The Russian hacking group COLDRIVER (also known as Star Blizzard or Callisto Group) has been active in cyberattacks since 2017. Since then, COLDRIVER has enhanced its detection evasion and continued to target email credential theft. Recently, COLDRIVER has focused its efforts on NGOs and think tanks supporting government employees, military officials and intelligence officials. This is especially seen in the case of those supporting Ukraine and NATO countries. 

Microsoft and the United States Department of Justice (DOJ) has announced the disruption of COLDRIVER’s technical infrastructure. This infrastructure was disrupted by Microsoft’s Digital Crimes Unit, leading the the seizure of 66 unique domains. 

Casey Ellis, Founder and Chief Strategy Officer at Bugcrowd, comments, “The takedown serves a few purposes: Disrupting existing operations, their infrastructure and their operatives. It puts COLDRIVER, and others, “on notice” that their activities are being detected and that they aren’t operating with impunity, which has the benefit of sowing internal doubt and confusion within the operation, which will chill their activities for a while. Importantly, the announcement and the amount of signaling the USG is doing around this takedown is definitely intended to send a message, both to foreign adversaries as well as those being protected here — Russia is a real adversary, with real cyber-operations underway.” 

The DOJ simultaneously seized 41 domains, totaling more than 100 websites seized together. Rebuilding this technical infrastructure will require time, resources and money, thus impacting COLDRIVER’s operations. 

Stephen Kowski, Field CTO at SlashNext Email Security+, states, “While the takedown is a significant blow to COLDRIVER’s operations, it’s important to remember that sophisticated threat actors are highly adaptable. They may regroup and establish new infrastructure, but this action certainly disrupts their current campaigns and forces them to expend resources rebuilding. The key to long-term security lies in continuous monitoring and rapid detection of new phishing domains and tactics as they emerge. 

“The effectiveness of such takedowns depends on the speed at which defenders can identify and neutralize new threats. Advanced AI-powered tools that can detect and block malicious URLs in real-time, even before they’re widely known, are crucial in maintaining a robust defense against evolving phishing tactics. While this action may not make us completely safe, it does buy valuable time for organizations to strengthen their defenses and educate employees about emerging threats.

“Ultimately, the most effective strategy combines proactive measures like these takedowns with cutting-edge technology that can identify and neutralize new phishing attempts as they arise. By leveraging real-time threat intelligence and automated phishing detection systems, organizations can stay ahead of threat actors, regardless of how quickly they attempt to rebuild their infrastructure.”

While COLDRIVER will be impacted by this infrastructure disruption, Microsoft still encourages civil society groups to bolster their cybersecurity postures. 

Guy Rosenthal, Vice President of Product, at DoControl, says, “The Microsoft-DOJ takedown of more than 100 COLDRIVER
domains is a significant blow to their operations, but it’s not without potential consequences. While it will disrupt their activities in the short term, we shouldn’t expect this to be the end of COLDRIVER or similar groups. In fact, this action might even paint a bigger target on Microsoft’s back.

“These state-sponsored groups are persistent and well-resourced. They’re likely to regroup and adapt their tactics. More concerning, they might view this as a challenge, potentially leading to increased efforts to compromise Microsoft’s own systems or services in retaliation. We’ve seen this pattern before — for instance, after Microsoft took action against the NICKEL group in 2021, there was a noticeable uptick in attempts by that group to breach Microsoft and its customers’ systems. It’s a reminder that these actions, while necessary, can sometimes provoke an aggressive response.

”That said, these takedowns do have value. They force threat actors to rebuild infrastructure, which takes time and resources. It also sends a message that these activities won’t go unchallenged. Perhaps most importantly, it provides valuable intelligence on their tactics and targets, which can help improve defenses across the board.

“But let’s be realistic — this is an ongoing battle. As long as there’s valuable information to be stolen, there will be actors trying to steal it. What’s crucial is that organizations don’t let their guard down. They need to assume that threats like COLDRIVER
are constantly evolving and looking for new ways in.

