by Virgil Renz | Sep 28, 2021 | Operational Technology
The convergence of IT/OT is upon us, bringing new challenges for both the IT and OT units to navigate. Traditionally, operational technology has been managed by site engineers with a focus on reliability and safety. But now, as OT systems are becoming more connected, it’s imperative that these two worlds begin to operate as one.
Threats to the Combined IT/OT Environment
More and more, we’re seeing attackers begin to exploit vulnerabilities across the IT/OT infrastructures, often with devastating results. This combined cyber-physical world represents a high-risk, high-reward scenario for attackers, and their targets often have no choice but to comply with attacker demands to prevent a catastrophic hit to finances or worse, endangering the lives of plant workers and the communities they serve.
We saw this play out most recently with the Colonial Pipeline attack. The Colonial Pipeline provides nearly half of the fuel for the east coast of the United States, transporting 100 million gallons of fuel a day. A ransomware attack in their IT environment put their OT security at risk. The company proactively shut down operations to prevent further spread, resulting in fuel shortages and disruption of fuel markets. The company ultimately paid the equivalent of a $5 million ransom in bitcoin to regain control of their systems, and we also know now that attackers were able to steal 100 gigabytes of company data while inside the network.
In the case of the Colonial Pipeline, the impacts were primarily financial. However, it’s important to understand the physical impacts that can occur when IT/OT systems are attacked. Take for example the attack on a German steel mill in 2014, where a spearphishing attack resulted in the compromise of industrial components that prevented a blast furnace from properly shutting down. These furnaces contain molten metal heated to thousands of degrees, and any malfunctions pose a serious risk to workers. Luckily, the only damage was to the mill itself. And while at the time the recommended prevention mechanism was to keep IT and OT networks completely separated, we know that given all the benefits of connected OT systems, that is just not practical. Therefore, it’s imperative to understand how IT and OT systems interact and how to balance secure operation of both.
Understanding the IT/OT Overlap
These IT/OT attacks are possible because IT and OT environments have begun to overlap as we trend toward OT hyperconnectivity. Hyperconnectivity comes with numerous benefits, especially when it comes to efficiency improvements and cost reductions. But the introduction of IT systems into the OT environment exposes once isolated systems and equipment to new threats. Now, a vulnerability in the IT environment could be exploited to attack an OT environment and vice versa.
Let’s take a closer look at where this overlap occurs. I like to think of the converged IT/OT environment in terms of four layers.
Layer 1 – The Control Level
Starting at the bottom, Layer 1, you have the Control Level for the OT environment. These are the in-the-field machines, the process sensors, engine controls, etc. Supported protocols at this level are extremely diverse and often proprietary making it difficult to standardize any kind of security.
Layer 2 – The Process Management Level
Layer 2 is where the IT/OT overlap begins. The Process Management Level is what allows OT engineers to manage productivity and operations in the OT environment, including SCADA supervisory control and data acquisition. This is the level that benefits from OT hyperconnectivity, leveraging new software and applications for cost and efficiency improvements.
Layer 3 – The Operations Management Level
Layer 3 is responsible for how the company as a whole is managed through the manufacturing execution system. Typically, this system is owned by the IT department.
Layer 4 – The Enterprise Level
Finally, at Layer 4, the Enterprise Level, is where company software, like ERPs that handle shipping and invoicing, as well as employee devices, email access, and cloud apps and storage all live. The protocols at Levels 3 and 4 are much more standardized and are designed with both interoperability and security in mind.
Exploiting the IT/OT Overlap – Two Real-World Examples
There are numerous attacks that have successfully exploited vulnerabilities in IT/OT systems—the 2017 attack on Ukraine’s power grid, the 2020 ransomware attack on U.S. pipeline operations, and the repeated attacks on Israeli water facilities in 2020 just to name a few. Because of the nature of OT environments, these attacks can have severe impacts on productivity, revenue, and, in some cases, the safety of employees and the communities they serve.
To better understand how an attacker can exploit the IT/OT overlap, let’s take a closer look at two such attacks—one that moved from the top-down and one from the bottom-up.
