The CFR watering hole attack got most of the news, but yesterday Computerworld reported that Capstone Turbine Corporation had a similar compromise on their website since Dec 18th. Many owner/operators still directly access their trusted ICS vendor websites from their SCADA or DCS control rooms. This makes them lucrative targets for attackers that want to compromise control systems.
From the December NERC Newsletter, on Dec 6th the National Energy Board of Canada gave all nine Canadian jurisdictions the right to make NERC standards mandatory. This includes NERC CIP. They have been working on this since 2002.
The 4th Quarter Edition of ICS-CERT’s Monitor was published in late December, and the stories on malware in the control environment have garnered a lot of press. I’d encourage you to read the ICS-CERT Operational Review Fiscal Year 2012. Most interesting quote “Analysis of the targeted systems indicated that information pertaining to the ICS/SCADA environment, including data that could facilitate remote unauthorized operations, was exfiltrated.”
Auto hacking will grow in 2013. From Techcrunch, “Cisco and NXP Semiconductors announced their intention to join the smart car bandwagon and help push automotive technology forward. The companies this morning announced a dual investment in Cohda Wireless, an Australian developer of hardware and software solutions for connected vehicles that allow cars to wirelessly communicate with one another (and with infrastructure) to prevent collisions — among other things.”
Sergey and the guys from Positive Technologies 29C3 presentation is available on YouTube. It’s a good intro to the ICS security problem, and Sergey will be skipping the SCADASEC 101 content and getting a lot more technical at S4.
Tweet of the Week
I know … self serving.
[blackbirdpie id=”286874813472075776″]
Don’t forget to subscribe to this blog RSS feed and follow @digitalbond.com on twitter.
Worth Reading Articles
- Computerworld Website of US-Based Gas Turbine Maker Also Rigged With New IE Exploit
- Mike Assante’s Call To Arms < DP Note: Amusing how many times I said Yes! and Wrong! in 7 paragraphs
- Memoori’s The Home Automation Market Is Up For Grabs in 2013
Critical Intelligence’s ICS Security Event Calendar Updates
- Utility Cyber Security, Jan 15-17 in Atlanta, Georgia
- ICS Security Presentations at RSA, Feb 25 – Mar 1 in San Francisco, California
Critical Intelligence provides reports and other information products on Cyber Situational Awareness and Threat Intelligence services for Industrial Control System Owner/Operators, Vendors and Government stakeholders.
Image TooFarNorth (the king of Letter F pictures)