La falta de Norte cuando a Ciberseguridad se trata en Perú

Perú es un país de gran diversidad de recursos naturales, y ubicado estratégicamente, lo cual hace que se tenga disponible una variedad de caminos profesionales que los egresados de las diferentes organizaciones educativas de educación secundaria pueden optar por seguir. Obviamente, la decisión de estudiar una carrera específica no solo depende de las habilidades del postulante, sino también del beneficio económico que la carrera en mención pueda brindar en el futuro, el requerimiento de la industria del país de estos profesionales, etc. 

Además de las carreras ya establecidas en el país, por ejemplo: medicina, derecho, varias ingenierías, economía, etc., existen muchas carreras que son destinadas para el futuro debido al mayor uso de la tecnología en esta época del mundo, en especial Tecnologías de la Información (TI). Pero TI, en su vasta variedad, tiene una disciplina que es muy importante en este momento, pero al parecer en Perú solo dos instituciones educativas de nivel superior del sector líder están poniendo esfuerzos para poder crear profesionales peruanos en esta disciplina, se trata de la Seguridad de la Información, estas son la Universidad ESAN (Maestría) y la Universidad Nacional de Ingeniería (UNI) (Pre-grado) [1, 2]. 

Es importante indicar que la Ciberseguridad es una disciplina de alta demanda alrededor del mundo, esto por muchos motivos, pero básicamente por el hecho de que una buena parte de las transacciones bancarias y comerciales que hacemos día a día usan sistemas electrónicos, ya sea desde la web o en el teléfono móvil [3]. Esta alta demanda, basada en el uso constante del conocimiento adquirido, actualización frecuente, y ambiente llenos de retos, hace que estos profesionales puedan trabajar desde el Perú en otros países también.

A pesar de que nuestro país ha sido víctima de diferentes ataques informáticos (inclusive las fuerzas armadas fueron objetivos de estos) en los cuales datos personales fueron extraídos ilegalmente, existe un poco o nulo interés de otras instituciones educativas en crear debidamente esta carrera profesional, además es más que decepcionante que el gobierno peruano a través de sus reguladores de las diferentes áreas de negocios no tengan regulaciones de Ciberseguridad claras y de cumplimiento obligatorio [4]. Un factor adicional es el poco o nulo interés que las empresas privadas en proteger los datos del consumidor, lo que incrementa de manera significativa el riesgo de robo de identidad que los consumidores pueden sufrir ya que no hay ninguna comunicación cuando las empresas sufren ataques informáticos con extracción ilegal de datos. 

Es esta falta de conciencia acerca de la importancia de la Ciberseguridad que no solo hace que las instituciones educativas no tengan interés en crear estas facultades, lo cual tendrá negativas consecuencias en un futuro cercano. Ahora bien no solo es el hecho de crear conciencia en el ámbito gubernamental y privado, pero también educar al ciudadano de a pie que nuestra identidad digital es más que importante en un mundo en el que los datos pronto reemplazarán de manera completa a una identidad en una tarjeta impresa.

Referencias:

1. https://www.esan.edu.pe/conexion-esan/esan-graduate-school-of-business-presenta-la-maestria-en-gestion-de-la-ciberseguridad-y-privacidad
2. https://rpp.pe/tecnologia/mas-tecnologia/uni-inaugura-carrera-de-ingenieria-de-ciberseguridad-noticia-1428538
3. https://www.isc2.org/News-and-Events/Press-Room/Posts/2022/10/20/ISC2-Research-Reveals-the-Cybersecurity-Profession-Must-Grow-by-3-4-Mil-to-Close-Workforce-Gap#:~:text=Despite%20adding%20464%2C000%20more%20cybersecurity,not%20have%20enough%20cybersecurity%20employees.
4. https://larepublica.pe/politica/gobierno/2022/10/08/hackers-en-la-dini-roban-secretos-militares-peruanos-de-ultimos-cinco-anos-guacamaya-leaks-ejercito-fuerzas-armadas
5. https://rpp.pe/tecnologia/mas-tecnologia/peru-tercer-pais-mas-ciberatacado-en-america-latina-noticia-1359003

Addressing the Cyber Security Insurance dilemma

Addressing the Cyber Security Insurance dilemma

Mainly due to the increase of ransomware attacks around the world during the last years, companies providing Cybersecurity Insurance or Cyber Risk Insurances are witnessing an increase in their products demand. 

Cisco defines Cybersecurity Insurance as: “Cyber insurance is an insurance product designed to help businesses hedge against the potentially devastating effects of cybercrimes such as malware, ransomware, distributed denial-of-service (DDoS) attacks, or any other method used to compromise a network and sensitive data. Also referred to as cyber risk insurance or cybersecurity insurance, these products are personalized to help a company mitigate specific risks.” [1]

Those organizations that are able to afford the cost of a specific Cybersecurity Insurance Policy need to understand that the Cybersecurity Insurance does not represent a holistic solution for any Cybersecurity attack they could be become victims of. 

In general terms, Cybersecurity Insurances should be a part of a well-structured Incident Response plan that organizes IT and non-IT departments across an organization including their respective senior or C-level management and aligned with a wider Business Continuity Program (BCP). While the complexity of the Incident Response Process is undeniably high, independently of the organization size, efforts should be made to have them in place and ready to go in the case of a severe attack against the organization’s IT infrastructure. Cybersecurity Insurances are the last resource in the established and practiced Incident Response Plan since it is designed to alleviate the cost of a successful attack and prevent the impacted organization to bankrupt [2]. In this regards, usual costs covered by the Cybersecurity Insurance are: investigation, crisis communication, legal services, and refund to customers [2].

