Unpatchable 0-day in surveillance cam is being exploited to install Mirai
Malicious hackers are exploiting a critical vulnerability in a widely used security camera to spread Mirai, a family of malware that wrangles infected Internet of Things devices into large networks for use in attacks that take down websites and other Internet-connected devices.
The attacks target the AVM1203, a surveillance device from Taiwan-based manufacturer AVTECH, network security provider Akamai said Wednesday. Unknown attackers have been exploiting a 5-year-old vulnerability since March. The zero-day vulnerability, tracked as CVE-2024-7029, is easy to exploit and allows attackers to execute malicious code. The AVM1203 is no longer sold or supported, so no update is available to fix the critical zero-day.
That time a ragtag army shook the Internet
Akamai said that the attackers are exploiting the vulnerability so they can install a variant of Mirai, which arrived in September 2016 when a botnet of infected devices took down cybersecurity news site Krebs on Security. Mirai contained functionality that allowed a ragtag army of compromised webcams, routers, and other types of IoT devices to wage distributed denial-of-service attacks of record-setting sizes. In the weeks that followed, the Mirai botnet delivered similar attacks on Internet service providers and other targets. One such attack, against dynamic domain name provider Dyn paralyzed vast swaths of the Internet.
Complicating attempts to contain Mirai, its creators released the malware to the public, a move that allowed virtually anyone to create their own botnets that delivered DDoSes of once-unimaginable size.
Kyle Lefton, a security researcher with Akamai’s Security Intelligence and Response Team, said in an email that it has observed the threat actor behind the attacks perform DDoS attacks against “various organizations,” which he didn’t name or describe further. So far, the team hasn’t seen any indication the threat actors are monitoring video feeds or using the infected cameras for other purposes.
Akamai detected the activity using a “honeypot” of devices that mimic the cameras on the open Internet to observe any attacks that target them. The technique doesn’t allow the researchers to measure the botnet’s size. The US Cybersecurity and Infrastructure Security Agency warned of the vulnerability earlier this month.
The technique, however, has allowed Akamai to capture the code used to compromise the devices. It targets a vulnerability that has been known since at least 2019 when exploit code became public. The zero-day resides in the “brightness argument in the ‘action=’ parameter” and allows for command injection, researchers wrote. The zero-day, discovered by Akamai researcher Aline Eliovich, wasn’t formally recognized until this month, with the publishing of CVE-2024-7029.
Wednesday’s post went on to say:
How does it work?
This vulnerability was originally discovered by examining our honeypot logs. Figure 1 shows the decoded URL for clarity. Decoded payload
Enlarge/ Fig. 1: Decoded payload body of the exploit attempts
Fig. 1: Decoded payload body of the exploit attempts
The vulnerability lies in the brightness function within the file /cgi-bin/supervisor/Factory.cgi (Figure 2).
In the exploit examples we observed, essentially what happened is this: The exploit of this vulnerability allows an attacker to execute remote code on a target system.
Figure 3 is an example of a threat actor exploiting this flaw to download and run a JavaScript file to fetch and load their main malware payload. Similar to many other botnets, this one is also spreading a variant of Mirai malware to its targets.
Enlarge/ Fig. 3: Strings from the JavaScript downloader
In this instance, the botnet is likely using the Corona Mirai variant, which has been referenced by other vendors as early as 2020 in relation to the COVID-19 virus.
Upon execution, the malware connects to a large number of hosts through Telnet on ports 23, 2323, and 37215. It also prints the string “Corona” to the console on an infected host (Figure 4).
Enlarge/ Fig. 4: Execution of malware showing output to console
Static analysis of the strings in the malware samples shows targeting of the path /ctrlt/DeviceUpgrade_1 in an attempt to exploit Huawei devices affected by CVE-2017-17215. The samples have two hard-coded command and control IP addresses, one of which is part of the CVE-2017-17215 exploit code:
The botnet also targeted several other vulnerabilities including a Hadoop YARN RCE, CVE-2014-8361, and CVE-2017-17215. We have observed these vulnerabilities exploited in the wild several times, and they continue to be successful.
