It’s Not Always about the Money or Secrets

The cyberattacks we generally hear about in the media are all about the money or getting sensitive information. When in the attack is for financial gain, stories like Equifax come to mind. On a smaller scale are the scams and phishing attacks that try to get individuals to give away their information. Examples like WikiLeaks and hacks of US government databases are about getting embarrassing information or collecting secrets.

But cyber criminals don’t always do things to make money or get secret/sensitive information. Many times they are trying to cause physical harm to a manufacturing facility, power plant, or computer center. Attacks like these do not get as much media attention for a variety of reasons but they can cause significant damage and even kill or injure people.

A recent New York Times article reported on this sort of attack against a petrochemical facility in Saudi Arabia. In this case, an attacker managed to insert code into the program of the controls used to manage plant safety and production functions. The intent of the code was obvious, override safety programs and cause an explosion that would severely damage the plant and kill or injure employees.

Fortunately, a bug in the malicious code actually triggered the safety systems and no harm was done. However, concern is high over the type of attack and its targeting of industrial control systems. These are not the typical computer systems that are hacked in other high profile stories. Instead, these are industrial network devices with very specific coding and programming. Because of their nature, they have been considered relatively immune to hacking.

Not anymore. These systems are used in over 18,000 industrial facilities around the world. Successful attacks could cripple industrial production capability (the presumed intent in the Saudi attack), shut down power plants and the electric grid, and generally create havoc. Because of the skill required to implement this attack remotely, investigators are certain it was conducted by a government that has the resources to develop the necessary code.

Attacks like these keep government and corporate cybersecurity (CS) people awake at nights because of the potential for harm they pose. And attackers like this type of electronic warfare because it is harder to assign responsibility, can still cause a lot of damage to your enemy, and doesn’t require traditional or asymmetrical military forces.

As employees, we can help our employers avoid attacks by safe computer habits. Here are the easiest and most effective:

1. Have a good antivirus program on your home computer. Before you bring in a USB stick to share vacation pictures, be sure to scan it thoroughly. One of the most common ways employer networks become infected is from employees’ personal devices. A virus that forced the shutdown on a German nuclear power plant came in on an employee USB stick.
2. If you find a USB stick near work, do not plug it into you work computer. Doing so will plant the virus or malware. Turn it over to the IT department for safe handling. This is one theory on how the virus that shut down the Ukrainian power plant a couple of years ago got onto the plant systems.
3. Never click on any links in emails that are not official business. If you must open the link, go directly to the site and search there. Links often redirect users to a fraudulent site which will plant a virus or other bug.
4. Steer clear of social media sites on work computers. These are often infested with viruses, malware, and other nasty computer bugs. Landing on an infected page can infect your work computer.

Cybersecurity is truly everyone’s responsibility, at home and at work. Good habits will eliminate you as the “attack vector” that introduced the virus or malware at home or work. And while you are here, take a look at how the CRIP.TO Shield and Black solution can enhance your privacy and security even further.

CRIP.TO — giving you the power to communicate fearlessly

Copyright © 2017–2018 CRIP.TO OÜ

Originally published at crip.to.