“While we should applaud this takedown, it’s not a reason to relax. It’s a call to double down on our cybersecurity efforts and stay vigilant against the next wave of attacks, whatever form they may take — and that includes keeping a close eye on our Microsoft environments for any signs of retaliatory action.” 

https://www.securitymagazine.com/articles/101116-russian-hacking-group-intercepted-by-microsoft-and-doj

La sicurezza mobile si riferisce alla mitigazione dei rischi e alla prevenzione delle minacce sui dispositivi mobili, proteggendo i dati e le risorse utilizzate. Con l’aumento dell’uso di tecnologie mobili per comunicazione e lavoro, la sicurezza dei dispositivi mobili è diventata cruciale, poiché questi dispositivi gestiscono dati sensibili e presentano rischi unici rispetto ai computer desktop.

Importanza della Sicurezza dei Dispositivi Mobili

I dispositivi mobili, come smartphone e tablet, offrono nuove modalità di lavoro, introducendo rischi che le soluzioni di sicurezza per desktop non affrontano adeguatamente. Ad esempio, il malware per dispositivi mobili spesso opera nella memoria residente e può rimanere attivo a lungo, poiché gli utenti raramente riavviano i loro dispositivi. Questo differisce dai computer desktop, dove il malware può stabilire una persistenza più robusta.

Sicurezza Mobile

Anche se aziende come Apple, Microsoft e Google offrono funzionalità di sicurezza, la sicurezza mobile richiede un approccio olistico. Le organizzazioni devono implementare protocolli di sicurezza critici, garantire che i dispositivi seguano impostazioni di sicurezza rigorose e mantenere la conformità alle normative.

Impatto della Sicurezza Mobile sulle Organizzazioni

La mancanza di sicurezza mobile può portare a gravi conseguenze, come la perdita di integrità aziendale, interruzioni operative e violazioni di dati. È fondamentale che le organizzazioni siano consapevoli delle minacce mobili e implementino strategie di difesa per gestire i dispositivi in modo completo.

Minacce alla Sicurezza dei Dispositivi Mobili

Le principali minacce includono phishing, malware (come ransomware e spyware), furto di dispositivi e attacchi Man-in-the-Middle. La gestione delle patch e l’uso di password forti sono essenziali per proteggere i dispositivi.

Benefici di una Soluzione di Sicurezza Mobile

Con oltre 7 miliardi di utenti di telefoni cellulari nel 2023, una strategia di sicurezza mobile è fondamentale. Essa garantisce che tutti i dispositivi siano protetti contro minacce moderne, salvaguardando le risorse aziendali e la privacy degli utenti.

Conclusione

La sicurezza mobile è una parte critica di un piano di sicurezza olistico. Con l’aumento dell’adozione dei dispositivi mobili e l’evoluzione delle minacce, le organizzazioni devono integrare la sicurezza mobile nelle loro strategie esistenti per proteggere efficacemente i loro ambienti e garantire la privacy degli utenti.

https://www.ictsecuritymagazine.com/notizie/sicurezza-mobile-comprendere-la-sicurezza-dei-dispositivi-mobili/

Nearly every organization uses email daily, meaning ensuring email security is a top priority. Email threats were analyzed in a report by Abnormal Security. The report saw file-sharing phishing volume more than triple, increasing 350% over the year. Sixty-percent of the attacks exploited legitimate domains, most commonly webmail accounts, such as Gmail, iCloud, and Outlook; productivity and collaboration platforms; file storage and sharing platforms like Dropbox; and e-signature solutions like Docusign. 

The finance industry was found to be most at risk, with file sharing phishing attacks making up one in 10 attacks. As financial institutions rely on file-sharing platforms to securely exchange documents, attackers have ample opportunities to slip in a fraudulent file-sharing notification among the sea of invoices, contracts, investment proposals, and regulatory updates. The second most vulnerable industry was construction and engineering, followed by real estate and property management companies. 

Business email compromise (BEC) attacks grew by more than 50% over the last year, with attacks on smaller organizations jumping nearly 60% in the last half. Forty-one percent of customers were targeted by VEC each week in the first half of 2024, a slight increase over the 37% targeted in the second half of 2023. 

Construction and engineering firms, as well as retailers and consumer goods manufacturers, were most vulnerable to VEC attacks, with 70% of organizations receiving at least one VEC attack in the first half of the year. 

Read the report.

https://www.securitymagazine.com/articles/101104-finance-industry-most-at-risk-for-phishing-attacks

According to a recent iProov report, the risk of deepfakes is rising with almost half of organizations (47%) having encountered a deepfake and three-quarters of them (70%) believing deepfake attacks which are created using generative AI tools, will have a high impact on their organizations. Sixty-eight percent believe that while it’s impactful at creating cybersecurity threats, more (84%) find it’s instrumental in protecting against them. 