Given that this camera model is no longer supported, the best course of action for anyone using one is to replace it. As with all Internet-connected devices, IoT devices should never be accessible using the default credentials that shipped with them.
In this episode of The Security Podcasts featuring Thomas Kinsella, Co-Founder & Chief Customer Officer at Tines, we discuss why security professionals experience burnout and how security leaders can prevent it.
“If you’re trying to build out a mature security team, you can’t have a huge amount of turnover,” Kinsella says. “You need a mature team that’s able to stick around for a little while. If you’ve got teams that are burnt out, there’s going to be a load of challenges.”
Why security professionals experience burnout
Thomas Kinsella, Co-Founder & Chief Customer Officer at Tines, discusses the challenges contributing to burnout among security professionals.
Susan Chiang hired as Chief Information Security Officer at Headway
Susan Chiang has been appointed Chief Information Security Officer (CISO) at Headway, a mental health organization. An accomplished technology executive, Chiang brings extensive security and strategy experience from companies like Cloudflare, Uber, and Salesforce, and healthcare consulting experience from Deloitte. She will oversee a team across data privacy and security, engineering and IT to make Headway the most trusted platform for mental health care providers and their patients.
According to the U.S. Department of Health and Human Services, cybersecurity incidents in healthcare are on the rise. The department reported a 93% increase in large breaches reported from 2018 to 2022, underscoring the critical need for investing in security and privacy as a top priority. This comes on the heels of the company’s announced expansion to Medicare Advantage and Medicaid plans.
Most recently, Chiang was Acting Chief Security Officer at Cloudflare, a large internet backbone company known for security and data privacy, where she oversaw engineering, operations, and technical program management functions for Security across the organization. Prior to Cloudflare, she was part of the security leadership team at Uber. Earlier in her career, she spent several years at Deloitte, where she focused on technology and healthcare consulting.
In addition to her professional achievements, Chiang is a recognized advocate for empowering women and underrepresented groups in the security industry. She was honored as a Women in IT Security Advocate by SC Media in 2023. Chiang holds a degree from the University of California, Berkeley, and is based in San Francisco.
Malicious actors are leveraging peak travel and vacation times
As Labor Day approaches, new data warns that cybercriminals are exploiting increased traffic to cover their attacks. The data comes from Cequence’s research team, which found 100% of the top 10 travel sites were exposed to public-facing vulnerabilities. Of these companies, four had 91% of the serious vulnerabilities. Furthermore, eight of the top 10 organizations had unmonitored or unmanaged public-facing, non-production/internal application servers. One organization had more than 300. These servers could open the door for malicious actors.
The research observed a pattern: industry peak seasons often coincide with increased cyberattacks. According to the research, the peak of the hospitality industry’s season may see an increase in DNS queries and DDoS attacks. The winter travel season, which begins in October, could generate enough traffic for cybercriminals to conceal their attacks.
“Travelers are at risk during peak vacation times, with cybercriminals seizing the opportunity to strike,” said William Glazier, Director of Threat Research at Cequence. “Our research highlights severe threats, including financial loss, identity theft, and disrupted travel for consumers, and reputational damage and legal issues for businesses. Frequent attacks can undermine consumer trust in digital platforms. To mitigate these risks, organizations need to prioritize API security, while travelers should stay vigilant and practice robust cybersecurity.”
Il phishing è una delle minacce informatiche più diffuse e pericolose che colpiscono utenti e aziende di tutto il mondo. Perché abbia successo, i criminali informatici creano copie perfette di siti web legittimi, inducendo le vittime a credere di trovarsi di fronte a una comunicazione autentica.