Dragonfly 2.0 – IT to OT Attack on the Energy Sector
Between 2015 and 2017, the Dragonfly group levied a series of attacks targeting the energy sector in the United States, Switzerland, and Turkey. This attack leveraged vulnerabilities across the layers of the IT and OT environments, beginning with spearshiphing and watering hole attacks at the Layer 4 – The Enterprise Level. These are traditional IT attack vectors that could have been prevented with traditional IT security measures.
Then, the attack introduced Trojan software in the form of OT software at Layer 2 – The Process Management Level, which provided access to the OT environment. At this point, Dragonfly was able to perform intelligence gathering in the OT environment in order to sabotage Layer 1 – The Control Level.
Stuxnet – OT to IT Attack on Iran’s Uranium Enrichment Program
In this second example, the IT/OT attack entered through the OT environment. Stuxnet, a malicious computer worm discovered in 2010, began as a pure OT attack with an infected USB device being installed on a computer at the Process Management Level (Layer 2). The worm was able to spread through that computer to two, three and ultimately thousands of other machines (Layer 4) until it reached the systems responsible for controlling the centrifuges to ultimately disrupt the centrifuge equipment at the uranium enrichment facilities (Layer 1).
Overcoming the Challenges of IT/OT Security
As demonstrated in the examples above, the convergence of IT/OT security has lagged behind the convergence of IT/OT infrastructures. This lag can be attributed to key differences in how OT systems operate compared to IT systems, including:
- Legacy assets and processes are difficult to update to account for today’s connectivity.
- Prioritization of availability and safety over security keeps maintenance windows small or non-existent.
- Geographically dispersed environments make it difficult to centrally manage security.
These differences mean closing the IT/OT security gap is not as simple as porting over IT security principles into the OT environment. Instead, CISOs must create a holistic security program that addresses IT and OT needs. To begin this journey, we recommend, at a high level, these four important steps.
- Define the OT security strategy and governance. Who will be responsible for which parts of the security program? IT or OT?
- Assess OT security risks. What is the impact of a ransomware attack? Data theft? Threats to process integrity?
- Enable communication between OT and IT units. Hold a joint workshop or offsite to share experiences, get to know each other, and understand terminologies, and priorities.
- Turn it into a win-win for IT and OT. How will OT benefit from the security program? What will the impact be to reliability, control, and visibility?
This article summarizes material from a presentation, “Overcoming Industrial Security Challenges,” held during Kudelski Security’s European Cyber Summit held in February 2021. For more information about how you can secure your IT/OT environment, visit https://www.kudelskisecurity.com/secure-ot-ics-networks/.
by Virgil Renz | Apr 26, 2021 | Operational Technology
Hyperconnectivity of OT, ICS and SCADA environments has created an overlap between IT and OT environments, exposing formerly segmented systems to much wider attack surfaces. CISOs operating in newly or soon-to-be converged IT/OT environments, therefore, have a new charge — to integrate OT security into their existing security programs.
It’s critical, however, that security leaders think of this as one, holistic security program. Attackers have already begun to exploit the overlap between IT and OT systems , leveraging vulnerabilities in IT systems to reach critical OT systems and OT vulnerabilities to reach IT systems. The impact of such an attack has significant ramifications beyond exposure of sensitive information and customer data. It could result in financial losses due to production stopping and, even more damaging, could put the public at risk if, for example, water or energy supplies are compromised.
This post, which summarizes the session “Overcoming Industrial Security Challenges” from the 2021 European Cyber Summit , will provide CISOs with a roadmap for developing a holistic IT/OT security strategy that addresses the needs of each environment without negatively impacting processes and productivity.
The Impact of IT/OT Convergence on the Security Strategy
In the IT world, we’re already very familiar with the idea of hyperconnectivity and the protections required to enable business processes without compromising security. Because of this, it may be tempting to simply port these IT security practices into OT environments . This would be misguided, however, because OT environments are fundamentally different than IT environments and therefore require a much different approach to security.