While organizations recognize the increased efficiencies that AI can bring, these benefits are also enjoyed by threat technology developers and bad actors. Almost three quarters (73%) of organizations are implementing solutions to address the deepfake threat but confidence is low with the study identifying an overriding concern that not enough is being done by organizations to combat them. More than two-thirds (62%) worry their organization isn’t taking the threat of deepfakes seriously enough. 

The study also reveals some rather nuanced perceptions of deepfakes on the global stage. APAC (51%), European (53%), and LATAM (53%) organizations are significantly more likely than North American (34%) organizations to say they have encountered a deepfake. APAC (81%), European (72%), and North American (71%) organizations are significantly more likely than LATAM organizations (54%) to believe deepfake attacks will have an impact on their organization. 

Deepfakes are now tied for third place amongst the most prevalent concerns for survey respondents with the following order: password breaches (64%), ransomware (63%), phishing/social engineering attacks (61%) and deepfakes (61%). 

There are many different types of deepfakes but they all have one common denominator: they are created using generative-AI tools. Organizations recognize that generative AI is innovative, secure, reliable, and helps them to solve problems. They view it as more ethical than unethical and believe it will have a positive impact on the future. And they’re taking action: just 17% have failed to increase their budget in programs that encompass the risk of AI. Additionally, most have introduced policies on the use of new AI tools. 

Read the report.

https://www.securitymagazine.com/articles/101105-47-of-organizations-have-dealt-with-deepfake-attacks

Unsafe security practices were analyzed in a recent report by Ivanti.

One in two office workers admit to using personal devices to log into work networks, with 32% of them revealing their employers are unaware of this practice. Yet, 13% of security professionals say user experience (UX) for end users is a mission-critical priority when adopting cybersecurity tech interventions. By focusing on UX in security measures, organizations can minimize the likelihood of employees bypassing established protocols and resorting to unsafe workarounds.

When employees have unfettered access to Gen AI tools and other advanced technologies, it can introduce challenges with data privacy, compliance, cyber risks and copyrighted materials. Research shows that 81% of office workers report they have not been trained on Gen AI and 15% are using unsanctioned tools.

Whether half of employees work remotely or just a small fraction do, there is still a profound need to ensure that the company supports all the ways employees work. Sixty-two percent use a VPN or a zero-trust access solution to restrict network access and protect sensitive information, and 57% use multi-factor authentication.

Read the report

https://www.securitymagazine.com/articles/101082-81-of-us-workers-have-not-been-trained-on-generative-ai

The Cybersecurity & Infrastructure Security Agency (CISA) has issued a warning regarding a known, exploited vulnerability. This vulnerability is an Ivanti Endpoint Manager (EPM) SQL Injection Vulnerability (CVE-2024-29824) and has been added to CISA’s Known Exploited Vulnerabilities Catalog.

Security leaders weigh in

Eric Schwake, Director of Cybersecurity Strategy at Salt Security:

“The Ivanti EPM vulnerability is currently being actively exploited and poses a significant threat that requires immediate attention. This is because it allows unauthenticated attackers to execute arbitrary code on unpatched systems, potentially giving them extensive control over affected devices and access to sensitive data. Many organizations could be vulnerable due to the widespread use of Ivanti EPM, especially in enterprise environments.

“Exploiting this flaw could have serious consequences, such as data breaches, disruption of business operations, and further compromise of internal systems. Organizations using Ivanti EPM should prioritize patching their systems immediately and conduct thorough security assessments to detect and mitigate potential compromise. This situation emphasizes the critical importance of proactive vulnerability management and timely patching to protect against evolving threats. In an increasingly interconnected world, securing every IT asset, such as endpoints, applications, and APIs, is paramount to maintaining a strong security posture.”

Jason Soroko, Senior Fellow at Sectigo:

“The CVE-2024-29824 vulnerability in Ivanti Endpoint Manager (EPM) allows remote code execution via SQL Injection, posing serious risk in enterprise environments. Attackers on the same network can fully compromise unpatched EPM systems, leading to broader control. Although Ivanti patched this in May, a proof-of-concept exploit is public, and active exploitation is confirmed. Organizations must patch immediately, as failure to do so leaves systems vulnerable to arbitrary command execution and network-wide compromise. The risk is heightened by published attack methods and ongoing exploitation.”

