(cross-posted from the SCADASEC mailing list – posting was reply from Marina Krotofil) A couple of other friends reached out and asked for more details and more thoughts.So I wanted to add a couple more things. Note, that I do not havevisibility into the EXACT configuration of LvivTeploEnergo infrastructure,which is insanely complex as well as […]
Category: Building
Report of another PLC compromised using cyber means
(cross-posted from the SCADASEC mailing list – posting was reply from Marina Krotofil) I just went through the Dragos report, the Wiredarticle, the Ukrainian sources, Nozomi report, some more foreign articles,Medium articles, Dale Peterson opinion piece, CERT-UA page, spoke to someICS folks who already looked into the sample, and I have so many questions. 1. […]
Process sensors are different than IOT and IIOT devices
December 2022, the US Government Accountability Office (GAO) issued Critical Infrastructure Actions Needed to Better Secure Internet-Connected Devices (GAO-23-105327). According to GAO, the scope of the report was governed by a legislative mandate in The Internet of Things Cybersecurity Improvement Act of 2020, which (along with conversations with GAO’s Congressional clients), which dictated the terms […]
Control system cyber incidents are much more plentiful than people realize
Control systems are systems of systems. Consequently, when one device or system is compromised, it can impact many others, potentially numbered in the tens to thousands. If I were to have counted all of the individual cases, my database would have almost 12 million control system cyber incidents. The insurance industry and credit rating agencies […]