OT environments are complex and specific. In other words, no two power plants, manufacturing plants, water treatment facilities, etc. are going to be the same. These environments will use proprietary hardware and software that is designed to enable very specific functions. This is somewhat of a double-edged sword when it comes to security. The more complex and specific the environment, the harder it is to attack. But it also makes it more difficult to secure. There will not be a one-size-fits all approach to OT security.
OT environments prioritize productivity and availability. Everything in the OT environment has been done in a way to enable process and assure productivity. Plants will run 24×7, which results in small and infrequent maintenance windows and limits the ability to apply updates or patch vulnerabilities. The security strategy will therefore have to account for the change-averse nature of the OT environment.
Devices in the OT environment have weak intrinsic protection levels. Until recently, devices in the OT environment were completely isolated and segmented from the outside world. Therefore, they had no need to be designed with network security in mind, and in many cases they cannot be updated without re-validating the entire system. Replacing OT infrastructure with IT systems or implementing IIoT connectivity and remote vendor access have broadened the attack surface, and because the platforms are not well protected, an attacker could take advantage of those intrinsic vulnerabilities.
How to Start the IT/OT Security Journey
Define the strategy.
During this initial step, the goal is to define how to run this joint effort between IT and OT. You will want to work with your OT stakeholders to establish what assets the security program will need to protect and who will be responsible for each aspect of the program.
It’s important to note that there is no one single strategy that will work for every IT/OT environment. It will depend on the business you are in, the current level of security maturity for processes and personnel, your risk appetite, your governance model, and your available resources (e.g. budget, staffing, 3rd party vendors).
Some of the ways we have seen customers implement their OT security strategies include:
- Delegate – Centrally define the OT security policy and goals and then delegate to the plants, including resource delegation.
- Improve Onwards – Define the OT security policy and choose a site for a proof of concept to test out security controls. Then apply that standard to every new site rather than retrofitting existing sites right away. That could perhaps be a second step.
- Big Plan – Define the OT security policy and develop a migration program for all sites. This is a huge undertaking, and the plan may need to be adapted for each site depending on the current maturity of the site.
Assess risks.
The next step is performing an assessment of OT security risks. Run through scenarios to understand what the impact of certain risks to the OT environment might be. What would happen if your systems were hit by a ransomware attack? If an attacker steals data from your OT systems or if they were able to modify your OT processes in some way?
Identifying the real threats to your business will help you narrow in on what you need to protect against as well as inform your threat monitoring, detection, and hunting activities.
Establish communication channels between OT/IT.
Traditionally IT and OT teams have not worked together because they have different objectives, reporting structures, and operational models. OT prioritizes productivity and availability where IT prioritizes the secure transmission of data. OT will report into the CTO where IT will typically report into the CIO. IT often operates using a service desk model with frequent hardware and software updates. OT is resistant to system changes because of the potential impacts to validated processes.
All of this can make it difficult to translate the importance of managing IT security risks, but there are ways to establish a common language between the two teams. Host a joint workshop or offsite for stakeholders to share their experiences and get to know each other. Facilitate knowledge sharing around the OT terminology and priorities, and find ways to connect risks such as malware — which may not inherently mean much to an OT leader — to their operational impact (e.g. interruption of a process).
Turn it into a win-win.
Finally, express the IT/OT security strategy in a way that demonstrates how OT will benefit. This is not dissimilar to early conversations security leaders had to have (and still have) with their C-suite. Better security often results in higher reliability and availability of systems. It can improve control and visibility for the environment, and it can enable OT processes.
For CISOs impacted by Industry 4.0 and the digitization of OT environments, the time to embark on the OT security journey is now. OT environments are actively targeted by direct and indirect attacks, but the good news is there are many OT security solution providers out there, including Kudelski Security, who can help you protect your converged IT/OT environment.
