Facebook Google Plus Twitter LinkedIn YouTube RSS Menu Search Resource - BlogResource - WebinarResource - ReportResource - Eventicons_066 icons_067icons_068icons_069icons_070

Tenable 博客

订阅

Securing Critical Infrastructure: What We've Learned from Recent Incidents

Learn about well-known vulnerabilities and attacks and how they affected critical infrastructure —from Phone Phreaking to recent ransomware.

Learn about well-known vulnerabilities and attacks and how they affected critical infrastructure — from Phone Phreaking to recent ransomware.

Cyberattacks against critical infrastructure are on the rise. The FBI’s Internet Crime Complaint Center (IC3) highlighted in its 2021 Internet Crime Report that 649 complaints of ransomware attacks were received from organizations in the critical infrastructure sector, a 7% increase over the prior year. Organizations in the healthcare, public health, financial services and information technologies sectors — which are among the 16 critical infrastructure sectors identified by the U.S. Cybersecurity and Infrastructure Security Agency (CISA) — are the most frequent victims of ransomware, according to the study. And the IC3 anticipates a surge of attacks against critical infrastructure in 2022.

The Colonial Pipeline ransomware attack serves as an example of how the surge in vulnerabilities in IT systems can severely impact operations and, potentially, the overall U.S. economy at large.

Industries are investing more into Supervisory Control and Data Acquisition (SCADA) systems, with a market forecast reach of $15 billion USD by 2030 with a CAGR of 7% according to a recent research report by Market Research Future. While recognizing that otherwise simple security measures like patching can have impact on operations for OT systems like SCADA systems, neglecting it leaves the door wide open for substantial consequences.

While IT and OT systems have common touch points each faces a diverse set of challenges. For example, patching vulnerabilities in OT systems is challenging because small errors can shut down entire plants and facilities. OT often involves legacy systems that require specialized know-how that, if not consistently shared and passed to future employees, can add to the complexity of both operating devices as well as patching them.

However, the effects of security incidents on the supply chain can be overwhelming.

Back to the future

The need to protect critical infrastructure certainly is not new. First attacks date back to the 1960s when the first phone hacking mechanisms exploited the public phone systems.

ARPANET, the first public packet-switched computer network, was first used in 1969. Shortly after, in 1971, the first instance of a “worm” (CREEPER) was created and the first Denial of Service attacks were born. During the early 1980s, the 414s marked the hacking scene’s break into computer systems at several institutions.

As internet connectivity became ubiquitous, organizations needed a way to easily share relevant vulnerability data across organizations and industries. In 1999, MITRE introduced the Common Vulnerabilities and Exposures (CVE) list system. In 2005, CVEs were followed by the National Institute of Standards and Technologies’ (NIST) National Vulnerability Database (NVD). Meanwhile, vulnerabilities and threats continued to proliferate.

Heartbleed left its mark on industrial control systems in 2014. More recently, vulnerabilities such as the Ripple20 set — which affects a software library widely used in OT, IoT and IT devices — remain a significant concern. Attacks against the software supply chain, such as the 2020 breach of the SolarWinds Orion platform, have upped the ante by targeting the auto-update features of a vendor’s software. And, attacks don’t always need to target OT systems directly to have a significant impact on critical infrastructure. The 2021 ransomware attack against the IT systems of Colonial Pipeline is a case in point: although the organization’s OT systems were not compromised, the decision was made to take the pipeline out of service out of an abundance of caution, causing fuel shortages up and down the densely populated East Coast of the United States.

critical infrastructure cybersecurity timeline

Vulnerability landscape: Behind the scenes

Securing critical infrastructure requires accounting for the complexities of IT and OT systems, understanding their diverse challenges and being prepared to overcome the obstacles stemming from their integration.

The recent attacks and threats discussed in this blog are critical and sophisticated. The table below is a selected list of widely covered vulnerabilities which have implications for critical infrastructure operators.

原文:Tenable, July 2022

As previously noted, each vulnerability in the above table affected critical infrastructure in different ways.

Colonial Pipeline: From IT systems to OT shutdown

The ransomware attack against the IT system of Colonial Pipeline, one of the biggest U.S. fuel pipeline operators, is an example of how an attack on IT systems can also have significant impact on critical infrastructure.

The group responsible for the Colonial Pipeline incident and many other notable ransomware attacks is known to use these vulnerabilities:

  • CVE-2021-20016, a zero-day vulnerability affecting SonicWall Secure Mobile Access (SMA100), used for attack initiation; and
  • CVE-2020-1472, a Zerologon vulnerability that — when successfully exploited — allows for privilege escalation by establishing a Microsoft Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC).

The attack led to a ransom payment of roughly $4.4 million and, while the OT systems controlling the pipeline itself were not breached, the organization opted to shut down operations for five days out of an abundance of caution. The case exemplifies how the convergence of IT/OT systems, and the related pursuit of digital transformation as a business driver, affects critical infrastructure operators.

结论

While vulnerability management remains a powerful tool to integrate into the overall business lifecycle, it’s not without its challenges in critical infrastructure environments. Among the challenges:

  • In many cases, devices running on OT networks are no longer supported. The companies behind them may have long gone out of business. 
  • In other cases, there’s a lack of a clear update mechanism, such as an interface or software update utility, so even if an OT vendor wanted to release a patch, it would be difficult to deploy.
  • Without an effective way to patch or remediate, an organization is left to figure out how to reduce or mitigate an attack surface by isolating network traffic and devices, firewalls and VPNs and unique routing tables.

Critical infrastructure providers are also heavily focused on uptime above all else, which introduces several challenges for patching OT systems, including:

  • The potential for patching to cause downtime of critical operational technologies,
  • A lack of fixes for legacy systems,
  • A lack of staff with the right expertise on how to secure legacy systems.