Mr. Mayuresh Dani, Manager, Security Research, at Qualys Threat Research Unit:

“CVE-2024-29824 is an unauthenticated SQL injection vulnerability, which affects vulnerable Ivanti Endpoint Manager (EPM) appliances. Proof-of-concept code that exploits this vulnerability has been available since early June. Given all these facts, this definitely is a dangerous flaw.

“Multiple versions of proof-of-concept code available make use of different variations of the xp_cmdshell feature in SQL Servers. This primarily allows the attacker to execute arbitrary Windows commands. This means the attacker will be able to download and run scripts that can lead to the installation of malware, or even manipulate files on the endpoint. This functionality can also allow the attacker to exfiltrate data or laterally move to other systems in the network — effectively leading to a complete system compromise. This feature should be disabled on production systems that are externally exposed.”

https://www.securitymagazine.com/articles/101111-security-leaders-discuss-the-new-vulnerability-added-to-cisas-catalog

Ott 08, 2024 Marina Londei In evidenza, Minacce, News, RSS 0

---

I ricercatori di ESET hanno scoperto le attività di CeranaKeeper, un gruppo APT allineato alla Cina che ha preso di mira istituzioni governative in diversi Paesi asiatici, esfiltrando grandi quantità di dati.

Il nome del gruppo, ideato dai ricercatori, è un gioco di parole tra il termine “beekeeper”, ispirato dalle numerose occorrenze della stringa “bectrl” nel codice dei tool del gruppo, e la specie di ape Apis Cerana, l’ape asiatica del miele.

CeranaKeeper utilizza molti strumenti e tecniche in rapida e continua evoluzione: gli attaccanti riscrivono il set di strumenti in base alle necessità, per cercare di eludere il rilevamento. L’obiettivo del gruppo APT è raccogliere il numero maggior di file possibile per accedere a conoscenze militari e governative.

Il gruppo usa servizi cloud e di condivisione file per l’esfiltrazione dei dati, cercando di camuffare il traffico con quello legittimo e difficile da bloccare di questi servizi.

CeranaKeeper è attivo almeno dal 2022 e ha come obiettivo principale gli enti governativi in Thailandia, Myanmar, Filippine, Giappone e Taiwan. Nel dettaglio, negli attacchi contro le istituzioni thailandesi il gruppo ha usato componenti rivisitate attribuite da altri ricercatori a MustangPanda, un altro gruppo APT allineato alla Cina, oltre a un nuovo set di strumenti in grado di violare service provider quali Pastebin, Dropbox, OneDrive e GitHub.

I ricercatori ritengono che i due gruppi siano entità separate, anche se è possibile che condividano informazioni e una parte degli strumenti. “Nonostante alcune somiglianze nelle loro attività, come obiettivi comuni e formati di archivi simili, ESET ha osservato differenze organizzative e tecniche tra i due gruppi, ad esempio nei set di strumenti, infrastrutture, procedure e campagne. Abbiamo anche notato differenze nel modo in cui i due gruppi svolgono compiti simili” ha affermato Romain Dumont, ricercatore di ESET che ha scoperto CeranaKeeper.

Il gruppo usa un set di strumenti pubblici chiamato “bespoke stagers” che sfrutta una tecnica di side loading e una specifica sequenza di comandi per esfiltrare file dalla rete. L’uso di componenti PlugX rimanda ancora una volta all’attività di MustangPanda, ma ci sono differenza organizzative e tecniche che confermano l’idea che si tratti di entità differenti.

Dopo l’accesso alla rete, il gruppo installa la backdoor TONESHELL, esegue uno strumento per il dump delle credenziali e usa un driver Avast e un’applicazione personalizzata per disabilitare gli antivirus presenti sulle macchine. Per spostarsi lateralmente, il gruppo distribuisce uno script BAT e sfrutta il controller di dominio per ottenere i privilegi di amministratore. Ciò permette a CeranaKeeper di esfiltrare enormi quantità di dati.

“Il gruppo dietro gli attacchi al governo tailandese, CeranaKeeper, sembra particolarmente implacabile, dato che la pletora di strumenti e tecniche che il gruppo utilizza continua a evolversi a un ritmo rapido” spiega il team di ESET. Il gruppo sta continuando con le sue attività ed è probabile che colpirà nuovi obiettivi evolvendo le tecniche e i tool a disposizione. 