Learn more about the increasing importance for OT cybersecurity across all industries in our e-Book. Click here.
by Virgil Renz | Nov 3, 2020 | Operational Technology
Recent high-profile ransomware attacks on hospitals have once again demonstrated the vital importance of securing healthcare IT infrastructures. When cyberattacks have the potential to cause morbidity and even loss of life, it’s absolutely imperative to understand and mitigate vulnerabilities in the technology environment and cultivate the strongest cybersecurity posture possible.
Medical campus environments present a complex set of challenges and rapid digital transformation is pushing the boundaries. IT infrastructure is converging with operational technology (OT), which supports building management and operations, and also with IoT, which supports cameras, thermal cameras, biomedical engineering clinical devices and much more. With the expansion of the digital landscape, a rise in BYOD, and a growth in the number of workers moving outside the corporate network, the security perimeter has dissolved and the attack surface rapidly increased.
Learn more about the increasing importance for OT cybersecurity in the Healthcare Industry by downloading the ebook
Given the complexity of the cybersecurity challenges that hospitals and healthcare organizations face as IT and OT infrastructures converge, this is no easy task. Rapid digital transformation is collapsing the boundaries between IT networks and devices and technologies that were formerly separated by air gaps. These include OT underpinning building management and operations, Internet of Things (IoT) devices including thermal cameras, patient monitors and equipment trackers, as well as biomedical engineering systems supporting clinical devices. The global COVID-19 pandemic has further complicated the situation, coupling the recent expansion of the digital landscape with a great increase in work-from-home for non-essential workers and corresponding uptick in BYOD. The end result has been a swift expansion of the attack surface.
The convergence of IT and OT infrastructures is exposing healthcare IT infrastructures to the inherent vulnerabilities in these devices, some of which have little to no integrated security, and many of which are incapable of receiving firmware updates. In these environments, uptime and reliability are critical to patient care delivery models, which can make altering the clinical operational procedures to deal with potential cyberattacks a very disruptive proposition. Not all healthcare cybersecurity programs function at optimal levels of maturity, and not all have access to as many resources –budget and staffing – as they’d like.
Even as digital transformation amplifies the difficulties of securing healthcare IT systems, however, it’s still possible to make meaningful improvements that will reduce real-world risks. The key is to begin with a holistic view of your environment, balance compliance needs with actual operational readiness, and adopt a strategic approach. We’ve put together a list of the five most important tactics to pursue.
Best Practices for Securing Healthcare IT Infrastructures
Tip #1: Inventory Your Assets
Gain visibility into what’s connected to your network, including devices that aren’t considered part of traditional IT.
Understanding the security vulnerabilities that impact medical devices and networks supporting biomedical systems is difficult in and of itself. Healthcare CISOs must also consider the myriad of systems that support hospital operations outside of the clinical environment. These include everything from digital signage to heating, air conditioning and ventilation controls. They also incorporate physical security controls like badge readers and door locks. Ancillary support equipment designed to enhance patient experience, such as smart TVs, noise regulation systems and guest Wi-Fi networks, are usually present as well. Any of these connected devices might potentially have a vulnerability that an attacker could exploit.
A critical first step in improving your hospital cybersecurity posture is gaining visibility into all of these assets. How many systems and devices are connected to your network? Are any misconfigured? Is every device’s firmware up to date? Do any of them have vulnerabilities that appear on MITRE’s Common Vulnerabilities and Exposures (CVEs) list? Taking inventory allows you to recognize what might become a pivot point or threat vector exposing your broader environment.
Tip #2: Ensure Proper Network Segmentation
Operate mission-critical systems in separate network zones from those that are less essential.
Many healthcare organizations still operate relatively flat networks, leaving them vulnerable to attacks that move laterally across the environment after exploiting a vulnerability in a medical device or other operational technology (OT) system that’s inherently insecure. Medical device lifespans are typically much longer than those of IT hardware, so most older devices in use are likely to have been built before current FDA cybersecurity guidance came into force. These systems remain difficult if not impossible to secure with post-market modifications.
Putting network-level controls in place to build segmentation and enforce distinct zones for different device types should be an especially high priority for organizations lacking the budget to replace these types of devices.
Tip #3: Increase Governance
Make sure you have proper policies and procedures in place to deal with the changing threats across the cybersecurity landscape.