Growing demand on Cybersecurity Insurances

Reportedly, ransomware attacks increased dramatically during 2021 and are still in the raise during 2022. Organizations impacted due to this type of attack are paying the ransom in order to reduce the time to obtain back their business related information, which triggers a different problem where organizations that decided to pay the ransom become again targets of a ransomware attack [3].

Moreover, the only problem is not only ransomware but the increased threat landscape due to the adoption of remote work due to the Covid 19 pandemic. Therefore, Security organizations around the world have witnessed an increase of complexity when it comes to their security strategies and the cost associated to those. 

Main function of the Cybersecurity Insurance

The main function of the Cybersecurity Insurance is to protect the organization of the cost associated with an attack that could have a considerable impact in the organizations operations. CSO indicates that “A Cyber insurance policy coverage usually includes costs related to the remediation process, such as paying for the investigation, crisis communication, legal services, and refunds to customers.” [2].

Having a Cyber Security Insurance could make me a target?

While there is no evidence that proves that malicious actors are able to obtain firsthand information of which organizations have acquired Cyber Security Insurances, there are some unscientific evidence that shows that malicious actors are more than ager to find ways to know which organizations have hired a Cyber Security Insurances and the Premium amounts of those.

Therefore, while hiring a Cyber Security Insurance could give C level executives some peace of mind, it should be accompanied by a solid security strategy and awareness.

Since Cyber Security Insurances could bring some level of last resources of protection to all size companies, it should not be understood as to have that in your Security Strategy as the only measure available against a Cyber Security attack.

Before even considering hiring Cyber Security insurance, organizations must create/review/improve their Incident Response Plans as mentioned in the beginning. Practicing that process in yearly internal drills is a good strategy to create muscle memory and be prepared when a real Security incident occurs. In addition of that, increases awareness and allow organizations to have their contact list updated. We will have more entries about Incident Response in the near future [8].

Conclusion

Cyber Security Insurances represent, if your organization is able to afford them, an additional layer where the organization could prevent bankruptcy as a consequence of a Cyber Security attack, but it should not be considered as the only available resource to handle a Cyber Security Incident.

Careful assessment is required in order to hire a Cyber Security Insurance, which might have some requirements in terms of Vulnerability Management, Security Controls, Security Operations, etc., in order to calculate the Premium.

References

[1] https://www.cisco.com/c/en/us/solutions/security/cyber-insurance/what-is-cyber-insurance.html 

[2] https://www.csoonline.com/article/3654216/is-cyber-insurance-an-invitation-to-cybercriminals.html#tk.rss_all

[3] https://www.techtarget.com/searchsecurity/news/252502519/Repeat-ransomware-attacks-hit-80-of-victims-who-paid-ransoms

[4] https://redcanary.com/blog/cyber-insurance/

[5] https://hbr.org/2021/01/cybersecurity-insurance-has-a-big-problem

[6] https://www.csoonline.com/article/3643054/cyber-insurance-explained.html#tk.rss_all

[7] https://www.darkreading.com/attacks-breaches/cyber-insurance-and-war-exclusions

[8] https://nvlpubs.nist.gov/nistpubs/specialpublications/nist.sp.800-61r2.pdf

ICS Attacks in Japan

ICS Attacks in Japan

Japan is well known internationally as a peaceful, well organized society where citizens obey the law and are compliant with rules across different governmental institutions. Spite of some internal problems like ageing society, sinking birthrate and now the economic consequences of the ongoing Covid-19 pandemic, Japan has done a great job into keeping its society under very traditional structures. Examples of how Japan is keeping parts of their society traditional is the banking system which continue using passbooks in order to allow the users to have records of their transactions, the existence of paper based processes in the governmental and private sector, the use of Hanko (a personal stamp used for personal/business/public documents), etc. In that traditional environment, the use of credit cards and other electronic payment methods have been introduced in the recent quinquennium without bumps in the road, like the loss of customer’s money to hackers from the Seven-Eleven Payment System 7Pay [1]. One of the factors that contribute to have such slow adoptions of electronic payment systems, for example, is the false sensation of security when it comes to transactions due to the image of safety society that Japan shows to the world [2].

It is also well known that Japanese organizations have been impacted due to different information security attacks during the last decade, being the ones that generated a great deal of media attention: the leaked of 12.6 million personal records in 2016, the previously mentioned 7Pay, etc. [3].

In addition to the dramatic increase in number of attacks due to the Covid-19 Pandemic, Japan has the same problem as other G7 countries, shortage of Cyber Security, which is projected to be around 193,000 professionals in 2020 and increasing due to Covid-19 is pushing companies to move their business online [4, 5, 6, 7].

With this increased in Security attacks, also attacks that are directed to Industrial Control Systems (ICS) have increased dramatically as well [8].  It is interesting to note that Japan has its own story of Security attacks against Industrial Control Systems (ICS), although not as abundant as US or Europe. The main officially reported incidents were (until 2017) [9]:

Year: 2005

Case Summary: Leak of atomic power plant’s confidential information via file sharing software.

Cause: Malware infection of an employee’s home PC storing confidential information.

Year: 2006

Case Summary: Leak of thermal power plant’s confidential information via file sharing software.

Cause: Malware infection of an employee’s home PC storing confidential information.

Recently, the attack against Honda’s factories indicates a new level of attack where the kinetic impact on the target was considerable [10]. IT related consequences of the attack payload were: employees were not able to use internal systems, inability to access servers, and inability to use email; while the kinetic impact of this attack was associated to halt operations in Honda’s factories located in Japan, UK, Turkey, USA and Italy [10, 11]. While there is no conclusions from the internal investigation on the attack, Honda had RDP accessible server facing the internet, which based on the analysis of Malwarebytes, there is clear evidence this could have been the attack vector used in order to compromise Honda’s IT infrastructure and cause economic losses as a potential collateral damage by the EKANS ransomware [12, 13].