---

---

---

https://www.securityinfo.it/2024/10/08/eset-scopre-ceranakeeper-gruppo-apt-affiliato-al-governo-cinese/?utm_source=rss&utm_medium=rss&utm_campaign=eset-scopre-ceranakeeper-gruppo-apt-affiliato-al-governo-cinese

Sovranità digitale e processi cyber strutturati: la base per una cooperazione tecnologica efficace.

Servono processi cyber strutturati e cooperazione tecnologica; affinché le organizzazioni raggiungano una vera cyber resilienza, è necessario costruire un processo di trustability che comprenda certificazioni e conformità ma anche continui test e monitoraggio. Prevenzione e resilienza vanno di pari passo con la cooperazione, nazionale e internazionale, vista la disomogeneità dei sistemi componenti le varie reti.

Processi Strutturati per la Sovranità Digitale

Una vera cyber resilienza all’interno delle organizzazioni, può essere garantita solo in presenza di determinate condizioni: innanzitutto occorrono processi di cyber security strutturati, in quanto il continuo aumento di attacchi informatici sta duramente mettendo alla prova la resilienza degli assett organizzativi. In secondo luogo, serve tra i responsabili della sicurezza un’adeguata consapevolezza di tali processi che va sfruttata in ottica di prevenzione di qualunque evento informatico avverso.

A questi elementi va aggiunta la cooperazione tra le diverse aziende che forniscono e gestiscono i sottosistemi di un sistema tecnologico, affinché configurino i propri apparati garantendo aderenza agli stessi standard di sicurezza e dunque interoperabilità. In ultimo, ma non certo per importanza, la certificazione degli apparati e la conformità agli standard internazionali.

Va costruito quindi un processo di trustability che, per citare un intervento del Direttore del Centro di Valutazione e Certificazione Nazionale, sia come un fossato attorno a un castello, dove le porte e le pusterle rappresentano i possibili accessi malevoli che minano la cyber resilienza delle nostre reti.

Questo processo comprende certificazioni e conformità ma anche continui test e monitoraggio e centra gli obiettivi che sta implementando nell’ultimo anno la nostra agenzia per la cyber security nazionale.

Il processo di trustability, cruciale per la sovranità digitale, va garantito attraverso diversi step di cooperazione tra aziende fornitrici di uno stesso sistema ICT e/o di una stessa rete. Quindi prevenzione e resilienza vanno di pari passo con la cooperazione, nazionale e internazionale, vista la disomogeneità dei sistemi componenti le varie reti.

Standard di Sicurezza Condivisi: un Pilastro della Sovranità digitale

Gli standard di sicurezza condivisi sono necessari come base per garantire la resilienza di apparati, reti e sistemi complessi, contribuendo così alla sovranità digitale.

L’approccio a standard che utilizzavamo all’inizio degli anni 2000 per i protocolli di rete, i quali dovevano essere a standard proprio per garantire la comunicazione tra gli utenti, va ora riutilizzato per rendere le stesse reti resilienti e quindi sicure.

Gli standard internazionali hanno il grande vantaggio di essere il miglior esempio di cooperazione tra stakeholder, a vantaggio degli utenti finali oltre a garantire competizione e innovazione tecnologica prevenendo, tra l’altro, rischi di interoperabilità tra componenti di rete sempre più disomogenei, vista la globalizzazione inevitabile della manifattura.

Standard e certificazioni “adattabili” ai contesti

Gli standard sono quindi fondamentali per garantire una piattaforma comune di resilienza delle reti ma sono una condizione necessaria e non sufficiente.

È utile, infatti, che standard e certificazioni non siano localizzati nel contenuto ma adattabili ai diversi contesti. Questa è la direzione recentemente adottata nelle linee guida metodologiche del Centro di Valutazione e Certificazione Nazionale.

Questa può essere un’implementazione di un concetto avanzato di sovranità digitale: laboratori locali ma certificazioni internazionali.

Le certificazioni cyber devono rispettare corrette e differenziate analisi di rischio ma prevedere anche tempi certi. Alcuni approcci europei, mi riferisco alla EN17640, che prevede 60 giorni di certificazione, possono rappresentare il giusto compromesso per coniugare le esigenze di time-to-market con la qualità di certificazione, supportando la sovranità digitale.

