For awareness High Check exposure in your normal cycle
Singapore agency warns on poorly secured remote access to control systems
CSA Singaporefood, cold chain, refrigeration
What happened. The Cyber Security Agency of Singapore (CSA) says recent attacks on refrigeration management systems show the risk of poorly secured remote access to operational technology. The advisory sets out measures to strengthen security. A related report says CSA urges firms to restrict web access to control systems.
Who is affected. Operators of remotely accessible control systems, with refrigeration and cold-chain systems named. The source does not say which organisations were attacked.
What to do. Review which control systems can be reached remotely or from the web, restrict that access, and follow the CSA Singapore advisory measures.
When to act. For awareness: background reading, nothing to schedule
Editor's reading
Forasset ownerOT security lead
- Purdue level
- L3.5
- L2
Why: Refrigeration management systems are supervisory control interfaces (L2), and remote access to them normally passes through gateways in the industrial DMZ (L3.5).
- Are you exposed?
Check whether any control-system web interface or remote-access service can be reached from the internet, for example with an external scan of your own addresses.
- If you cannot fix it yet
- Take control-system web interfaces off the internet and allow access only through a controlled gateway.
- Require multi-factor authentication for every remote-access path into OT.
- Limit remote connections to named users and approved source addresses.
- Watch for
- Logons to refrigeration or control-system interfaces from unfamiliar internet addresses.
- Unexpected changes to temperature setpoints or alarm settings on management systems.
- ATT&CK for ICS
- T0886Remote Services
Inferred from the facts above, not stated by the source. Check it against your own site before acting.
Source: CSA Singapore (opens csa.gov.sg)
More on Food and agriculture