Facebook Google Plus Twitter LinkedIn YouTube RSS Menu Search Resource - BlogResource - WebinarResource - ReportResource - Eventicons_066 icons_067icons_068icons_069icons_070

Tenable 블로그

구독

Colonial Pipeline Ransomware Attack: How to Reduce Risk in OT Environments

It's time for Operational Technology (OT) environments to pursue a more proactive approach to cybersecurity by making cyber maintenance as much of a routine practice as the mechanical maintenance of systems and equipment.

A major supplier of oil and gas to the U.S. East Coast was taken offline on May 8 after a reported ransomware attack. The attack on the 5,500 mile Colonial Pipeline, which supplies 45 percent of the oil and gas used on the East Coast, is just the latest to target the oil and gas sector, which is considered one of 16 critical infrastructure areas identified by the U.S. Department of Homeland Security

It is not surprising that a shutdown or interruption of a pipeline would gain major media attention. But the attack also begs the question: how exposed to attacks is our critical infrastructure?

Colonial Pipeline ransomware attack how to secure critical infrastructure

Source: Colonial Pipeline

The changing operating technology paradigm 

While the operational technology (OT) required in oil and gas operations was once isolated and "air-gapped," today these systems are increasingly connected to IT infrastructure and to the internet, opening up new attack paths. This convergence creates an environment in which any and all aspects of oil and gas operations could be vulnerable to attack from either the IT or the OT side, opening up the possibility of lateral movement. 

Additionally, many ransomware attacks use Active Directory (AD) to perform lateral movement and privilege escalation after initial penetration and new malware increasingly  includes codes to target AD misconfigurations. AD has become the favored target for attackers to elevate privileges and facilitate lateral movement through leveraging known flaws and misconfigurations. Unfortunately, most organizations struggle with Active Directory security due to misconfigurations piling up as domains increase in complexity, leaving security teams unable to find and fix flaws before they become business-impacting issues. 

The attack against Colonial Pipeline is just the latest in a series of recent activity against oil and gas operations around the globe, including:

  • Saipem, an Italian oil and gas industry contractor, which fell victim to a December 2018 cyberattack hitting servers based in the Middle East, India, Aberdeen and Italy.

  • A cyberattack on a shared data network, which forced four natural gas pipeline operators in the U.S. to temporarily shut down computer communications with their customers in April 2018.

  • A cyberattack against a U.S. natural gas facility, which concurrently encrypted both the IT and OT networks, locking access to the human machine interface (HMI), data historians and polling servers. The pipeline was forced to shut down for two days in February 2020.


Regulatory compliance does not equal security

In our experience working with OT environments, we often find organizations assuming that regulatory compliance is the same as security. While we are by no means suggesting this was the case at Colonial Pipeline, we do believe it's worthwhile for all organizations in the sector to consider taking a more expansive view of their cybersecurity strategy. 

There are five safety and security standards relevant to the oil and gas industry, all of which call for organizations to have a base layer of security in place. This layer includes asset inventory, security management controls and a vulnerability management system. While we support a regulatory approach and believe compliance is laudable, we consider adherence to these guidelines as only the beginning of a sound cybersecurity strategy.

Here's why: the promulgation, enactment and enforcement of regulatory standards cannot keep pace with the rapidly expanding attack surface, and the speed with which attackers adapt to it. Thus, we cannot assume "compliance" means the organization has achieved "security." We must look well beyond compliance if we hope to keep critical infrastructure secure and prevent attacks like the one that has affected Colonial Pipeline.

5 safety and security standards relevant to the oil and gas industry

API Standard 1164 - Content unique to pipelines not covered by NIST CSF and IEC 62443.


National Institute of Standards and Technology (NIST) cybersecurity framework for improving critical infrastructure cybersecurity (NIST CSF) - Pre-eminent framework adopted by companies in all industry sectors; Natural gas and oil companies increasingly orient enterprisewide programs around NIST CSF.


Department of Energy cybersecurity capability maturity model - Voluntary process using industry-accepted best practices to measure the maturity of an organization's cybersecurity capabilities and strengthen operations.


International Electrotechnical Commission (IEC) 62443 - Family of standards for industrial control systems (ICS) security; widely adopted by production segment of natural gas and oil industry; applicable to any type of natural gas and oil ICS

International Organization for Standardization ISO 27000 - Leading standard in the family providing requirements for an information security management system (ISMS).


How to disrupt OT security threats

Ironically, one of the least desirable times to deal with a cyberattack is when it is happening. Over the coming days and weeks, we will undoubtedly learn more details about the course of this attack, as well as the cost and disruption it caused. If critical infrastructure organizations have any hope of getting out of the cyber firefighting mode of having to react to attacks, they will need to instead focus on preempting attacks by disrupting them before they happen. 

Many industrial environments, including the oil and gas industry, are very familiar with performing routine maintenance on their equipment. Whether it is changing out a bearing, filter or fluids, maintenance is performed to avoid a catastrophic equipment failure due to what's known as "running to failure." Regular maintenance saves money and aggravation and avoids the diversion of resources. 

So, why aren't organizations performing the same type of regular maintenance on the cybersecurity of their OT systems?

Taking a "maintenance" approach to OT infrastructure means performing the appropriate cyber hygiene on the programmable logic controllers (PLCs), distributed control systems (DCSs), HMIs and other OT devices that run these machines. Performing regular cyber hygiene can reduce OT threats by stopping risky behavior, closing "ports of entry" and reducing the amount of vulnerabilities that can be exploited.

Reducing threats before they happen requires:

  • achieving visibility across the entire attack surface — including IT and OT systems; 

  • deploying deep security measures at the device and network level; and 

  • re-establishing control through managing configuration changes. 