Apparati certificati cyber possono essere un vero baluardo per gli attacchi hacker ed utilizzi impropri da parte della criminalità organizzata.

Bibliografia:

1. Piccinelli L. (Giugno 2024) : Nasi, Rauti, CaoPinna, Piccinelli: Rapporto Cybercrime Fondazione Magna Grecia, a cura On.Foti presentato alla Camera dei Deputati (Presidenza Commissione Antimafia)
2. Piccinelli L. (Novembre 2023) Processi Cyber & Cooperazione Tecnologica ed. Online www.cybersecurity360.it
3. Piccinelli L. (Marzo 2023) Neutralità tecnologica e certificazione ed. Online www.cybersecurity360.it

Articolo a cura di Luca Piccinelli

https://www.ictsecuritymagazine.com/articoli/sovranita-digitale/

@import url(‘https://fonts.googleapis.com/css2?family=Nunito+Sans:ital,opsz,wght@0,6..12,400;0,6..12,500;0,6..12,600;0,6..12,700;1,6..12,400;1,6..12,500;1,6..12,600;1,6..12,700&family=Nunito:ital,wght@0,400;0,500;0,600;0,700;1,400;1,500;1,600;1,700&display=swap’); @import url(‘https://fonts.googleapis.com/css2?family=Architects+Daughter&family=Roboto:ital,wght@0,100;0,300;0,400;0,500;0,700;0,900;1,100;1,300;1,400;1,500;1,700;1,900&display=swap’); h3 { font-weight: bold; font-size: 18px; color: #C72026; } figure { padding: 4px; margin: auto; } figcaption { background-color: #f8f8f8; color: #404144; Nunito Sans’, Arial, sans-serif; font-size: 16px; padding: 2px; text-align: center; } .pqFull { display: block; border-width: 2px 0; border-style: solid; border-color: #404144; padding: 1.5em 0 0.5em; margin: 1.5em 0; position: relative; Architects Daughter’, Arial, sans-serif; font-size: 21px; text-align: center; color: #0067A6; } .pqFull:before { content: ‘\201C’; position: absolute; top: 0em; left: 50%; transform: translate(-50%, -50%); background: #fff; width: 3rem; height: 2rem; color: #666; text-align: center; } .pqFull:after { content: ; display: block; text-align: center; font-size: 18px; color: #404144; }

In today’s highly technological world, devices are at the heart of organizational operations. Whether it’s a sophisticated surveillance camera with advanced features or a simple access control panel, the smooth functioning of these devices is critical for seamless operations across the enterprise. The failure of even a single device can trigger a cascade of frustration and reduced productivity. This is why effective device lifecycle management is so important; it can prevent disruptions and enhance both the efficiency and security of an organization. But how can organizations ensure successful device lifecycle management? They simply need to follow the three “T’s”: Thinking, Tools, and Timelines.

Thinking ahead to avoid trouble

Before taking any action, whether it involves purchasing a new device or hiring additional staff, having a comprehensive plan in place is the first key to success. The first consideration in any project should always be compliance to all applicable standards. Ensuring that your organization, employees and technology all adhere to necessary standards and internal policies is a fundamental building block, and without it, whatever you build upwards will eventually come tumbling down.

Next comes the strategic layering of technology. When introducing new technologies, it should be planned to complement and build upon existing security measures rather than replace them. This approach maximizes the value of current devices and enhances overall security. This strategic layering, though, requires a thorough understanding of the current technology landscape within the organization. It also requires identifying the gaps that new technology can fill, as well as how older devices can complement them.

People are also critical in this initial planning stage. The lines between IT (Information Technology) and OT (Operational Technology) are no longer distinctly separate. This newfound collaboration between IT and OT should be rooted in open communication channels and defined roles and responsibilities. By approaching technology in this way, organizations can ensure that there are no overlaps or gaps in responsibility, mitigating security vulnerabilities and operational inefficiencies tied to poor staffing. Key questions to address here include: Who is responsible for updates? To whom do they communicate this information? Who decides the level of security or hardening required? Answering these questions at the onset lays a solid foundation for effective, long-term device lifecycle management.

The right tools for the job

With a solid plan in place, the next step is to equip your organization with the right tools for the goals you’re aiming to achieve. These can be categorized into three main types: tools for designing, tools for implementation, hardening, and designing, and tools for maintaining devices.