Figure 1. Function responsible for performing DNS query [12]

Here are two important differences between the attack to Honda and the one to Enel:

While the ransom email is the same in both cases, here are two important differences between the attack to Honda and the one to Enel [12]:

Honda

Resolving internal domain: mds.honda.com

Exposed RDP: /AGL632956.jpn.mds.honda.com

Enel

Resolving internal domain: enelint.global

Exposed RDP: /IT000001429258.enelint.global

Interestingly enough, the same EKANS ransomware is also responsible for the attack against Edesur S.A., a company who belongs to Enel an Argentinian Electric Company, which could prove that Industrial Control Systems (ICS) became one of its main targets [12, 13, 14].

Additional screenshots of the RDP access to the specific Honda and ENEL publicly accessible servers can be found here: https://twitter.com/1ZRR4H/status/1270066266137559042?s=20

Conclusions:

1. Japan false sensation of secured information (which comes from the false Japanese society’s sensation of security) needs to be updated in the near future in order to improve the methods and controls used to secure information across different organizations
2. Attacks are increasing in general during the Covid-19 period, not only against company information but also against Industrial Control Systems (ICS)
3. Reasons of the Honda and Enel attacks could vary from specific business purposes to attempts to disrupt normal operations in those specific targets
4. Ransomware campaigns are still having great impact in organizations around the world, the more complex the organization is (with large number of assets) the more important is to have multi layer controls in place and a well-tested DR environment
5. As the same as Stuxnet, EKANS is the newest member of a small family of highly targeted attacks against ICS infrastructure where specific entry points or payloads strategies are embedded in the malicious code
6. EKANS differentiate itself from other ICS targeted attacks in using a more common entry points as RDP in order to deliver the malicious payload in the impacted machine/network
7. The attack against Honda represents (based on officially reported information) the first large size ICS attack against a Japanese automaker
8. Previous ICS related attacks against Japanese organizations were infections in company endpoints connected to user’s home internet connection
9. Attacks originated in not secure home network environments against not-well managed or BYOD devices will increase due to ongoing Covid-19 Pandemic and the new Working from Home (WFH) company strategy
10. Japanese organizations, of all sizes and business niches, need to see the opportunities available in their organizations to improve security methods and controls

References

[1] Another 7pay system defect left personal data of users exposed The Asahi Shimbun 

[2] Four firms with links to Japan's Defence Ministry hacked - The Straits Times

[3] 12.6 million cases of personal information leaked in Japan in 2016, survey shows - Japan Times

[4] What the Data Is Telling Us About the Current Rise in Security Threats During the COVID-19 Pandemic

[5] Cyber Security Talent Shortage in Japan - Accenture Security

[6] 71% of Security Pros See Threats Jump Since COVID-19 Outbreak - Dark Reading

[7] Addressing the Cyber Security Talent Gap - Dennis Ludena

[8] Critical infrastructure cyber attacks on the rise - EET Asia

[9] An Analysis of the Actual Status of Recent Cyberattacks on Critical Infrastructures, NEC, Matsuo Noguchi, and Hirofumi Ueda, NEC Security Research Laboratory, NEC Technical Journal, Vol. 2, 2017

[10] Honda's global operations hit by cyber-attack - BBC News

[11] ICS Threat Snake Ransomware Suspected in Honda Attack - Dark Reading

[12] Honda and Enel impacted by cyber attack suspected to be ransomware - Malwarebytes Labs

[13] EKANS Ransomware and ICS Operations - Dragos

[14] Edesur Argentina - Twitter

 

Efectos Secundarios de un ataque a Sistemas de Control Industrial (SCI)

Efectos Secundarios de un ataque a Sistemas de Control Industrial (SCI)

Las amenazas específicas que afectan la Seguridad de los Sistemas de Control Industrial (SCI) se están volviendo cada vez más frecuentes en el escenario de la Seguridad de la Información. Existen muchas diferencias entre los sistemas estándar de Tecnologías de la Información (TI) y Seguridad de los Sistemas de Control Industrial (SCI), siendo los dos más importantes la disponibilidad de los Sistemas de Control en SCI, y las consecuencias de los ataques, más de esto en el futuro. Antes de entrar en detalles, me gustaría mencionar algunos de los sectores más importantes en el espectro de SCI: Energía Nuclear, Comunicaciones, Servicios de Emergencia, Sistemas de Transporte, y Sistemas de Agua [1].

Desde el punto de vista de la disponibilidad, debido a la naturaleza de los SCI en el que los productos o procesos están configurados en un lazo, en el que debido a su ciclo continúo, los dispositivos de CSI no pueden ser detenidos en base a la necesidad. Al mismo tiempo, las consecuencias de un ataque exitoso generan una diferente sensación de urgencia comparados con los mismos en TI debido a su naturaleza cinética. En otras palabras, cuando hay un caso de datos filtrados sin autorización, las personas afectadas pueden recibir un procedimiento desde la compañía afectada para aplicar una solución temporal cambiando contraseñas, configuraciones, etc., pero los usuarios afectados directamente no sabrán exactamente como y cuando su información será usada o las consecuencias de un uso inapropiado hasta que es demasiado tarde.

En el caso de los SCI, su impacto cinético es instantáneo, dirigido (posiblemente afectando el desarrollo norma de la población de una región geográfica específica atacando una planta eléctrica y deteniendo la producción de energía) y que podría durar por semanas o meses dependiendo del nivel de destrucción causada por los ataques. En el peor de los casos, un ataque exitoso en contra de la Infraestructura de SCI puede causar las pérdidas de vidas.
Como podemos observar, el impacto cinético es la consecuencia más peligrosa de los ataques en contra de la infraestructura de SCI.

