Six weaknesses that competitors can use to undermine your business

Unauthenticated protocols, outdated hardware, weak user authentication, weak file integrity checks, vulnerable windows operating systems, undocumented third-party relationships may help your adversaries undermine your industrial operations, says FireEye.

Must Read

A Balancing Act: Personal Data Protection Bill gives more power to govt, data can be processed abroad

The Personal Data Protection Bill is likely to water-down many suggestions of draft Bill prepared by the Justice BN Srikrishna.

Over 50% candidates with Hindi, regional languages clears UPSC civil service exam in 2018

In 2018, a total of 812 candidates were recommended for central civil services, among them 485 candidates were those who had chosen or other regional languages as mother tongue

Modi govt to amend IT Act to trace rogue messages on WhatsApp

The Union government said that to trace rogue messages on platforms such as WhatsApp, it has proposed to amend the Information Technology (Intermediaries Guidelines) Rules, 2011 of the IT Act, 2000
Tech Observer Desk
Tech Observer Desk
TechObserver.in covers e-governance, enterprise IT, startups, telecom and consumer electronics.

firm FireEye said that six key weaknesses which include unauthenticated protocols, outdated hardware, weak user authentication, weak file integrity checks, vulnerable windows operating systems, undocumented third-party relationships can be used by adversaries to undermine industrial operations. Industrial enterprises including electric utilities, petroleum companies, and manufacturing organisations invest heavily in industrial control systems (ICS) to efficiently, reliably, and safely operate industrial processes. “Without the technology operating the plant floor, their business doesn’t exist. Board members, executives, and security officers are often unaware that the technology operating the economic engine of their enterprise invites undetected subversion,” said FireEye.

The company said that there are six weaknesses – unauthenticated protocols, outdated hardware, weak user authentication, weak file integrity checks, vulnerable windows operating systems, undocumented third-party relationships – which industrial firm need to address in order to mitigate any cybersecurity attack.

“Industrial plants have quickly become much more reliant on connected systems and sensors for their operations, yet the cyber security of most plants is not nearly as strong as it needs to be. As industrial initiatives such as Make in India progress, a clear understanding of the common weaknesses in plant environments will help corporate boards, executives and security officers engage in knowledgeable conversation about security, ask discerning questions, and make sound investments,” , Chief Technology Officer for APAC, FireEye said in a statement.

Unauthenticated protocols: When an ICS protocol lacks authentication, any computer on the network can send commands that alter the physical process. This may lead to incorrect process operation, which damages goods, destroys plant equipment, harms personnel, or degrades the environment, said cybersecurity firm.

Outdated hardware: ICS hardware can be operational for decades. This hardware may operate too simplistically or lack the processing power and memory to handle the threat environment presented by modern network technology.

Weak user authentication: User authentication weaknesses in legacy control systems often include hard-coded passwords, easily cracked passwords, passwords stored in easily recoverable formats, and passwords sent in clear text. An attacker who obtains these passwords can often interact with the controlled process at will.

Weak file integrity checks: Lack of software signing allows attackers to mislead users into installing software that did not originate from the vendor. It also allows attackers to replace legitimate files with malicious ones.

Vulnerable Windows operating systems: Industrial systems often run unpatched Microsoft Windows operating systems, leaving them exposed to known vulnerabilities.

Undocumented third-party relationships: Many ICS vendors may not immediately know the third-party components they use, making it difficult for them to inform their customers of the vulnerabilities. Adversaries who understand these dependencies can target software the industrial firm may not even know it has.

- Advertisement -
avatar
1000
  Subscribe  
Notify of
- Advertisement -

Latest in TECH

- Advertisement - ESDS eNight Cloud Hosting

Related Articles