Increasing a healthcare organization’s cybersecurity maturity goes beyond implementing best-of-breed tools. It must also take into consideration operational and clinical processes are in line with cybersecurity best practices. It’s also paramount to identify the areas where you face the greatest risks and begin by making changes there first.
Key components of strong cybersecurity governance include:
- Developing incident response procedures. These should include detailed playbooks explaining what stakeholders will do in case of an incident or breach. Conducting tabletop exercises enhances preparedness.
- Employee education. Changes to clinical procedures are far more likely to be successful if employees understand their purpose and importance.
- Integrating compliance with broader risk management strategies. Though regulatory requirements such as GDPR, HIPAA and PCI cannot be ignored, compliance is only one facet of an overall security strategy.
Tip #4: Allocate appropriate resources for security
Without an adequate budget, you’ll encounter endless and near-insurmountable challenges.
Take a systematic approach to cybersecurity spending, prioritizing those investments that are likely to yield the best return in terms of risk reduction. Nonetheless, the operating costs involved in keeping your devices and network secure aren’t negligible. A certain minimum outlay — of money as well as effort — is required to make meaningful progress against the major cybersecurity issues in healthcare.
Tip #5: Maintain awareness of supply chains and the security posture of partners and vendors
Every connected device you bring into your environment has the potential to increase vulnerability, as does every vendor who handles your data or network.
Many medical devices, especially legacy systems, simply weren’t designed with security in mind. In addition, firmware updates intended to add features or functionality may inadvertently introduce security flaws. Keeping track of software, embedded microcontrollers and communication protocols can be challenging even for the device manufacturers themselves. For a hospital tasked with managing tens of thousands of devices, it’s a colossal undertaking.
That’s why choosing hardware that’s secure by design can result in a significant cost savings, even if device costs are initially higher. Ensuring that there’s a secure method of firmware update delivery is also important aspect when evaluating a vendor’s products. Cybersecurity needs to be engaged in vetting vendors at the procurement process.
A similar principle holds true if you’ve outsourced the management of a portion or the whole of your network to a third-party provider. If your hospital makes use of managed services, be certain you’re dealing with a quality vendor who relies on best-of-breed tooling and has a strong record for cybersecurity. It’s a good idea to include a security validation check within decision-making processes when ranking prospective providers. Be sure your MSP has the capability to effectively monitor your network in order to detect anomalous behavior quickly.
by Virgil Renz | Mar 21, 2018 | IoT
As CIO’s and CISO’s who walk the halls of healthcare institutions know all too well, the number of devices being enabled in the Internet of Things and Internet of Medical Things around us is exploding exponentially. With this explosion, complexities arise in security, data collection, storage, and especially lifecycle management. Devices have varying degrees of security and lifespans that range from two years up to 15 years, adding complications to management strategies.
Medical devices are the next perfect storm as a security threat vector and lifecycle management is now becoming predicated on risk and security vulnerabilities within the legacy device ecosystem. Hackers increasingly turn to medical technology used by providers as the next mechanism to commandeer and attack networks and hold organizations for ransom. Medical IoT devices are connected to a vast array of sensors, monitors and numerous applications making them an ideal entry point into the larger hospital networks and an easy way to propagate attacks to other systems.
The FDA started to make cybersecurity a priority in 2013 as a requirement for connected medical devices; however, due to the long development cycle of these devices and long time to get certified for use in the market, the rollout is slow. This will result in a significant lag in the introduction of connected devices that have embedded cyber threat resilience components that can thwart modern threats. This creates an incredibly complex lifecycle management challenge for healthcare technology.
Cybersecurity challenges are now becoming the primary driver for lifecycle management of medical technology. Older compromised systems present a sizeable risk to cybersecurity and leave every member of the C-Suite asking how to tackle this challenge. Often these systems have little to no update capabilities, are outside of vendor support or have been replaced with newer, better supported product lines. Vendor support for cybersecurity vulnerabilities typically takes time to create, test and patch before they can be deployed across the entire device population. As an example, an EEG monitor has a typical lifespan of 10 years. During that period security vulnerabilities will change and morph making it difficult for manufacturers to keep pace with the cybersecurity threat landscape. Even worse, securing these devices ultimately rests on the provider.