Nonostante la crescente consapevolezza e le campagne di sensibilizzazione, le tecniche si fanno sempre più sofisticate, il che spiega perché il phishing continui a mietere vittime, con danni economici e reputazionali importanti.
I giganti del web sono tra i bersagli principali di questi attacchi e, secondo un nuovo studio condotto da Kaspersky su 25 aziende globali di grande rilievo, nel 2024 Google, Facebook e Amazon sono stati i brand più frequentemente presi di mira da attacchi di phishing.
Nel 2024 l’incremento di attacchi è stato infatti quasi 1,5 volte superiore rispetto all’anno precedente.
La ricerca ha evidenziato che nella prima metà di quest’anno gli utenti di tutto il mondo hanno tentato di accedere a risorse false che imitavano questi brand quasi 26 milioni di volte, un aumento di quasi il 40% rispetto allo stesso periodo del 2023.
Gli esperti di Kaspersky attribuiscono questo forte aumento a una maggiore aggressività dei criminali informatici piuttosto che a una diminuzione della vigilanza degli utenti.
Secondo uno studio condotto da Kaspersky, Google, Facebook e Amazon sono stati i brand più frequentemente presi di mira da attacchi di phishing nel 2024.
Tra i brand analizzati, Google è risultato il più colpito, con oltre 4 milioni di tentativi di phishing bloccati dalle soluzioni di Kaspersky. Seguono Facebook, con circa 3,7 milioni di tentativi, e Amazon con circa 3 milioni.
Microsoft e DHL completano la top five con rispettivamente 2,8 e 2,6 milioni di tentativi. Altri brand come PayPal, Mastercard, Apple, Netflix e Instagram sono anch’essi tra i primi 10 obiettivi preferiti dai cybercriminali per il furto di credenziali e denaro nel 2024.
Gli attacchi contro Google sono aumentati del 243% nella prima metà del 2024 rispetto allo stesso periodo dell’anno precedente, facendo di Google uno degli obiettivi principali per i phisher. Mastercard ha registrato un incremento del 210% dei tentativi di furto di dati sensibili e denaro, seguita da Facebook e Netflix, entrambi con un raddoppio degli attacchi.
Olga Svistunova, esperta di sicurezza di Kaspersky, ha spiegato che il phishing contro Google è particolarmente preoccupante perché, ottenendo l’accesso a un account Gmail, i criminali possono accedere a una vasta gamma di altri servizi, rendendo Google un obiettivo privilegiato.
Il phishing contro Mastercard, d’altra parte, è aumentato in concomitanza con la proliferazione di falsi negozi online che simulano la vendita di beni e accettano pagamenti con presunte carte Mastercard.
Nonostante l’incremento generale, alcuni brand hanno registrato un calo nei clic sulle risorse di phishing. Microsoft, ad esempio, ha visto diminuire l’incidenza di questi attacchi, probabilmente grazie a una maggiore consapevolezza nelle organizzazioni. Anche DHL ha registrato un calo simile, un fenomeno osservato tra diversi brand nel settore trasporti e logistica.
Altri brand, pur non rientrando nella top 10, hanno visto crescere grandemente gli attacchi. HSBC, ad esempio, ha registrato un aumento di otto volte fino a 240.000 tentativi di phishing, ed eBay ha visto triplicare gli attacchi, superando i 300.000 casi. Airbnb, American Express e LinkedIn hanno registrato aumenti rispettivamente del 174%, 137% e 122%.
Per le aziende, è fondamentale identificare tempestivamente se il proprio brand sia stato preso di mira dai phisher. Kaspersky consiglia di monitorare regolarmente la presenza online del brand, informare i clienti sui canali ufficiali e segnalare tempestivamente alle autorità eventuali tentativi di phishing.
Queste misure, unite a una costante sensibilizzazione dei propri utenti, possono contribuire a ridurre l’efficacia di questi attacchi e a proteggere meglio i dati sensibili. L’industria della cybersicurezza deve dunque continuare a evolversi e a innovare per fronteggiare una minaccia che non mostra segni di rallentamento, mantenendo alta la guardia contro un nemico invisibile ma estremamente pericoloso.
