Plan ahead High Check your exposure
Service providers hit through ScreenConnect accounts and N-central flaws in one week
MLQ.ai (via Google News)ScreenConnect, N-central
What happened. MLQ.ai reports that hackers hit managed service providers through ScreenConnect accounts and N-central flaws in the same week.
Who is affected. Managed service providers using ScreenConnect and N-central. The source does not say which organisations are affected. Plant sites relying on such providers for remote support may be exposed.
What to do. Check whether you or your service providers use ScreenConnect or N-central, and review who can reach your plant systems through them.
When to act. Plan ahead: Remote-access and management tool users: check ScreenConnect accounts and N-central now. Reports are early.
Editor's reading
Forasset ownerOT security leadIT security
- Purdue level
- L4
- L3.5
Why: Remote-support and management tools used by service providers form the remote-access path into customer networks, placing them in the industrial DMZ (L3.5) and enterprise IT (L4).
- Are you exposed?
Ask your service providers which remote-support tools they use to reach your site, and search your inventory for ScreenConnect and N-central.
- If you cannot fix it yet
- Limit which provider accounts can connect to plant systems and require multi-factor authentication for them.
- Keep remote-support tools off the plant network unless a session is approved and supervised.
- Watch for
- Remote-support sessions into plant systems outside agreed maintenance windows.
- New or unrecognised remote-access clients or accounts appearing on plant-adjacent hosts.
- ATT&CK for ICS
- T0886Remote Services
Inferred from the facts above, not stated by the source. Check it against your own site before acting.
Source: MLQ.ai (via Google News) (opens news.google.com)
More on ScreenConnect