Análisis de los ataques de 2019

A pesar de que el mundo, desde la perspectiva de TI es más pequeño que nunca, los principales objetivos de actores maliciosos siguen siendo grandes corporaciones en países industrializados. Estos actores maliciosos pueden ser divididos en cinco grupos [2]:

1.      Atacantes de Estados o Naciones

Dueños de los APT, tienen personal altamente especializado y tienen la capacidad de desarrollar nuevos ataques.

2.      Ciber criminales

Individuos o grupos que realizan ciberataques para obtener un beneficio económico de ello.

3.      Hacktivists

Individuos o grupos que realizan ciberataques en objetivos por razones políticas o ideológicas.

4.      Usuarios internos

Usuarios finales, administradores de sistemas, ejecutivos, etc.

5.      Socios

Definido como empresas que proveen Servicios trabajando juntos o mediante acceso remoto con la compañía cliente.

Estos grupos están usualmente enfocados en grandes objetivos, o como se menciona anteriormente, objetivos localizados en países desarrollados, especialmente en el área de SCI donde la gran mayoría de las más grandes empresas de Energía o Industria están localizados. Por lo tanto, es muy interesante el ver países como Perú o Bolivia en la lista de los principales países con el mayor incremento en el porcentaje de computadores usados en SCI en el cual objetos peligrosos fueron bloqueados cuando los dispositivos de memoria removibles fueron conectados a estas, como se muestra en el siguiente diagrama:

Figura 1. Países y territorios con el más grande incremento en el porcentaje de computadoras en SCI en el cual objetos peligrosos fueron bloqueados cuando dispositivos de memoria fueron conectados [3, 4].

A pesar de que las estadísticas están enfocadas en computadoras usadas en ambientes de SCI, el incremento de objetos peligrosos bloqueados es una clara indicación que los ataques en SCI pueden ocurrir en el futuro, ya sea por una computadora comprometida sea conectada directamente a algún dispositivo de SCI o por un malware diseñado para usar la infraestructura de computadoras como un puente para identificar e infectar dispositivos de SCI.

La razón detrás de esta supuesto es que a pesar de que Programas de Antivirus (AV) pueden ser encontrados en entornos empresariales en América del Sur, Programas de AV son solo capaces de detectar lo que es llamado commodity malware, malware usado años atrás disponible para ser adquirido o descargado de manera gratuita, dejando la puerta abierta a amenazas más avanzadas para la Seguridad de SCI.

La implementación de controles de seguridad más avanzados o configurados en múltiples capas, especialmente en SCI en países como Bolivia o Perú es usualmente una conversación muy difícil de tener en cualquier empresa independientemente de su tamaño, básicamente por el costo asociado con estos productos, adicionalmente a estos puntos es la falta de comprensión de cómo trabaja Seguridad desde el punto de vista del ciclo de conocimiento donde inversión adicional es necesaria en entrenamiento interno y externo.

¿Por qué Bolivia y Perú?

Existen muchas razones para que actores maliciosos o atacantes, principalmente Ciber Criminales y Hacktivists, estén interesados en atacar la infraestructura de SCI en Bolivia y Perú, acá les presento algunos de estas:

1.      Economía dependiente

Países como Bolivia y Perú, así como otros países de América del Sur, debido a que las actividades económicas más productivas son la extracción y exportación de Recursos Naturales, por ejemplo,  Perú tiene importantes minas de Oro y Cobre que proporcionan estos minerales a países como China, EUA, etc., generando un porcentaje importante del presupuesto anual del país y apoyo a la habilidad del gobierno para mejorar las condiciones de vida de sus ciudadanos. Tener un impacto en este motor de generar dinero tendrá un impacto significativo en la economía del país y, por lo tanto, en sus ciudadanos.

En este caso los Ciber criminales y Hacktivists pueden ser contratados para hacer el trabajo para la organización realmente interesada en causar un efecto negativo en las economías de estos países.

2.      Efectos secundarios en otras economías

Tener un impacto importante en proveedores de materias primas como Bolivia y Perú pueden tener un impacto en sus consumidores finales, como China, Japón, EUA, etc., no permitiéndoles continuar con operaciones normales en sus fábricas lo que puede retrasar, o detener si el ataque SCI causa un impacto mayor en la infraestructura, causando un impacto diferente en su sus economías.

En este caso, como en el anterior, los Ciber criminales y Hacktivists pueden ser contratados para hacer el trabajo por la organización realmente interesada en causar el efecto negativo en los consumidores principales de la producción de estos países. En este caso en particular, los atacantes de estado o nación pueden ser parte de la estrategia de ataque.

3.      Trabajadores descontentos

Esta es una conversación común en la Seguridad de TI, pero no muy común en la Seguridad de SCI por, debido a la naturaleza de la red, es a veces difícil de identificar a un trabajador descontento. Aun así, se deben considerar las medidas necesarias, como el uso de cámaras de CCTV en puntos clave de la planta, o infraestructura de seguridad adicional y los controles aplicados entre todos los niveles en las organizaciones.