Il NIST (National Institute of Standards and Technology), l’organizzazione nazionale statunitense per gli standard, ha recentemente pubblicato tre nuovi standard di algoritmi (ML-KEM, ML-DSA, SLH-DSA) che rappresentano un passo cruciale verso la migrazione globale alla PQC, acronimo di Post-Quantum Cryptography” (ossia, crittografia post-quantistica).
In risposta a questo importante sviluppo, il National Cyber Security Centre (NCSC) del Regno Unito ha aggiornato il proprio white paper sulla PQC, mantenendo invariate le linee guida tecniche principali ma offrendo nuove indicazioni per aiutare le organizzazioni a comprendere i prossimi passi da intraprendere.
Standardizzazione e oltre: i primi passi della migrazione
La standardizzazione degli algoritmi è solo l’inizio di un percorso lungo e complesso per la comunità crittografica internazionale. La piena migrazione alla PQC richiederà diversi anni e, per alcuni settori, potrebbe estendersi per oltre un decennio. Tuttavia, la portata di questo cambiamento rende fondamentale iniziare fin da subito i lavori preparatori.
Le aziende più grandi, soprattutto quelle che utilizzano tecnologie operative o IT personalizzate, devono cominciare a pianificare la transizione. Il primo passo consiste in una “scoperta iniziale” che include l’analisi dei dati aziendali, la valutazione del loro valore, la durata della loro rilevanza e la comprensione dei sistemi su cui sono conservati.
È essenziale identificare dove viene utilizzata la crittografia a chiave pubblica e valutare come le catene di fornitura stiano affrontando la migrazione alla PQC. Le priorità dovranno concentrarsi sui sistemi che trattano dati con un alto valore a lungo termine e su quelli che presentano difficoltà di aggiornamento, come hardware longevi o complessi da sostituire.
La piena migrazione alla PQC richiederà diversi anni e, per alcuni settori, potrebbe estendersi per oltre un decennio.
Il ruolo del NCSC nella transizione alla PQC
Per facilitare questa transizione, l’NCSC sta mettendo in atto una serie di iniziative mirate a supportare le organizzazioni nella pianificazione e nell’esecuzione della migrazione alla PQC.
Il NCSC collaborerà con i regolatori per definire linee guida e politiche adeguate, coinvolgendo i principali enti industriali per comprendere le sfide specifiche di ciascun settore. Particolare attenzione sarà rivolta a settori come finanza e telecomunicazioni, che hanno già ragionato sull’integrazione della PQC nelle loro reti complesse.
Inoltre, sempre nel Regno Unito l’NCSC lavorerà con l’Ufficio del Gabinetto e il DSIT (Department for Science, Innovation and Technology) per determinare le politiche di migrazione per i diversi dipartimenti governativi, fornendo consulenze su misura, soprattutto in ambiti legati alla sicurezza nazionale. Nei prossimi mesi, l’NCSC collaborerà con alcuni dipartimenti per sviluppare piani di migrazione completi che potranno essere adottati anche da altre entità.
Per quanto riguarda il supporto alle organizzazioni private, l’NCSC intende promuovere la consulenza specializzata nel campo della PQC, garantendo che le aziende possano accedere a competenze adeguate per affrontare la transizione. A lungo termine, verranno accreditati consulenti e consulenze idonee, ma nel breve termine il focus sarà sulla creazione di reti che permettano alle organizzazioni di connettersi con gli esperti di cui hanno bisogno.
La transizione alla crittografia post-quantistica rappresenta una sfida senza precedenti per la sicurezza informatica. Le aziende devono iniziare ora a pianificare e prepararsi, adottando un approccio strategico che tenga conto delle loro specifiche esigenze e delle peculiarità del loro settore.
