Act today Critical Check your exposure
US agencies urge hardening of refrigeration and cold-chain monitoring systems
CISA Cybersecurity Advisorieshealthcare, chemical, food and agriculture
What happened. New: a joint US federal advisory gives hardening guidance for these systems. CISA, the FBI and others are aware of malicious activity targeting electronic temperature controllers and commercial refrigeration controllers in retail grocery and cold storage.
Who is affected. Owners of industrial refrigeration and cold-chain monitoring in the Healthcare, Chemical, Food and Agriculture and Transportation sectors, including refrigerated transport, retail grocery and cold storage.
What to do. Identify refrigeration and cold-chain systems reachable from the internet, remove unnecessary remote access, secure the access you need, use strong authentication and keep systems updated.
When to act. Act today: the source reports it has been used in attacks
Editor's reading
Forasset ownerOT security leadIT security
- Purdue level
- L5
- L2
- L1
Why: Temperature and refrigeration controllers are field controllers (L1), monitoring systems sit at L2, and internet-reachable remote access places exposure at the edge (L5).
- Are you exposed?
Check whether any refrigeration controller or cold-chain monitoring system answers from the internet, and list every remote-access route to them.
- If you cannot fix it yet
- Remove internet access to refrigeration controllers and monitoring portals; allow remote access only through a secured gateway.
- Require strong authentication, ideally multi-factor, on every remote-access path to these systems.
- Change default passwords on temperature controllers and monitoring accounts.
- Watch for
- Unexpected changes to temperature set points, defrost cycles or alarm settings on refrigeration controllers.
- Logons to controller or monitoring interfaces from unfamiliar internet addresses.
- ATT&CK for ICS
- T0831Manipulation of ControlT0886Remote Services
Inferred from the facts above, not stated by the source. Check it against your own site before acting.
Source: CISA Cybersecurity Advisories (opens cisa.gov)
More on Healthcare Chemicals Food and agriculture