Soluciones disponibles

Como se explicó anteriormente, las empresas en Bolivia o Perú no tienen estas conversaciones, y/o no tienen el presupuesto necesario para invertir, asumiendo estos problemas específicos, aquí hay algunas soluciones disponibles:

1. Tener una discusión honesta acerca de la Seguridad de TI con las personas en sus compañías y con la gerencia. La razón detrás de la mención de Seguridad de TI es porque ésta es la puerta principal de cualquier ataque relacionado a SCI.
2. Pida a su equipo de Seguridad de TI a que realice una Evaluación de Riesgos y decida la infraestructura o sistemas críticos desde el punto de vista de TI.
3. Realice una evaluación de la condición desde su red de SCI usada en su empresa, cosas como: años de operación y esperanza de vida, capacidad de actualización, segmentación entre la Red de SCI y la Red de TI, requerimientos de gestión, etc. 
4. Reúna los resultados de su Evaluación de SCI y realice una Evaluación de Riesgo de su Infraestructura de SCI, existen diferentes métodos disponibles para este propósito (NIST 800-82, North American Electrical Reliability Council (NERC), Cyber Security Evaluation Tool o CSET, Electricity Subsector Cybersecurity Risk Management Process, etc.), decida cuál es el más adecuado para usted y aplíquelo, los resultados deben de ser sus Sistemas o Infraestructura Crítica [5, 6, 7, 8].
5. Con los resultados de la Evaluación de Riesgos, tenga una conversación con su equipo de Seguridad de TI, con su equipo de SCI y cruce referencias de los dos resultados (TI y SCI) de las dos Evaluaciones de Riesgo. El resultado debe de ser los puntos más importantes para proteger.
6. Defina la estrategia requerida desde el punto de vista de Seguridad de TI para proteger los puntos más importantes, personal requerido y presupuesto asociado.
7. Compruebe, y cree si es necesario, todas las políticas de acuerdo con reguladores locales/internacionales y reguladores específicos de la empresa.
8. Es siempre una buena idea contactar a los fabricantes de SCI y Empresas de Sistemas de Seguridad de TI para crear una Prueba de Concepto (o Proof of Concept (POC) en inglés). Los resultados de la Prueba de Concepto deben de mostrar la eficacia de los sistemas para aplicar las políticas de la Empresa, y la eficacia para mitigar los riesgos descubiertos.
9. Mapeé los resultados de la Prueba de Concepto con el presupuesto disponible. Esto puede dar una idea a Gerencia para tomar la decisión final de comprar, implementar, alquilar o subcontratar cualquier sistema.

Gastar o no gastar, ese es el dilema

Un factor útil para decidir los gastos en una Empresa es el costo asociado con un ataque. A pesar que en el caso de un ataque en contra de SCI el impacto negativo de la violación en términos de la información revelada es menor comparado con el real impacto cinético, es aun útil para explicar a Gestión como la reputación y Operaciones normales pueden ser afectados, y cuán difícil puede ser recuperarse de estos [9].

Tener a los equipos de TI y SCI trabajando juntos en los resultados de la Evaluación de Riesgos puede proveer una evaluación valiosa en el costo asociado con un ataque y dependiendo de la naturaleza de los negocios de la empresa un costo más detallado puede ser calculado. Obviamente, si existe la más pequeña posibilidad de que un ataque en contra de la Empresa puede tener como resultado la pérdida de vidas, el costo asociado pueden ir más allá del valor de la Empresa, y definitivamente ningún monto de dinero puede ser suficiente para las familias que pueden verse afectadas por esa pérdida de vidas.

Habiendo dicho esto, existen soluciones para cada presupuesto y puede tratarse de soluciones con un costo asociado o de Código Abierto, cada una con sus propias desventajas, más de estos en un post futuro. La más grande desventaja asociada con las soluciones pagas es el costo asociado es el presupuesto requerido, no solo para la solución, pero, inclusive más importante, para el entrenamiento requerido para el personal requerido que operará la solución. Siempre recuerde que las Personas son la parte más fundamental de su Personal, Procesos y Tecnología (PPT).

En el caso de las soluciones de Código Abierto, a pesar de que el costo asociado no es tan grande, usualmente el Hardware usado en la solución es el mayor costo asociado; el conocimiento asociado es el más grande impacto en el presupuesto de la Empresa. Tener a un experto en la solución de Código Abierto en la empresa puede ser costoso, además depurar y administrar una solución de Código Abierto puede no ser siempre sencillo, especialmente in ambientes de SCI, donde la disponibilidad es el rey.

Ahora, dependiendo de la estructura de la empresa, su equipo de TI puede ser subcontratado así como la empresa a cargo del mantenimiento de los dispositivos de SCI, en el caso de que no exista la pericia o habilidad requerida cuando se haga las diferentes Evaluaciones de Riesgo y se tengan las diferentes conversaciones, o cuando un Gerente de Alto Cargo requiera de un par de ojos adicionales para supervisar el proceso (lo cual no es una mala idea después de todo), en esos casos, un costo adicional puede ser el contratar una empresa de consultoría que provea la pericia o habilidad y la solución. Dependiendo de la tarea entre manos y la Empresa a ser contratada, este costo puede representar un monto significativo de presupuesto, por lo tanto, sea muy cuidadoso si desea ir por esta ruta, compruebe lo más que pueda todas las referencias e información acerca de la organización de consultoría.

Conclusión

A pesar de que es interesante ver países como Bolivia y Perú en el listado de países afectados por ataques en contra de CSI, Empresas de CSI en general deberían de tener a Seguridad como una de sus tareas prioritarias, aún más importante si un ataque puede tener un impacto cinético representado por la pérdida de vidas.

Las Evaluaciones de riesgos, desde el punto de vista de TI y SCI, son necesarios y deberían de ser analizados como grupo por ambos equipos de TI y SCI.

Gastar siempre es un problema, pero necesario para evitar indeseables consecuencias negativas, o impacto negativo, y para actuar proactivamente en contra de un posible ataque de SCI.