How IT leaders can balance software needs with limited budgets
Compared to previous years, IT SaaS app usage and spending are up in 2024. IT teams showed the highest average SaaS portfolio growth for 2 years running while spending is expected to grow by 15-20% annually, according to a recent report from Gartner. However, IT leaders should not expect their budgets to increase to meet this demand. In reality, most IT teams are juggling tight budgets due to a shaky economy and the challenges faced by the tech sector.
So how can IT leaders effectively balance budget constraints with the ever-growing need for software applications, and make the right choices for their organization? To navigate these challenges and effectively manage SaaS portfolios within tightened IT budgets, IT leaders need to consider three key aspects: identifying friction points, analyzing usage patterns and making strategic investment decisions. By focusing on these areas, IT leaders can ensure that their software investments align with the organization’s needs and provide the best possible value.
Applications that remove friction
Each application has a different use case and addresses different employee concerns. So how do IT leaders figure out what app is best? They can start by looking at unknown and known points of friction for employees.
For engineers, tooling plays a huge role in their day-to-day tasks and ability to get things done. If IT leaders know that help tickets get bottlenecked because engineers aren’t able to easily prioritize them, investing in software that can remove that blocker will benefit the organization as a whole.
In some cases, employees will opt for outside applications — resulting in shadow IT — use because the applications solve a friction point for them. When asking someone what video meeting platform they like most, they likely have a strong answer and reasons to back up why they prefer it (or why they don’t). However, purchasing a license for everyone’s personal preference simply doesn’t make sense financially.
To assess preferred software applications, evaluating usage is a good way to understand what applications are providing the most value. If an application is being underutilized, there is likely a good reason that IT leaders should account for.
Worst performers and top shadow IT applications
For IT leaders looking to solve employee needs but not sure where to start, shadow IT is a friend. In 2023, 48% of software applications were categorized as shadow IT, nearly half of an organization’s SaaS portfolio. Evaluating which app licenses are going unused and which unlicensed apps are affecting the tech stack can help IT leaders understand the high-level needs and desires of their employees. Back to the video platform example: if an organization has licenses for one but a competing platform is showing higher levels of usage through shadow IT, it’s worth considering a license switch.
Getting the best bang for the buck
Arguably one of the most important aspects of fulfilling software needs with a tightened IT budget: is there a positive return on investment, and is the company paying a fair price?
When it comes to SaaS procurement and renewing licenses, leaders often fall victim to quick renewals rather than truly assessing price and competitors — some of which might be more cost-effective. There’s a strong chance that an uninformed renewal results in a higher cost and lower ROI. Removing auto-renewals and looking at data regularly can reduce the chances of overpaying for software that isn’t being used or is too costly.
Navigating IT budget constraints while meeting the organization’s software needs requires a strategic approach. IT leaders must focus on identifying friction points, analyzing usage patterns and making strategic investment decisions. Balancing limited budgets with software requirements is indeed a challenge, but by adopting a proactive and data-driven approach, IT leaders can optimize their SaaS portfolios and maximize value, both financially and tactically, for their organizations.
Cyberattacks on critical infrastructure increased by 30% in one year
A new report from KnowBe4 highlights the rising threat of cyber incidents against critical infrastructure. The report discovered that cyberattacks against critical infrastructure have risen by 30% since 2022, representing more than 420 million attacks between January 2023 and 2024. This is equivalent to 13 attacks each second.
Across the globe, the average number of cyber incidents per week is growing. This number has quadrupled since 2020, doubling in 2023 alone. Furthermore, vulnerable points in the United States power grids are growing in number. The report found approximately 60 vulnerable points are appearing each day, increasing the total count from from 21,000 in 2022 to around 23,000-24,000 currently.