Tools for designing devices ensure that configurations remain consistent across all devices during the design or programming phase. These tools often include templates that standardize future programming efforts. For example, using standardized templates for device configurations can streamline the deployment process, reduce errors, and ensure consistency across the board. Additionally, organizations should pay close attention to hardening guides provided by manufacturers from the outset to avoid problems later, as these guides serve as valuable resources during the design stage and offer best practices for configuring devices securely.

By working together, IT and OT can ensure that devices remain in optimal condition and that any issues are promptly addressed throughout their lifecycle.

In the implementation stage, the collaboration between IT and OT becomes crucial. Implementation tools help to ensure devices are onboarded securely and hardened appropriately, protecting against both cyber and physical threats. Devices should be securely mounted and placed in safe locations — an OT concern — while the networks they connect to must be fortified against cyber threats — which lie in the IT realm. You wouldn’t want to mount a camera in a spot where it’ll be easily damaged, just like you wouldn’t want to connect it to an unsafe network. Features like encryption, formerly just an IT concern, ensure data transmitted between devices and systems remains confidential and protected from interception or tampering. However, now, even this approach requires collaboration between IT and OT teams to identify the best encryption methods and ensure they are implemented consistently across all devices.

Finally, maintenance tools are essential for successful device lifecycle management, so they need to be user-friendly and accessible to all relevant parties. These tools include ones that provide visibility into the device’s lifecycle, including warranty status, end-of-life dates, and support options from manufacturers. Maintenance also involves staying updated on bug fixes that affect the entire network, and knowing what exactly needs to be done to smash those bugs. Using centralized management systems can provide a single pane of glass view of all devices, their status, and any pending maintenance activities — making response times faster than ever and mitigating costly downtime.

Timelines for thriving

The final “T” in device lifecycle management is timelines. Every device has its own set of timelines, including those for design, implementation, maintenance, and decommissioning. These timelines are not the sole responsibility of any one department; rather, they require a collaborative effort across IT and OT teams.

Let’s start with a few shorter timelines. For instance, the design timeline: IT and OT must collaborate here, as OT will know about needed capabilities, and IT will know about how that device will go on the network and any necessary maintenance activity. During design, even though it’s a short timeframe to work together, the two departments need to strive for a happy medium — what does OT need, and can IT maintain it effectively?

Another short timeline is the implementation phase, where IT takes the lead and focuses on device hardening and selecting the appropriate security measures to protect the organization. This phase involves configuring devices according to security best practices, testing them to ensure they meet the required standards, and deploying them into the production environment. For instance, IT would configure firewalls, set up access controls, and apply security patches to ensure that the new devices are protected from potential threats.

Perhaps our longest timeline is the maintenance phase, where once a device is in service, it requires ongoing care. The division of responsibilities between IT and OT can vary depending on the organization, update schedule, and the specific device. Historically, OT was responsible for maintenance, but the rise of cybersecurity threats has necessitated greater IT involvement. Now, effective collaboration between IT and OT is critical. Maintenance activities can include regular software updates, hardware inspections, performance monitoring, and responding to any issues that arise. For example, IT might be responsible for applying security patches and updates to ensure that devices remain protected from vulnerabilities, while OT might handle routine inspections and performance monitoring to ensure that devices continue to operate effectively.

Decommissioning, our final short timeline, involves securely wiping and disposing devices, which is once more largely the responsibility of IT. Proper decommissioning ensures that sensitive data is not left on devices and that they are disposed of in an environmentally friendly manner. This phase includes tasks such as data wiping, physical device destruction, and recycling of components.

By working together, IT and OT can ensure that devices remain in optimal condition and that any issues are promptly addressed throughout their lifecycle. Through careful planning, the use of appropriate tools, and adherence to timelines, organizations can effectively manage their devices’ lifecycles. By doing so — keeping their devices up to date and their people operating as a unit — they ensure that devices remain secure, reliable, and efficient throughout their operational lifespan.

https://www.securitymagazine.com/articles/101103-the-three-ts-of-device-lifecycle-management

@import url(‘https://fonts.googleapis.com/css2?family=Nunito+Sans:ital,opsz,wght@0,6..12,400;0,6..12,500;0,6..12,600;0,6..12,700;1,6..12,400;1,6..12,500;1,6..12,600;1,6..12,700&family=Nunito:ital,wght@0,400;0,500;0,600;0,700;1,400;1,500;1,600;1,700&display=swap’); h3 {font-weight: bold;font-size: 18px;color: #C72026;}
figure {padding: 4px;margin: auto;}
figcaption {background-color: #f8f8f8;color: #404144;Nunito Sans’, Arial, sans-serif;font-size: 16px;padding: 2px;text-align: center;}

Security leaders can utilize robotics and drones to increase visibility without risking additional personnel. They can be especially helpful for night shifts or dangerous terrain such as the scene of a natural disaster.

