![Security Security](http://a.fsdn.com/sd/topics/security_64.png)
![Government Government](http://a.fsdn.com/sd/topics/government_64.png)
A Ransomware Attack Shut a US Natural Gas Plant and Its Pipelines (infosecurity-magazine.com) 24
Long-time Slashdot reader Garabito writes: The Department of Homeland Security has revealed that an unnamed U.S. natural gas compression facility was forced to shut down operations for two days after becoming infected with ransomware.
The plant was targeted with a phishing e-mail, that allowed the attacker to access its IT network and then pivot to its Operational Technology (OT) control network, where it compromised Windows PCs used as human machine interface, data historians and polling servers, which led the plant operator to shut it down along with other assets that depended on it, including pipelines.
According to the DHS CISA report, the victim failed to implement robust segmentation between the IT and OT networks, which allowed the adversary to traverse the IT-OT boundary and disable assets on both networks.
The plant was targeted with a phishing e-mail, that allowed the attacker to access its IT network and then pivot to its Operational Technology (OT) control network, where it compromised Windows PCs used as human machine interface, data historians and polling servers, which led the plant operator to shut it down along with other assets that depended on it, including pipelines.
According to the DHS CISA report, the victim failed to implement robust segmentation between the IT and OT networks, which allowed the adversary to traverse the IT-OT boundary and disable assets on both networks.
Cloud (Score:3)
As I said, this is not my area of expertise, does anyone with experience see anything wrong with such a move?
Re: (Score:3)
Command and control shouldn't be on the same network as e-mail... so it makes sense to move your command servers to a datacenter a network hop away from the plant. The datacenter can restrict your control server with a firewall to make sure commands come from the right place. Then again, why would your execs be so close to the plant anyway... basically the less people and around the plant, the less that can go wrong.
Re: (Score:1)
"Network Hops" are irrelevant (unless you are making Beer). Connectivity is connectivity, no matter if the distance is inches or light centuries, through one "copper hop" or a billion wormholes.
Re: (Score:2)
I wonder if the very motivations we have for connecting stuff to the Internet isn't our downfall.
We operated infrastructure like this before the Internet even existed; we connect these things to the Internet to make our lives cheaper, simpler and easier. Except that if you want the same level of security as a non-connected system, that's not so cheap, simple or easy.
I don't doubt that it's *technically possible* to do something like this with an acceptable level of security, the question is whether it's *e
Convenience (Score:2)
Using the Internet for convenience means it's also convenient for a perpetrator anywhere in the world to hack at the system, constantly, with no fear of punishment.
Re: (Score:2)
No. Knowing the security standards of PLC systems from the 90's any modernization will help.
Re: (Score:2)
Uh, PIPELINE SHUT DOWN... that causes energy prices to rise.
Re: (Score:2)
Gas pipelines get shut down all the time. Maintenance, etc.
Re: (Score:2)
Planned shutdowns for maintenance tend to be less of a problem since mitigating loss of capacity is part of planning.
Think, your car goes out of service for a tuneup in your garage vs your car goes out of service on the freeway at rush hour.
Re: (Score:2)
Got to do MUCH better than this (Score:2)
Snark
Phishing should have nothing to do with operational control, shouldn't be a factor. First you start with educated people that must pass a weekly test on whether or not your company will EVER ask you for the operational password in an email, or emailed link - every week they should pass.
Endsnark
Totally missing "Russia" or "China" in the article (Score:2)
Re: (Score:2)
Do those nations need the kind of ransom a gas plant could pay? Answer is no, would be waste of time. If they attacked, it would be a one time debilitating attack.
Windows again (Score:4, Insightful)
Windows again, big surprise. Microsoft Windows is a clear and present threat to the security of the nation. Time to start firing people.
Re: (Score:2)
No.
Idiots doing idiotic things are a clear and present threat to the security of the nation. TIme to start taking the idiots out behind the barn and beating them to death with baseball bats.
Re: (Score:2)
Using Windows in any critical application is, using your word, idiotic.
Re: (Score:2)
Indeed. Use of Windows in anything critical is just a symptom. It is a symptom of extreme incompetence and a complete lack of accountability were IT-related engineering is concerned. If an architect screws up this badly, building fall down and the architect goes to prison. In IT, nothing happens.
Re: (Score:2)
Windows has nothing whatsoever to do with it. The root of the problem is the utter incompetence to provide a secure environment. It is not more difficult to "secure" Windows (the OS) that it is to "secure" anything else. You simply have to know what you are doing.
And therein lies the problem. The world is chock full of people who have no clue what they are doing and should be at McDonalds flipping burgers or asking "Would you like fries with that?" rather than having anything to do with anything other t
Re: (Score:2)
It is not more difficult to "secure" Windows (the OS) that it is to "secure" anything else.
Rubbish. Windows is a black box with innumerable security holes [cvedetails.com], known and unknown.
Re: (Score:2)
It is not more difficult to "secure" Windows (the OS) that it is to "secure" anything else.
Rubbish. Windows is a black box with innumerable security holes [cvedetails.com], known and unknown.
Indeed. Sure, those that only follow ritual without understanding when securing a system will find Windows and Linux pretty similar. But the minority with a clue will find them vastly different. Personally, I have done some deep-dives into parts of Linux to answer specific questions or secure specific angles. Takes time and knowledge, but no obscure information sources or reverse engineering or "trust".
Re: (Score:3)