“The findings in our report are a wake-up call for critical infrastructure sectors,” says Stu Sjouwerman, CEO at KnowBe4. “While the surge in cyberattacks on them is deeply concerning, it’s important to remember that we’re not powerless in this fight. By fostering a strong security culture that combines technology, processes, and people, we can significantly mitigate these risks. Every organization, regardless of size or sector, has a role to play in safeguarding our collective infrastructure. It’s time we view cybersecurity not as just an IT issue, but as a fundamental aspect of our operational resilience and national security.”
Con l’aumento dell’uso delle applicazioni SaaS, i rischi di cybersicurezza crescono: la dipendenza dalle vulnerabilità di terze parti e la mancanza di consapevolezza del Modello di Responsabilità Condivisa sono le criticità principali che mettono in pericolo le aziende e i loro dati. A dirlo è il report “The State of SaaS Resilience in 2024” di HYCU, il quale evidenzia che le applicazioni SaaS sono state la causa di attacco per il 61% delle violazioni ransomware segnalate.
“Oggi un’azienda media si affida a centinaia di applicazioni SaaS per una serie di attività, compresi i flussi di lavoro critici per l’azienda. Capire quanto i dati SaaS siano vulnerabili alle crescenti minacce informatiche è fondamentale” ha dichiarato Subbiah Sundaram, SVP Product di HYCU.
L’analisi riporta che i responsabili IT non conoscono ancora il numero esatto di applicazioni SaaS in uso nella propria organizzazione, con la maggior parte degli intervistati che stima di utilizzarne dodici. La ricerca mostra però che, in media, le aziende di medie dimensioni usano oltre 200 applicazioni di questo tipo. Vista la diffusione delle applicazioni SaaS, le lacune segnalate stanno diventando una delle sfide più importanti da affrontare per le imprese.
Dal report emerge infatti che il 41% degli intervistati si affida a vendor di servizi SaaS per la protezione e il ripristino dei dati, ma i vendor o gli ISV attribuiscono la responsabilità di queste attività al cliente, secondo il Modello di Responsabilità Condivisa.
Il 90% delle imprese coinvolte ha inoltre dichiarato di non essere in grado di recuperare i dati crittografati dagli ambienti SaaS entro un’ora e il 43% afferma di non avere personale con le competenze necessarie per proteggere i dati delle applicazioni SaaS.
“Questo nuovo rapporto di HYCU illustra la necessità per le aziende di migliorare la protezione dei dati in ambiente SaaS. In qualità di leader in questo settore, HCYU è pronta ad aiutare le aziende a colmare le lacune che minacciano la propria resilienza, fornendo soluzioni di backup e ripristino aziendali specificamente progettate per gli attuali ambienti basati sulle applicazioni SaaS” ha concluso Sundaram.
Security leaders respond to the Halliburton cyberattack
Halliburton, one of the most prominent oilfield service companies, was the subject of a recent cyberattack. The company states that on August 21, 2024, it became aware of unauthorized users accessing parts of its system. Currently, the nature of the attack is unclear.
Security leaders weigh in
Richard Caralli, Senior Cybersecurity Advisor at Axio:
“The Halliburton breach highlights a critical truth: many ransomware attacks exploit basic oversights rather than sophisticated techniques. While the specifics of the attack are still unclear, it’s likely that this wasn’t a highly complex operation. Much like the incidents at Colonial Pipeline, Caesars, MGM and Clorox, the attackers may have taken advantage of simple, preventable errors — gaps in fundamental cybersecurity practices that were either inadequately implemented or not maintained over time.
“These attacks don’t necessarily involve advanced technology; rather, they often succeed because of lapses in basic security measures. Mistakes, misconfigurations and a lack of ongoing evaluation create vulnerabilities that can be easily exploited.
“The takeaway from Halliburton’s experience is that organizations need to focus on consistently applying and maintaining the fundamentals of cybersecurity. It’s not always about defending against the most sophisticated threats, but ensuring that the basics are solid. This breach serves as a reminder that attention to core practices is essential in safeguarding against attacks. Maintaining these fundamentals is crucial to building resilience and reducing the risk of becoming the next target.”
