NSAとCISAが共同でOTと制御システムのリスクを低減するよう警告を出していましたね。。。

こんにちは、丸山満彦です。

USのNSAとCISAが共同で、OTと制御システムのリスクを低減するためにすぐに対策をとるように警告を出していますね。。。国際的な緊張がより高まった時にOTや制御システムへのサイバー攻撃が起こり、米国の生活や産業等にダメージが出ると大きな損失になるということで、早めに対応を促しているのですかね。。。

● CISA
・2020.07.23 Alert (AA20-205A) NSA and CISA Recommend Immediate Actions to Reduce Exposure Across Operational Technologies and Control Systems

Recently Observed Tactics, Techniques, and Procedures

• Spearphishing [T1192] to obtain initial access to the organization’s information technology (IT) network before pivoting to the OT network.
• Deployment of commodity ransomware to Encrypt Data for Impact [T1486] on both networks.
• Connecting to Internet Accessible PLCs [T883] requiring no authentication for initial access.
• Utilizing Commonly Used Ports [T885] and Standard Application Layer Protocols [T869], to communicate with controllers and download modified control logic.
• Use of vendor engineering software and Program Downloads [T843].
• Modifying Control Logic [T833] and Parameters [T836] on PLCs.

Impacts

• Impacting a Loss of Availability [T826] on the OT network.
• Partial Loss of View [T829] for human operators.
• Resulting in Loss of Productivity and Revenue [T828].
• Adversary Manipulation of Control [T831] and disruption to physical processes.
   

Mitigations

• Have a Resilience Plan for OT
• Exercise your Incident Response Plan
• Harden Your Network
• Create an Accurate “As-operated” OT Network Map Immediately
• Understand and Evaluate Cyber-risk on “As-operated” OT Assets
• Implement a Continuous and Vigilant System Monitoring Program