Referencias
[1] Critical Infrastructure Sectors, Department of Homeland Security, US -  https://www.dhs.gov/cisa/critical-infrastructure-sectors
[2] Creating a Threat Profile in your organization, SANS - https://www.sans.org/reading-room/whitepapers/threats/creating-threat-profile-organization-35492
[3] Threat landscape for industrial automation systems, H1 2019, Kaspersky - https://ics-cert.kaspersky.com/reports/2019/09/30/threat-landscape-for-industrial-automation-systems-h1-2019
[4] Infographic – ICS/OT Cyber Attacks, Galactic Security Systems - https://www.galacticsecurity.systems/
[5] Guide to Industrial Control Systems (ICS) Security, NIST - https://csrc.nist.gov/publications/detail/sp/800-82/rev-2/final
[6] North American Electric Reliability Corporation (NERC) - https://www.nerc.com/Pages/default.aspx
[7] Industrial Control Systems Assessment, CISA - https://www.us-cert.gov/ics/Assessments
[8] Electricity Subsector Cybersecurity Risk Management Process, U.S. Department of Energy - https://www.energy.gov/sites/prod/files/Cybersecurity%20Risk%20Management%20Process%20Guideline%20-%20Final%20-%20May%202012.pdf
[9] The State Of Industrial Cybersecurity 2018 - https://ics.kaspersky.com/media/2018-Kaspersky-ICS-Whitepaper.pdf

Side effects of an ICS attack

Side effects of an ICS attack

Specific threats against Industrial Control Systems (ICS) Security are becoming more frequent in the Information Security scenario. There are many differences between standard IT Security and ICS Security, being the two most important the availability of the Control System in ICS, and the attack’s consequences, more on this in a future entry. Before getting in details, I would like to mention some of the most important sectors in the ICS spectrum: Energy, Nuclear, Communications, Emergency Services, Transportation Systems, and Water Systems [1]

From the point of view of availability, due to the nature of ICS in which products or processes are configure in a loop, where due to the continuous cycle, ICS devices can’t be stopped in order to mitigate risks or attacks in an ad-hoc basis. At the same time, consequences of successful attacks generate a different sense of urgency compared to the ones in IT due to the kinetic nature. In other words, when there is a data leaked case, people affected might receive a procedure from the affected company to apply a temporally solution changing passwords, settings, etc., but affected end users will not know exactly when or how their data could be used or the consequences of that misuse until it is already too late.

In the case of ICS Systems, their kinetic impact is instantaneous, targeted (possibly affecting the normal life development of a specific geographical region by attacking an Electric Plant and stopping the energy production) and it could last for weeks or months depending on the level of destruction the attack caused. In the worst case scenario, a successful attack against ICS infrastructure could cause the loss of lives.

As we can see, the kinetic impact is the most dangerous consequence of an attack against an ICS Infrastructure.

2019 Attacks analysis

Although the world, from the IT perspective is smaller than ever, the main targets of malicious actors are still being large corporations in industrialized nations. These malicious actors could be divided in five groups [2]:

1.      Nation State attackers

APT owners, have highly skilled resources and are capable of develop new threats

2.      Cyber Criminals

Individuals or groups that perform cyber-attacks to get financial benefit from it.

3.      Hacktivists

Individuals or groups that perform cyber-attacks on targets for political or ideological reasons

4.      Internal users

End users, system administrators, executives, etc.

5.      Partners

Defined as Companies that provide Services working together or by remote access with the client company.

These groups are usually focused on large targets, or as mentioned earlier, targets localized in industrialized countries, especially in the area of ICS where mayor players of Energy or Industry are located. Therefore, it is very interesting to see countries like Peru or Bolivia listed as main countries with the highest increase in the percentage of ICS computers on which malicious objects were blocked when removable media were connected to them, as shown in the following diagram:

Figure 1. Countries and territories with the highest increase in the percentage of ICS computers on which malicious objects were blocked when removable media were connected [3, 4].

Although statistics are focused on computers used in the ICS environment, the increment of blocked malicious objects blocked is a clear indication that ICS attacks could happen in the near future, either because a compromised PC is connected to an ICS device directly or that the malware is designed to use the PC infrastructure as a bridge to identify and compromise ICS devices.

The reason behind that assumption is that although Antivirus (AVs) could be found in enterprise environments in South American countries, AVs are only able to detect commodity malware, in other words, historical malware, leaving the door open to more advanced ICS Security threats.

Implementation of more advanced or multi-layered security controls, especially for ICS in countries like Bolivia or Peru is usually a difficult topic to discuss in any company size, due primarily to the cost associated to these products, in addition to this is the lack of understanding how Security works from the knowledge cycle point of view where additional investment is required in internal and external training.

Bolivia, and Peru, why?

There are many reasons for attackers, mainly Cyber Criminals and Hacktivists, could be interested into attacking ICS infrastructure in Bolivia and Peru, here I present you some of them:

1.      Economy dependency

Countries like Peru and Bolivia, as well as other South American countries, because one of the biggest economic activities are the extraction and export of Natural resources, for example Peru has important cooper and gold mines that provide those minerals to countries like China, Japan, US, etc., generating a good percentage of the country’s annual budget and supporting the ability of the government to improve living conditions of their citizens. Having an impact on that money making engine will have a significant impact to the country’s economy and therefore to their citizens.

In this case Cyber Criminals and Hacktivists might be hired to do the job by the real organization interested into causing negative effects to these countries’ economies.

2.      Side effect in another economies

Having a large impact in raw material providers’ countries like Peru and Bolivia could impact their final customers, like China, Japan, US, etc., not allowing them to continue normal operations in their factories which could slow down, or halt them if the ICS attack caused a major impact in the infrastructure, causing a different impact on their economies.

In this case, as the same as the previous one, Cyber Criminals and Hacktivists might be hired to do the job by the real organization interested into causing negative effects in the main customers of these countries’ production. In this particular case, Nation State Attackers could be part of the attacking strategy.

