For awareness Medium Check exposure in your normal cycle
Penetration tester finds Windows 7 servers linked to factory milling machines
The Register - securityMicrosoft · manufacturing
What happened. A penetration tester visited a factory that had been hacked six months earlier. He found Windows 7 servers connected to computer numerical control (CNC) milling machines. Most were not joined to the domain.
Who is affected. The source names no affected organisation. It describes a manufacturing client using legacy Microsoft Windows 7 servers connected to CNC machines.
What to do. Check whether legacy operating systems such as Windows 7 are connected to your production machines, and review how those servers are protected.
When to act. For awareness: background reading, nothing to schedule
Editor's reading
Forasset ownerOT security lead
- Purdue level
- L3
- L2
Why: Servers attached to CNC milling machines are production-floor systems, which fit the supervisory and site operations levels.
- Are you exposed?
Look in the asset inventory for Windows 7 servers connected to CNC or other production machines, including ones not joined to the domain.
- If you cannot fix it yet
- Isolate legacy Windows servers behind a firewall that allows only the traffic the machines need.
- Remove unnecessary network paths between legacy servers and the corporate network.
- Watch for
- Logons to legacy servers from the corporate network or from unfamiliar hosts.
- New administrator accounts or credentials used across servers that are not joined to the domain.
Inferred from the facts above, not stated by the source. Check it against your own site before acting.
Source: The Register - security (opens theregister.com)
More on Microsoft Manufacturing