OT/ICS Cybersecurity Newsletter

Hey there, welcome to this week's edition of the Cybersecurity Newsletter.

For the OT/ICS Cybersecurity professional that needs to know it all, but doesn't have the time - we've got your back.

BLOG

SecurityGate.io Reports 175% Year-Over-Year Growth

SecurityGate.io announced accelerating company growth in response to increasing demand for OT cyber security solutions. According to Gartner, organizations will spend a collective $188.3 billion on information security and risk management products and services in 2023.

Read now

Responding To And Recovering From A Cyber Attack

This document defines a National Cybersecurity Center of Excellence (NCCoE) project focused on responding to and recovering from a cyber incident within an Operational Technology (OT) environment.

Read now

CISA Strategic Plan 2023-2025

This Strategic Plan communicates the Cybersecurity and Infrastructure Security Agency's (CISA) mission and vision, promotes unity of effort across the agency and our partners, and defines success for CISA as an agency. It describes the stakeholder, policy, and operational context in which we must perform and presents the strategic changes CISA will make to better executive our vital mission over the next three years.

Read now

NEWS

The state of OT security: a rapidly evolving landscape

"Because OT security powers critical infrastructure in industries like electricity, oil, water and more, there are persistent concerns about the potential for cyber attacks that carry real world, kinetic consequences -- including injury or loss of life." - TechTarget

“The most interesting part of this article comes from the three reports (from Barracuda Networks, Trend Micro, and Claroty) on security incidents hitting in the 80-90% range of respondents, with impacts to ICS environments – even two days or longer. Yet these aren’t getting publicly reported, so businesses are scrambling to recover, potentially have some resiliency on-site, and definitely don’t want the reputational damage from an OT incident. It would be useful to know exactly what measures these organizations took to get back on their feet – and prevent this from happening again immediately.” - Bill Lawrence, CISO

NEWS

How cyber attackers are targeting industrial machines in 2022-2023

"It was a unique year for big machines. In 2022, there were two new entries into what some call an “elite league of malware” — malware directed at industrial machines that run our world, from power plants to traffic lights to water." - Industrial Cyber

“The last reported successful cyber attacks against the electric grid in Ukraine happened in 2015 and 2016 – each for thousands of customers but only for a few hours before power was restored. Now, Indestroyer 2 and Pipedream/Incontroller have been created to target ICS/SCADA systems – thankfully, they were discovered before they could wreak havoc and have been dissected and reported on by some of the heavyweights in the malware business. So, over 5 years after the lights (briefly) went out due to cyber attacks – the defenders caught these attempts – and the lights stayed on. That’s a lot of development work and preparation time spent on this malware, all lost in these cases – thankfully. Of course, the effectiveness of kinetic attacks on the grid from Russian aircraft and missiles are being felt by thousands of Ukrainians this winter, so blocking additional outages from cyber would be larger comforts in a colder war.” - Bill Lawrence, CISO

NEWS

How We Will Win the Cyber-Physical Battle for OT Security

"When critical infrastructure is the target, communities, economies and civilian lives are all on the line. Even more concerning, many of these facilities are unprepared to face the threat." - CPO Magazine

“OT is important and the workforce crunch is growing. The author makes a case for managed security service providers (MSSPs) riding in to save the day. In most cases, this will be remote service, so the people and tools protecting the OT won’t be collocated with the production environment, and therefore dependent on glitch-free communications and probably cloud availability, neither of which have spotless track records. A blended approach with internal staff, backfilled by a MSSP, should be a starting point, while growing team size and experience using the same tools the MSSP deploys should come after. Somebody’s got to get things secure and running locally if badness hits and cuts off all remote access.” - Bill Lawrence, CISO