Act today Critical Check your exposure
Hackers cut Ukraine's power three times; US says China has prepared
Nacionale (via Google News)energy
What happened. Nacionale reports that hackers have switched off power in Ukraine three times. It also reports that US agencies say China has prepared to try the same.
Who is affected. Energy sector organisations. The source does not say which organisations are affected.
What to do. No action is named. Share with your SOC or OT security team so they can check for the same indicators.
When to act. Act today: Electricity operators: attacks have switched off power in Ukraine three times; check remote access and grid control…
Editor's reading
ForOT security leaddetection engineerleadership
- Purdue level
- L3
- L2
Why: Switching off power means reaching the SCADA and operations systems that control the grid, which sit at site operations and supervisory levels (L2 and L3).
- Are you exposed?
Review which remote-access paths and IT-to-OT connections can reach your power control systems, and who can use them.
- If you cannot fix it yet
- Restrict remote access to control and operations networks to named users and require multi-factor authentication.
- Limit connections from the corporate network into control systems to approved jump hosts.
- Watch for
- Look for logons to SCADA servers or engineering workstations from the IT network outside normal hours.
- Watch for unexpected commands to switching or breaker control systems.
Inferred from the facts above, not stated by the source. Check it against your own site before acting.
Source: Nacionale (via Google News) (opens news.google.com)
More on Energy and power