One must keep in mind that vulnerability testing is complex because of the various systems, subsystems and chipsets that are embedded in these devices. Most organizations simply do not have a $10 million budget to create a lab or staff who has the functional expertise to effectively perform hardware and software vulnerability testing with the rigor required to pass a security audit. Organizations must hire vendors who have the needed technical expertise, specialized staff and equipment in ferreting out vulnerabilities in purpose-built devices. It is not enough to perform a software scan on a device and assume it is secure.
So what approach should an organization take to lowering their risk on medical devices with varying usable lifespans and cybersecurity protections?
Evaluate Your Environment For Risk
- Identify devices that are end of life. These devices will have no updates released, which exposes them to risk. Furthermore, discovered vulnerabilities may not be announced by the company. We recommend you replace these devices with supported systems.
- Identify systems that are no longer covered by service contracts or lack current operating systems capable of being secured. This issue is similar to devices that are end of life, and should also be replaced or covered by a new service contract.
- Audit prospective vendors security, patch management and cyber-security countermeasures to ensure satisfactory risk mitigation
- Contract for penetration testing of on premise devices. It’s important to cover both the hardware and software of the device in this assessment.
- Consider WIFI, Bluetooth, SD card and proprietary RF interfaces as potential areas of compromise on devices. Ensure there are controls in place to monitor and protect devices over all communication protocols. Disable protocols that are not in use if possible.
- Create a risk profile for each device used in your environment and a risk score and then prioritize based on that risk creating a lifecycle management posture rooted in security.
Global Risk And Compliance
- Have an action plan: Create standard operating procedures for what to do when medical devices are compromised
- Create a risk framework for each device to determine what to do if a device is infected with malware or has been compromised by a hacker
- Include medical devices in your governance plan to ensure that compromises are dealt with at an appropriate level and escalation paths are included
- Ensure you have logs for each device with current firmware versions, patches, etc. and ensure you have a process and policy to perform medical device updates.
- Create Incident response plans specific to breaches involving medical devices and have a team assembled. Include retainers for breach mitigation and post-mortem cyber forensics.
By implementing and monitoring the product lifecycle, leaders, CSOs and CISOs can better plan when to introduce new operational technology in the environment. Ensuring that each of these devices will not negatively impact your operations is critical for continuity of care and allowing for the transformative delivery of healthcare services and improved patient outcomes. Implementing a lifecycle management approach to medical device refreshes rooted in a security framework will allow providers to keep pace with the rapidly evolving threat landscape that is currently plaguing the industry, while ensuring compliance and minimizing security threats and vulnerabilities in the process.
by Virgil Renz | Dec 19, 2017 | IoT
Iot Security and BotNets are a hot topic right now because of several high-profile attacks. On September 20, 2016 Brian Krebs security blog krebsonsecurity.com was the victim of such an attack. One of the largest attacks recorded exceeded 620 gigabits per second(Gbs.).[i]
After the Mirai botnet was declared the major culprit in the largest DDoS attack in history it became evidently clear that IoT was the next battleground on the front against Botnets. Striking at the core of Dyn a major domain name service company this botnet wreaked havoc in a 3-wave attack. It shut down major sites across the internet, gaming networks and other online services. “Attackers used the Mirai botnet to overwhelm Dyn’s DNS servers with a whopping 1.2 terabits per second of traffic. Dyn’s DNS servers couldn’t respond to legitimate DNS queries under the load, which rendered Dyn’s customers — including the New York Times, Reddit, Tumblr and Twitter – unreachable”[ii] As we look back through the annals of IoT breach history operational technology systems, consumer devices, medical devices and industrial control systems pose some of the highest risks to be taken over and enlisted as a zombie horde of devices just waiting to unleash havoc on networks with increasing frequency.
