OT/ICS Cybersecurity Newsletter

Hey there, welcome to this week's edition of the Cybersecurity Newsletter.

For the OT/ICS Cybersecurity professional that needs to know it all, but doesn't have the time - we've got your back.

PRESS RELEASE

SecurityGate.io and ilionx Partner to Strongly Secure Operational Technology

SecurityGate.io and IT service provider ilionx enter into a partnership to improve the security of operational technology (OT) in the Netherlands. With the partnership, ilionx supports organizations in the Netherlands with a full risk assessment and associated consultancy, regardless of the market segment.

Cyber Assessment Framework V3.1

This report provides information about the Cyber Assessment Framework (CAF) V3.1, a tool for assessing cyber resilience. The Cyber Assessment Framework (CAF) provides a systematic and comprehensive approach to assessing the extent to which cyber risks to essential functions are being managed by the organization responsible. It is intended to be used either by the responsible organization itself (self-assessment) or by an independent external entity, possibly a regulator or a suitably qualified organization acting on behalf of a regulator.

Read now

National Cyber-Informed Engineering Strategy

This whitepaper from the Department of Energy provides information on the Cyber-Informed Engineering (CIE). The CIE is an emerging framework, originated by the National Laboratories and advanced by DOE, to build cybersecurity into the nation's energy systems at the earliest possible stages rather than trying to secure these critical systems after deployment.

Read now

NEWS

CISA announces RFI for critical infrastructure cyber reporting mandate

"The Cybersecurity and Infrastructure Security Agency formally announced plans to issue a request for information seeking public input on new incident reporting mandates under the Cyber Incident Reporting for Critical Infrastructure Act of 2022, which President Joe Biden signed in March." - Cybersecurity Dive

“On Monday, September 12, CISA posted a request for information for public comments on proposed regulations required by the Cyber Incident Reporting for Critical Infrastructure Act of 2022 (CIRCIA), which was signed into law in March. Look for very interesting input over the next month that CISA is gearing up to handle: ‘While CISA welcomes input on other aspects of CIRCIA's regulatory requirements, CISA is particularly interested in input on definitions for and interpretations of the terminology to be used in the proposed regulations; the form, manner, content, and procedures for submission of reports required under CIRCIA; information regarding other incident reporting requirements including the requirement to report a description of the vulnerabilities exploited; and other policies and procedures, such as enforcement procedures and information protection policies, that will be required for implementation of the regulations.’

They also plan 11 in-person listening sessions, one per CISA’s 10 regions and one more in DC. Key words for critical infrastructure organizations to watch for: covered entities, submission requirements, incident reporting, and, of course, enforcement.” - Bill Lawrence, CISO

NEWS

North Korea's Lazarus Targets Energy Firms With Three RATs

"For roughly six months, the North Korean Lazarus hacking group has been targeting energy companies in Canada, the US, and Japan with three remote access trojans (RATs), Cisco reports." - Security Week

“Some estimates state that cyber crime is as high as 8% of this failed state’s economy in recent years. The wide range of TTPs (tactics, techniques, and procedures) show how resourceful these criminals are driven to be, pivoting if one sophisticated approach might work better than another. It is sad that these funds will presumably be funneled to the nuclear weapons program or into the coffers of the kleptocrats at the top while the population suffers and dies. Do what you can to make life hard for the Lazarus APT group by beefing up ransomware defense and detection capabilities, using MFA, encrypting data at rest, and storing backups in hard to hack places.” - BIll Lawrence, CISO

NEWS

10 steps to prevent cyberattacks on industrial control systems

"Industrial control system (ICS) security is certainly not a new concept, but over the past 18 months, its status has risen to the top of organizations’ priority lists. This is, in large part, due to the high-profile ICS attacks that have dominated news headlines of late." - SECURITY

"This is pretty solid advice. If you want to follow the "People, Process, and Technology" order, take the last bullet - training - and make that a very high priority. Picking an appropriate ICS security framework helps sharpen the training objectives and lays out many of the following listed points. Easy wins - like MFA wherever you can - might stem the tide while other, more technical defenses are put in place." - Bill Lawrence, CISO