3.      Disgruntled workers

This is a common conversation in IT Security, but not so common in ICS Security due that, because of the nature of the network, it is sometimes difficult to identify the unhappy worker. Still, necessary measures should be consider, like the use of CCTV cameras in key points of the plant, or additional Safety infrastructure and controls enforced among all resource levels in the organizations.

Solutions available

As explained before, companies in either Peru or Bolivia don’t have the conversation and/or don’t have the required budget to invest, assuming those specific issues, here are some solutions available:

1. Have an honest discussion about IT Security with the people in your company and management. The reason behind mentioning IT Security is because is the front door of any ICS related attack.
2. Ask your IT Security people to make a Risk Assessment and define the critical infrastructure or systems from the IT point of view.
3. Make an assessment of the condition of the ICS network used in the company, things like: years of operation and life expectancy, upgradability, segmentation between the ICS Network and the IT Network, management requirements, etc.
4. Collect all the results of your ICS Assessment and make a Risk Assessment of your ICS infrastructure, different methods are available for this purpose (NIST 800-82, North American Electrical Reliability Council (NERC), Cyber Security Evaluation Tool or CSET, Electricity Subsector Cybersecurity Risk Management Process, etc.) decide the one most suitable for you and apply it, the results should be your critical infrastructure or Systems [5, 6, 7, 8].
5. With the Risk Assessment results, have a conversation with your IT Security people, ICS people and cross reference the two results (IT and ICS) of their correspondent Risk Assessments. The result should be the most important points to protect.
6. Define the required strategy from the IT Security point of view to protect those important points, the resource required and the budget associated.
7. Check, and create if required, all policies according to local/international regulators and company specific regulations.
8. It is always a good idea to contact the ICS manufacturers and IT Security systems companies to create POCs. Results of the System POC should show the system effectiveness to apply Company’s policies, and its effectiveness to mitigate discovered risks.
9. Map the POC results with the available budget. This could give Management an idea to make the final decision to buy, implement, rent or outsource the given system

To spend or not to spend, there is the dilemma

One useful factor to decide an expense in a company is the cost associated with a breach. Although in the case of an ICS attack the breach negative impact of the information disclosed is smaller compared to the real kinetic impact, it is still useful to explain to management how reputation and normal operations in a company could be affected, and how could be difficult to recover from it [9].

Having the IT and ICS team working together on the results of the combined Risk Assessment could provide a valuable assessment on the cost associated with a breach and depending of the nature of the business of the company a much detailed cost could be calculated. Obviously, if there is the slightest probability that an attack against the company could result in the loss of lives, the cost associated could go beyond the company value, and definitely no amount of money could be enough for the families that could be affected because of that loss of live.

Being said that, there are solutions for every pocket and they can be either paid ones or open source ones, each one with their own drawbacks, more on this in a future post. The biggest drawback associated with the paid ones is the budget required, not only for the solution but, even more important, for the training required for the resources that will interact with the solution. Always remember that People are the most fundamental part of your People Process and Technology (PPT).

As for the Open Source solutions, although the cost associated with them is not that big, usually the hardware used in the solution is the largest cost associated; the knowledge cost associated is the biggest impact in the company’s budget. Having an in-house expert of an Open Source solution could be costly, moreover debugging and administrating an Open Source solution could not be always straightforward, especially in an ICS environment, where availability is king.

Now, depending on company’s structures, your IT Team could be outsourced as well as the company in charge of the ICS devices’ maintenance, or in the case that there is no expertise to rely on when making the different risk assessments and having the necessary discussions, or when your Senior Management wants a third set of eyes to oversee the process (which is not a bad idea after all), in those cases, an additional cost could be the hiring of a consulting company to provide the expertise and solution. Depending on the task in hands and the company to be hired, this cost could represent a significant amount of budget, therefore, be careful if you go this route, check as much as you can all the references and information about the consulting organization.

Conclusion

Although is interesting to see countries like Bolivia and Peru in the list of countries affected by ICS attacks, ICS companies in general should have Security as one of their priority tasks, moreover if an attack could potentially have a kinetic impact represented by loss of lives.

Risk assessments, from the IT and ICS point of view, are required and should be cross referenced and analyzed as a group by both IT and ICS teams.

Spending is always an issue, but necessary to avoid unwilling negative consequences, or negative impact, and to act proactively against any possible ICS attack.

References

[1] Critical Infrastructure Sectors, Department of Homeland Security, US -  https://www.dhs.gov/cisa/critical-infrastructure-sectors

[2] Creating a Threat Profile in your organization, SANS - https://www.sans.org/reading-room/whitepapers/threats/creating-threat-profile-organization-35492

[3] Threat landscape for industrial automation systems, H1 2019, Kaspersky - https://ics-cert.kaspersky.com/reports/2019/09/30/threat-landscape-for-industrial-automation-systems-h1-2019

[4] Infographic – ICS/OT Cyber Attacks, Galactic Security Systems - https://www.galacticsecurity.systems/

[5] Guide to Industrial Control Systems (ICS) Security, NIST - https://csrc.nist.gov/publications/detail/sp/800-82/rev-2/final

[6] North American Electric Reliability Corporation (NERC) - https://www.nerc.com/Pages/default.aspx

[7] Industrial Control Systems Assessment, CISA - https://www.us-cert.gov/ics/Assessments

[8] Electricity Subsector Cybersecurity Risk Management Process, U.S. Department of Energy - https://www.energy.gov/sites/prod/files/Cybersecurity%20Risk%20Management%20Process%20Guideline%20-%20Final%20-%20May%202012.pdf

[9] The State Of Industrial Cybersecurity 2018 - https://ics.kaspersky.com/media/2018-Kaspersky-ICS-Whitepaper.pdf

Securing organizations in large scale events

Securing organizations in large scale events

This year Japan is the host of multiple large scale sport events, the 2019 Rugby World Cup and the 2019 Volleyball World Cup, both nationwide events that will attract a significant number of fans to different cities across Japan [1, 2].