In February of 2017 a new threat emerged rooted in a multi-vector attack. A Windows Trojan that harbored IoT attack code was detected in the wild by malware researchers. It essentially looked-for vulnerabilities in Windows computers, infected them with a trojan horse that then scanned for vulnerable IoT devices infecting them with a variant of Mirai IoT botnet code. Why is this important? A computer infected with the trojan is sitting behind the firewall. Now it is scanning for vulnerable IoT Devices behind the firewall effectively circumventing the firewall and intrusion detection systems and taking command of the devices inside your network to launching a DDoS attack from inside your own network or worse. Now machines can orchestrate a DDoS attack using SSDP because they have already successfully bypassed the firewall and other defense mechanisms.
The challenge however is that SSDP can lead to a 30x amplification of the attack. The Windows Mirai Spreader essentially flipped the script on what we believe to be innocuous devices on our own internal networks. This invariable will gain more importance as IoT 4.0 implementations happen in buildings, cities, industrial controls and vehicle networks. As attackers grow more sophisticated in their approaches we are not beyond the realm of polymorphic IoT attacks targeting command and control server environments causing servers or devices to return adaptive malicious code which fits the specific task it has been assigned to do.
Ever increasing complexity of the delivery systems now poses an even greater threat. Imagine you are a hospital with thousands of medical devices connected to your network. Someone infects those devices and they launch an internal DDOS attack against the network. Suddenly your operational systems are shut down at a hospital crippling scheduling system, billing systems and other infrastructure and thereby causing the facility to have to shut down. It would no longer be able to schedule procedures to occur and even worse force the relocation of patients to other facilities. The potential is there for a Botnet to become the delivery mechanism for crypto lockers. Essentially ransoming medical devices, operational controls, elevators or any device within the IoT realm. The effects on facilities could be catastrophic and even potentially life threatening.
Now we are facing Reaper. It is gathering a horde of devices. It is estimated that Reaper has over 2m troops and it could grow to 3.5m or more. It is currently growing at a rate of 88k a day according to Krebs on Security. Much of Repear is built on the same foundation as the Mirai botnet which was incredibly successful. The approaches of each are different. Mirai used a known list of default passwords to compromise IoT devices and turn them into an army of DDoS troops. However, Repear appears to be much more methodical in it’s approach. It is constantly trying numerous weaknesses until it infiltrates the machine. Reapers method is faster and easier, and it can learn new vulnerabilities as it discovers them. Checkpoint believes that attacks were coming from many different countries totaling approximately 60% of corporate networks which are part of the ThreatCloud Global Network.[iii]
Although the author of Mirai was recently identified and arrested and sentenced the author of the Repear botnot is unknown. Therefore, it is better to be safe than sorry and anyone with IoT devices should investigate their safety as soon as possible. As leaders responsible for stopping threats to operational technologies, IoT systems & devices and ensuring the overall security of your network you must take steps to ensure you minimize the risks from IoT devices & Botnet attacks
Recommended steps should organizations take to secure IoT devices:
- Conduct security evaluations of all IoT hardware being used both inside and outside the firewall including testing the physical hardware for vulnerabilities, whitebox testing software, and penetration testing your IoT network and devices.
- Start at the bottom at the chip level. Cases have already shown nefarious code implanted in chips. Perform hardware penetration testing at the chip and board level.
- Limiting remote access to the devices to only administrators.
- Ensure you have strong authentication mechanisms if remote access is needed. Strong unique non-sequential passwords for devices and include a second authentication factor.
- For administrator and user services require strong authentication to systems and supporting software.
- Include logic to verify updates before any changes to the devices are made to ensure only authorized software and firmware are used.
- Utilizing an MSSP to manage security of IoT devices to better react to threats and stop any exploit before it becomes more prolific and attacks non-IoT portions of your network.
[i] KrebsOnSecurity: KrebsOnSecurity Hit With Record DDoS
[ii] Forbes Technology Council: Distributed-Denial-Of-Service Attacks And DNS
[iii] Checkpoint Research: A New IoT Botnet Storm is Coming
