panels patched

A command injection vulnerability (CWE-73) disclosed within the software used by Locus Energy solar panels has now been patched by the company. An ICS-CERT advisory dated December 6, 2016, Daniel Reich, an independent researcher, was credited with finding the vulnerability in several versions of the LGate solar panel. Because the web server on these vulnerable […]

Continue Reading...

Posted in Critical Infrastructure Security, Software Architecture and Design

 

Cyber attacks erase Saudi government data

The data on thousands of computers at the headquarters of the General Authority of Civil Aviation in Saudi Arabia was erased starting in mid-November by malware from “outside the country,” according to a state report. On Thursday, the state-run Saudi Press Agency confirmed that a series of cyber attacks on government systems, especially the transportation […]

Continue Reading...

Posted in Critical Infrastructure Security, Data Breach, Government Security

 

Securing IoT devices in the wake of last week’s Mirai malware attack

Last Friday, two major distributed denial-of-service (DDoS) attacks on Dyn’s Managed DNS infrastructure brought down the websites of over 80 internet giants, including Amazon, PayPal, and Twitter. The sophisticated attack involved tens of millions of IP addresses. Many of these addresses were associated with the open source Mirai botnet. The attack leveraged Internet of Things (IoT) […]

Continue Reading...

Posted in Critical Infrastructure Security, Internet of Things

 

Study suggests smart cities lack critical cyber security protections

A new survey of government IT officials faults smart cities with a lack of cyber security protection. A survey of 203 IT professionals working for state and local governments conducted by Tripwire finds 98% of government IT professionals see smart cities as not having adequate protection from cyber attacks. In particular, 27% faulted public Wi-Fi, […]

Continue Reading...

Posted in Archive, Critical Infrastructure Security, Government Security

 

Power meters vulnerable to remote attacks, says ICS-CERT

ICS-CERT says power meters from two manufacturers are vulnerable to remote cross-site request forgery attacks (CSRF) and/or compromise. In one advisory, ICS-CERT cited Schneider Electric’s ION Power Meter products. A remote attacker using CSRF could perform unauthorized actions on the affected devices, such as configuration parameter changes or saving modified configuration. Models affected include ION […]

Continue Reading...

Posted in Critical Infrastructure Security