Resolving these and other challenges related to critical infrastructure security requires a concerted effort by operators, vendors and government agencies around the world. Finding and fixing vulnerabilities in the IT and OT systems used in these environments is just the first step.

Editor's note: This blog was revised on July 15 to more accurately reflect the context in which we discuss CVE-2021-20016 and CVE-2020-1472.

获取更多信息

Read our blog posts:

Listen to the The State of OT Security, a Year Since Colonial Pipeline podcast

Download the whitepaper Prediction of an OT Attack.

Read the report A look inside the ransomware ecosystem.

We recently held a transport-focused OT webinar – Unpacking Some of the Most Common Cybersecurity Challenges Facing Your Transportation-Sector Business. The session included panelists from the U.S. Transportation Security Administration (TSA) and two of our partners. If you missed it make sure you catch the recording and keep an eye on our list of future webinars as we’ve more planned around this topic.

相关文章

您是否易受最新漏洞利用的攻击?

输入您的电子邮件以在收件箱中接收最新的 Cyber Exposure 警报。

tenable.io

可全面访问基于云的现代化漏洞管理平台,从而以无可比拟的精确度发现并追踪所有资产。

Tenable.io Vulnerability Management 试用版还包括 Tenable Lumin、Tenable.io Web Application Scanning 和 Tenable.cs Cloud Security。

tenable.io 购买

可全面访问基于云的现代化漏洞管理平台,从而以无可比拟的精确度发现并追踪所有资产。 立即购买年度订阅。

65 项资产

选择您的订阅选项:

立即购买

免费试用 Nessus Professional

免费试用 7 天

Nessus® 是当今市场上功能最全面的漏洞扫描器。Nessus Professional 可帮助自动化漏洞扫描流程、节省合规周期的时间,并让您调动起 IT 团队的积极性。

购买 Nessus Professional

Nessus® 是当今市场上功能最全面的漏洞扫描器。Nessus Professional 可帮助自动化漏洞扫描流程、节省合规周期的时间,并让您调动起 IT 团队的积极性。

购买多年期许可,即享优惠价格添加高级支持功能,获取一年 365 天、一天 24 小时的电话、社区和聊天支持。

选择您的许可证

购买多年期许可,即享优惠价格

添加支持和培训

Tenable.io

可全面访问基于云的现代化漏洞管理平台,从而以无可比拟的精确度发现并追踪所有资产。

Tenable.io Vulnerability Management 试用版还包括 Tenable Lumin、Tenable.io Web Application Scanning 和 Tenable.cs Cloud Security。

Tenable.io 购买

可全面访问基于云的现代化漏洞管理平台,从而以无可比拟的精确度发现并追踪所有资产。 立即购买年度订阅。

65 项资产

选择您的订阅选项:

立即购买

试用 Tenable.io Web Application Scanning

完整享有专为现代化应用程序而设、属于 Tenable.io 平台组成部分的最新 Web 应用程序扫描功能。可安全扫描全部在线资产组合的漏洞,具有高度准确性,而且无需繁重的手动操作或中断关键的 Web 应用程序。 立即注册。

Tenable Web Application Scanning 试用版还包括 Tenable.io Vulnerability Management、Tenable Lumin 和 Tenable.cs Cloud Security。

购买 Tenable.io Web Application Scanning

可全面访问基于云的现代化漏洞管理平台,从而以无可比拟的精确度发现并追踪所有资产。 立即购买年度订阅。

5 个 FQDN

$3,578

立即购买

试用 Tenable.io Container Security

完整获得已集成至漏洞管理平台之唯一容器安全产品的功能。监控容器映像中的漏洞、恶意软件和策略违规。与持续集成和持续部署 (CI/CD) 系统进行整合,以支持 DevOps 实践、增强安全性并支持企业政策合规。

购买 Tenable.io Container Security

Tenable.io Container Security 经由与构建流程的集成,可供全面了解容器映像的安全性,包括漏洞、恶意软件和策略违规,借以无缝且安全地启用 DevOps 流程。

试用 Tenable Lumin

通过 Tenable Lumin 直观呈现及探索 Cyber Exposure,长期追踪风险降低状况,并比照同行业者进行基准度量。

Tenable Lumin 试用版还包括 Tenable.io Vulnerability Management、Tenable.io Web Application Scanning 和 Tenable.cs Cloud Security。

购买 Tenable Lumin

联系销售代表,了解 Lumin 如何帮助获取整个企业的洞见并管理网络安全风险。

试用 Tenable.cs

获取检测和修复云基础设施错误配置以及查看运行时漏洞的完全访问权限。立即注册,免费试用。

Tenable.cs Cloud Security 试用版还包括 Tenable.io Vulnerability Management、Tenable Lumin 和 Tenable.io Web Application Scanning。

联系销售代表购买 Tenable.cs

联系销售代表,了解有关 Tenable.cs 云安全的更多信息,并了解如何轻松加入您的云帐户,并在几分钟内获得云错误配置和漏洞的可见性。

免费试用 Nessus Expert

免费试用 7 天

Nessus Expert 针对现代攻击面而量身打造,可以查看更多信息,保护企业免遭从 IT 到云中漏洞的攻击。

已经有 Nessus Professional?
免费升级到 Nessus Expert 7 天。

购买 Nessus Expert

Nessus Expert 针对现代攻击面而量身打造,可以查看更多信息,保护企业免遭从 IT 到云中漏洞的攻击。

选择您的许可证

促销价格已延长到 2 月 28 日。
购买多年许可证,节省幅度更大。

添加支持和培训