Security magazine highlights robotics and drone solutions for 2024.

Beehive

Responds and Adapts to Environment Changes

The Beehive drone is two main compartments, the “Hive” and the “Bee”. After the Hive opens, the Bee takes off in under 5 seconds with a 40-acre range. The Bee is able to plan a path, perform the sweep and land safely back in the Hive. Thanks to 3D property mapping and geofencing, the Bee navigates and stays within user property. The Bee also detects unexpected obstacles and re-routes to avoid collision and improve future flight paths. Image courtesy of Beehive.
Find out more at sunflower-labs.com

---

---

Elistair

Dispatch Drone From Moving Object

Khronos is a complete fully automated system which includes the tethered drone, its power and landing station, and its ground control software. The solution is designed to be integrated onto a fixed platform or vehicle to safely enhance mobile operations and increase flexibility. Khronos can be deployed without leaving the vehicle. Image courtesy of Elistair
Find out more at elistair.com

---

---

FlightOps

Automatically Respond to Various Incidents

FlightOps drones have three different SIM cards and are controlled with LET secure network links. The system is designed to alert the drone in the event of an incident, flying an autonomous route to the scene. The drone transmits images to a police control center and — pending successful trials — police vehicles. Image courtesy of FlightOps
Find more at flightops.io

FoxFury

Improve Visibility With Brighter Lighting

The D3060-TC Light System for Skydio X2 is a custom saddle and D3060-TC lights designed specifically for the Skydio X2 drone. The D3060-TC lights are strobe-capable with 30° and 60° dual LEDs that operate independently to provide 360° anti-collision lighting that meets global night flight requirements. The waterproof D3060-TC is rechargeable via USB-C. It lasts 1.5 to three hours on a single charge and weighs 1.1 oz (31.2 g). Image courtesy of FoxFury
Find more at foxfury.com

---

---

Immervision and ModalAI Inc.

Increases Drone Visual Range

Immervision partnered with ModalAI, Inc., a Blue UAS Framework manufacturer of autonomous drone and robot technology, on a drone vision system. The solution incorporates the Immervision Imvisio-ML and the VOXL 2 platform to provide the full image pipeline, from the optics to the hardware platform running the autonomous navigation software. Its 190-degree field of view and low-light capability aims to increase perception and improve the performance of machine vision applications, running on its Qualcomm QRB5165 processor. Image courtesy of Immersion and ModalAI
Find more at immervision.com

---

---

Knightscope

Automatically Recharge After Deployment

The Knightscope K5 is intended for outdoor use running 24/7 on its own, including autonomously recharging itself without any human intervention. The K5 is best suited for securing large, outdoor spaces through the winters of the Northeast and the summers of the South. Image courtesy of Knightscope
Find out more at knightscope.com

---

---

Montavista

Prolongs Airtime and Battery Life

METARY P Series battery cells from Montavista aim to improve the air time for commercial drone usage. Adopting a lithium metal anode and an optimized non-flammable liquid electrolyte, the METARY P Series cells provide not only a high specific energy over 400 Wh/kg that can sustain a long in-air time for a commercial drone, but also a high specific power that can lift and maneuver it safely at high speed. Image courtesy Montavista and PRNewswire
Find more at mvista.com

---

---

Nightingale Security

Automatically Dispatch Drone to Incident Site

The system springs into action by dispatching a drone to the precise location of the incident, providing an instantaneous visual feed to the response team through live video streaming. The system enables the configuration of scheduled, autonomous patrol missions with meticulous precision. Parameters such as specific days, times, designated paths, altitudes, hover durations, camera orientations, and other mission intricacies can be meticulously defined. Image courtesy of Nightingale
Find out more at nightingalesecurity.com 

https://www.securitymagazine.com/articles/101101-product-spotlight-on-robotics-and-drones