To have an idea of the magnitude of the 2019 Rugby World Cup in Japan, approximately 400 000 fans will arrive to Japan for the different matches from September 20. Online activity will have a drastic increase in Japan as well having as a reference the 2015 World Cup where over 270 million social media videos were viewed, 2.8 million official app downloads, and the hashtag #RWC2015 appeared twice a second [3].

It is predicted that the online activity in Japan will be larger than the last World Cup; moreover, Japan is in the top 10 countries with the fastest internet connection, which allows travelers and locals to exchange a vast amount of information.

Fans cheer up your team and secure your devices!

In this scenario, fans (local and travelers) should exercise standard security measures in order to protect their information, like:

1. VPN use when connecting through publicly available Wi-Fi spots
2. Having patched and updated all your Oss, laptops and phones
3. As a general measure, not only for these events, users should act with caution when receiving mails with attachments and follow simple rules to avoid phishing mails [4]
4. Download apps from trusted sources (Apple store or Google Play)
5. Only visit sites that have https enabled [5]

Securing IoT

The Japanese government began to scan any device that is accessible through the internet, especially IoT devices, as part of their initiative to identify devices that can be victims of brute force attacks, meaning that they are still using easy-to-guess passwords or factory default passwords. Once a vulnerable device is found, the Internet Service Provider (ISP) will be contacted in order to establish communication with the end user [9, 10].

Therefore, fans, if you haven’t updated your device’s passwords, it’s time to do it. Don’t wait until you receive a notification from the company you used to get internet access in Japan.

Securing organizations in Japan

Organizations, especially the ones who have a close relationship with any event, like sponsors for example, could become target of different types of attack from various groups of attackers.

Attackers groups could vary from people trying to learn more about Security and unwillingly cause some damage to a company infrastructure, groups of people that they have different interests like: financial, political, religious, etc., that could have much more advanced tools at their disposal to launch attacks to specific organizations’ infrastructure, and of course we have Nation State attackers who belong to different Advanced Persistent Threats (APTs) grouped according to the targets they have and the tools they commonly use [6].

Although Security Professionals we cannot precisely forecast when an attack could occur, we can continuously assess the efficiency and reliability of our set of tools. There are some steps to follow in order to efficiently test the reliability of our own tools, this is a simple guide but you can make it much more detailed if required.

Understand the company lifecycle

Having a clear idea of where are the crown jewels of your organization, where the revenue is coming from, prioritized assets, Intellectual Property (IP), internal systems that support the organization is the first and foremost important step to create the scenarios together with the full understanding of the impact on the impact if one of your priority infrastructure is compromise.

a. Collect information

The Mitre ATT&CK framework is a collection of Tactics, Techniques and Procedures (TPPs) used by different attackers groups. This information is crucial to know what to test in our security systems.

Please remember that although this is a collection of all TPPs, specific groups like APT, have their own favorite set of TPPs, there is no “magic” blueprint that can be used to generalize attacks from different groups.

An additional important set of data is the threat lifecycle, also known as kill chain model, there are many variants of this, but we can use the follow high-level steps [6]:

1. Reconnaissance
2. Weaponization
3. Delivery
4. Exploitation
5. Installation
6. Command & Control
7. Actions and objectives

b. Create scenarios

Together with the use of Frameworks like Mitre’s ATT&CK, detailed scenarios can be created according to the organization’s specific requirements [7].

Scenarios like controls against Phishing mail are common and well understood. More complex scenarios can be created but depends on your organization’s requirements.
Once the most relevant attack scenarios are ready is time to test them, a table top exercise could be used to understand not only the tool efficiency but also the process around them that are required in any organization independently of their size and nature.
Gaps resultants from the test are required to be discussed and remediated, then tested again and the cycle continues.

c. Special circumstances

In this moment Japanese organizations are, one way or another and in different levels, involved in the Rugby World Cup and Volleyball World Cup, especially sponsors, governmental organizations, partners, etc.

Those highly involved organizations need to put additional attention into the Security Landscape, if possible, adding Threat Intelligence to their normal security operations could improve their vantage point incrementing the resilience capacity of their installed tools.
Education for end users is, as always, the most one of the most important strategies available in any organization to improve their security posture. Constant training, simulations and exercises are a must for any organization to improve their preparedness for any potential security attack.

Conclusion

As a conclusion, organizations involved in big ticket events in Japan need to improve their security posture through testing, user’s training, focused threat intelligence and process improvement. Specially, when the Enthronement Ceremony for the new Emperor will happen on October 22 generating interest from a different group of attackers than the ones interested in sports [8].

Let's remember this is a rehearsal for the 2020 Tokyo Olympics.


References

[1] https://www.rugbyworldcup.com/
[2] http://worldcup.2019.fivb.com/en
[3] https://www.techradar.com/uk/news/tackling-cybersecurity-at-the-rugby-world-cup
[4] https://www.pandasecurity.com/mediacenter/security/10-tips-prevent-phishing-attacks/
[5] https://www.digicert.com/blog/buy-site-know-website-secure/
[6] https://www.sans.org/security-awareness-training/blog/applying-security-awareness-cyber-kill-chain
[7] https://attack.mitre.org/
[8] https://en.wikipedia.org/wiki/2019_Japanese_imperial_transition
[9] https://dennisludena.blogspot.com/2019/02/japanese-government-to-probe-insecure.html
[10] https://dennisludena.blogspot.com/2019/02/japanese-government-to-probe-insecure_26.html