Mr. Venky Raju, Field CTO at ColorTokens:
“Nation state actors have already demonstrated their ability to penetrate and attack critical infrastructure systems in the United States. So far it has been restricted to small utilities like the water supply system in Muleshoe, Texas, etc. We will soon know if the Halliburton attack is an escalation by one of these groups, or an attack on their IT networks by a different actor.
“Regardless, utilities and other critical infrastructure organizations should take immediate steps to prevent unauthorized remote access to IT and OT networks, and implement microsegmentation controls inside networks to limit lateral movement. The latter is even more urgent as the adversaries may have already planted backdoors by using undetected zero day exploits.
“Tools like Shodan and smap make it very easy even for amateur hacking groups to discover unprotected OT devices and exploit known vulnerabilities. Organizations should audit all their Internet-accessible devices to ensure that remote access is limited to authorized users and undiscoverable by search agents.”
Donovan Tindill, Senior Director of OT Security at DeNexus:
“Following this incident (and depending on the scope of the attack), Halliburton and its many divisions could be expected to experience severe business interruption with internal staff productivity degraded, access to information and networks revoked out of caution, and large portions of both internal and external facing staff idled. In contrast, cyber incident response teams contain and eradicate the threat. Idled or severely degraded employee and subcontractor productivity during the cyber incident is potentially the best-case loss scenario.
“Cyber risk management, which typically includes cyber quantification, should be employed to understand potential financial losses to make better cybersecurity investment decisions that directly connect investments to the loss reduction ROI they provide.”
Chris Patteson, Director of Account Management at DeNexus:
“Attacks on asset heavy industrial platforms operators and critical infrastructure are going to continue to be a focus of adversaries due to the value at risk. The welcome change we are seeing is that organizations are more actively transparent, and this allows peers to assess their environments as well when activity picks up.”
Marcus Fowler, CEO of Darktrace Federal:
“Critical infrastructure providers and manufacturing companies are increasingly pursuing IT and OT convergence as the data collection and analysis benefits can dramatically improve production efficiency, maintenance and scaling. However, as OT security struggles between legacy systems and the expanding wave of IT and OT interconnectivity within their environments, the risk of cyber-physical attacks continues to grow.
“With IT/OT convergence expanding attack surfaces, security personnel have increased workloads that make it difficult to keep pace with threats and vulnerabilities. Many organizations rely on Indicator of Compromises (IOCs) for threat detection which often miss insider threats and novel attacks because the tactics, techniques and procedures (TTPs) and attack toolkits have never been seen in practice. Anomaly-based detection is best suited to combat these types of threats. Thus, the adoption of AI-powered solutions that focus on anomalous behaviors to identify novel threats, can respond at machine speed, and help to guide recovery from cyber incidents in industrial systems is paramount for keeping critical infrastructure safe.
“Organizations with OT have historically been hesitant to adopt machine-driven response out of concerns for a misfired response disrupting critical processes. However, AI can be used to execute highly targeted and precise response mechanisms. Organizations should assess their own cyber-physical environments and perform their own risk calculations to see where it is appropriate to integrate machine-driven response, either in autonomous or human-in-the loop modes, to accelerate security team response and protect against cyber-physical attacks.”
Mark Manglicmot, Senior Vice President of Security Services at Arctic Wolf:
“Critical Infrastructure is the lifeblood of a functioning economy and society, and threat actors realize that they can inflict a maximum amount of chaos and extortion by targeting sectors like oil & gas that provide essential services to thousands of businesses and communities. Earlier this year, the Office of the Director National Intelligence and FBI Director Chris Wray warned congress that U.S. critical infrastructure is a prime target for nation-state-backed threat actors, and attacks on organizations like Halliburton should serve as a warning sign that defending critical infrastructure must be a top priority, especially leading up to the presidential election.”
