OccamSec’s Post

🔒🌊 The Rising Tide of Water Utility Cyber Threats: How Dragos Shields Water Systems According to a newly released, "Dragos Water and Wastewater Threat Perspective," nearly 60 percent of identified high-severity vulnerabilities in OT systems used by the water and wastewater sector are related to controller assets, including programmable logic controllers (PLCs) and variable frequency drives (VFDs). Over 90 percent of identified vulnerabilities in WWS IT systems are related to connectivity devices and systems such as virtual private networks (VPNs) and remote administration tools. Our case study with a leading water utility showcases how embracing the Dragos Platform has revolutionized their cybersecurity posture, from asset management to incident response, to safeguard against these evolving threats. 🔗 Explore the blog and case study: https://hubs.la/Q02vRTMW0 #icscybersecurity #otcybersecurity #industrialcybesecurity #waterutilities #wastewater

It's essential to see organizations like the Cybersecurity and Infrastructure Security Agency (CISA) actively addressing security concerns in the realm of Industrial Control Systems (ICS). These six advisories shed light on specific vulnerabilities and potential threats associated with various ICS components, including power control software and communication units. In today's interconnected world, where critical infrastructure relies heavily on ICS, staying informed about these security issues is paramount. These advisories provide valuable technical information and recommended mitigations, empowering users and administrators to take proactive steps in safeguarding their systems. The proactive approach by CISA in releasing these advisories underscores the importance of cybersecurity in maintaining the resilience and security of our industrial sectors. It's a collective effort to ensure the protection of critical infrastructure and prevent potential cyber incidents with far-reaching consequences. 💻🔒 #ics #cybersecurity #cisa #criticalinfrastructure #securityinnovation #cyberresilience #proactiveapproach #vulnerabilitymanagement #threatintelligence #safeguarding

Interesting dive into protecting OT - with vulnerabilities popping up across OEMs - what can be done to secure our civilization's critical OT assets? - Evaluate your organization's attack surface area - Consider the risk of attack, and potential collateral damage - Pen test existing network security - Create an action plan to mitigate risk

As per a whitepaper from SANS Institute, five cybersecurity controls have been recommended for an efficient and effective industrial control system (ICS) or operational technology (OT) security program. The controls are designed to prevent compromises using approaches such as endpoint protection, hardening of devices, passwords, access management, and patching. Embracing the ICS Critical Controls ensures a well-rounded strategy that's both proactive and reactive, fortifying your defenses against evolving threats! 1️⃣ ICS Incident Response 2️⃣ Defensive Architecture 3️⃣ ICS Network Visibility Monitoring 4️⃣ Secure Remote Access 5️⃣ Risk-Based Vulnerability Management #cybersecurity #icssecurity #otsecurity #CriticalControls #endpointprotection #hardening #accessmanagement #patching #securitystrategy #prevention #detection #response #industrialautomation #nistframework #vulnerabilities #protect #sansinstitute

As we navigate the complex landscape of cybersecurity standards for critical infrastructure, the importance of IEC 62443 and the guidance provided by CIP-013 for manufacturer selection cannot be overstated. IEC 62443 offers a robust framework for addressing and mitigating security vulnerabilities in industrial automation and control systems, ensuring that organizations can protect their critical infrastructure from evolving threats. Similarly, CIP-013 provides essential guidelines for managing supply chain risk in the electric utility sector, emphasizing the need for stringent security controls when selecting manufacturers. At Commend, we are committed to adhering to these standards, ensuring that our enterprise-level communication platforms meet the highest security requirements. Our dedication to delivering secure, reliable, and scalable solutions makes us the ideal partner for organizations seeking to safeguard their operations. With our expertise and focus on compliance, Commend stands out as the right choice for those prioritizing security and resilience in communication systems. #Cybersecurity #IEC62443 #CIP-013 #Commend #SecuritySolutions

Reading this post from Tony leads me to feel like this should be a panel for discussion -- I think "CyberSecure/Cypersecurity" has turned into another "power sales term" -- having cybersecurity is subjective. The definition of those power sales terms that trend over time, such as "AI", "Cloud", "Analytics" vary, and in sales worlds its often a word that is targeted at "whatever cost". in example, management says "Our products will have AI by next quarter" so the organization bends the definition of the word so they can say their product has it. I'm starting to see the same with the cybersecurity term, which intentionally is very wide impacting. Not everyone will define the term the same, and those folks that say cybersecurity isn't a concern, might be saying so because they have "mitigated" the risks in other aspects than a specifics product manufacturers interpretation of being cybersecurity focused.. It's a conversation we should all be having. Lets partner up and have this as a topic and invite some of our peers. No two organizations will adopt the same exact posture, each will be customized/tendered specific to the organization and their operations.

🔒 Boost OT Security with the NIST Guide! 🔒 Unlock the secrets to securing your Operational Technology (OT) with the NIST Special Publication. From industrial systems to building automation, get expert guidance on safeguarding your tech against threats and vulnerabilities. 🛡️💡 Dive into practical security countermeasures and strategies tailored for the unique needs of OT systems. Ready for a secure and efficient OT environment? 👉 Grab Your Guide Now: https://ow.ly/MhYL50R7mtm #WeAreExclusive #OTSecurity

https://lnkd.in/dmj7Tcgk #Cyberattacks on Danish CII sector - a detailed report by SektorCERT - includes recommendations. #SecuringThings #cii #criticalinfrastructure #cyberattacks #cybersecurity #cybersecurityawareness #cyberrisk #energysector #icscybersecurity

It's crucial to follow a structured framework for industrial patch management. Adopting strategies based on IEC 62443-2-3 and DHS guidelines provides an excellent foundation for an effective patch management strategy.

The importance of Cyber Security adding to physical security cannot be overestimated! Make sure to operate Best Practices and to look for suppliers with a credible Cyber Security strategy: trust.commend.com.