Organizations need appropriate cyber hygiene in both their OT infrastructure and their Active Directory to reduce their cyber exposure and ensure that attack paths are cut off before attackers can succeed in escalating privileges, traversing the network and launching their ransomware attempt. These efforts can help all critical infrastructure and manufacturing operations avoid having to respond to a security crisis that can stop operations and potentially put human lives at risk. 

자세히 알아보기

관련 기사

최신 익스플로잇에 대해 취약합니까?

이메일을 입력하여 최신 사이버 노출 알림을 받으십시오.

tenable.io

비교할 수 없는 정확도로 모든 자산을 확인하고 추적할 수 있는 최신 클라우드 기반 취약성 관리 플랫폼 전체에 액세스하십시오.

Tenable.io Vulnerability Management 평가판에는 Tenable Lumin, Tenable.io Web Application Scanning 및 Tenable.cs Cloud Security도 포함되어 있습니다.

tenable.io 구매

비교할 수 없는 정확도로 모든 자산을 확인하고 추적할 수 있는 최신 클라우드 기반 취약성 관리 플랫폼 전체에 액세스하십시오. 지금 연간 구독을 구매하십시오.

65 자산

구독 옵션 선택:

지금 구매

Nessus Professional 무료로 사용해 보기

7일간 무료

Nessus®는 오늘날 시장에서 가장 포괄적인 취약성 스캐너입니다. Nessus Professional은 취약성 스캔 프로세스를 자동화하고 컴플라이언스 주기에서 시간을 절약하고 IT 팀이 참여할 수 있도록 합니다.

Nessus Professional 구매

Nessus®는 오늘날 시장에서 가장 포괄적인 취약성 스캐너입니다. Nessus Professional은 취약성 스캔 프로세스를 자동화하고 컴플라이언스 주기에서 시간을 절약하고 IT 팀이 참여할 수 있도록 합니다.

여러 해 라이선스를 구매하여 절감하십시오. 연중무휴 전화, 커뮤니티 및 채팅 지원에 액세스하려면 Advanced 지원을 추가하십시오.

라이선스 선택

여러 해 라이선스를 구매하여 절감하십시오.

지원 및 교육 추가

Tenable.io

비교할 수 없는 정확도로 모든 자산을 확인하고 추적할 수 있는 최신 클라우드 기반 취약성 관리 플랫폼 전체에 액세스하십시오.

Tenable.io Vulnerability Management 평가판에는 Tenable Lumin, Tenable.io Web Application Scanning 및 Tenable.cs Cloud Security도 포함되어 있습니다.

Tenable.io 구매

비교할 수 없는 정확도로 모든 자산을 확인하고 추적할 수 있는 최신 클라우드 기반 취약성 관리 플랫폼 전체에 액세스하십시오. 지금 연간 구독을 구매하십시오.

65 자산

구독 옵션 선택:

지금 구매

Tenable.io Web Application Scanning 사용해 보기

Tenable.io 플랫폼의 일부로 최신 애플리케이션을 위해 설계된 최신 웹 애플리케이션 스캐닝 서비스에 대한 전체 액세스 권한을 누리십시오. 많은 수작업이나 중요한 웹 애플리케이션 중단 없이, 높은 정확도로 전체 온라인 포트폴리오의 취약성을 안전하게 스캔합니다. 지금 등록하십시오.

Tenable Web Application Scanning 평가판에는 Tenable.io Vulnerability Management, Tenable Lumin 및 Tenable.cs Cloud Security도 포함되어 있습니다.

Tenable.io Web Application Scanning 구매

비교할 수 없는 정확도로 모든 자산을 확인하고 추적할 수 있는 최신 클라우드 기반 취약성 관리 플랫폼 전체에 액세스하십시오. 지금 연간 구독을 구매하십시오.

5 FQDN

$3,578

지금 구매

Tenable.io Container Security 사용해 보기

취약성 관리 플랫폼에 통합된 유일한 컨테이너 보안 서비스에 대한 전체 액세스 권한을 누리십시오. 컨테이너 이미지에서 취약성, 맬웨어 및 정책 위반을 모니터링합니다. 지속적 통합 및 지속적 배포(CI/CD) 시스템과 통합하여 DevOps 실무를 지원하고 보안을 강화하고 기업 정책 컴플라이언스를 지원합니다.

Tenable.io Container Security 구매

Tenable.io Container Security는 빌드 프로세스와의 통합을 통해 취약성, 맬웨어, 정책 위반 등 컨테이너 이미지의 보안에 대한 가시성을 제공하여 DevOps 프로세스를 원활하고 안전하게 지원합니다.

Tenable Lumin 사용해 보기

Tenable Lumin을 사용하여 Cyber Exposure를 시각화 및 탐색하고 시간 경과에 따른 위험 감소를 추적하고 유사한 조직을 벤치마크하십시오.

Tenable Lumin 평가판에는 Tenable.io Vulnerability Management, Tenable.io Web Application Scanning 및 Tenable.cs Cloud Security도 포함되어 있습니다.

Tenable Lumin 구매

조직 전체에서 인사이트를 얻고 사이버 위험을 관리하는 데 Lumin이 어떻게 도움이 되는지 알아보려면 영업 담당자에게 문의하십시오.

Tenable.cs 사용해 보기

클라우드 인프라 구성 오류를 감지 및 수정하고 런타임 취약성을 볼 수 있는 전체 액세스 권한을 누리십시오. 지금 무료 평가판에 등록하십시오.

Tenable.cs Cloud Security 평가판에는 Tenable.io Vulnerability Management, Tenable Lumin 및 Tenable.io Web Application Scanning도 포함되어 있습니다.

영업 담당자에게 연락하여 Tenable.cs 구매

영업 담당자에게 연락하여 Tenable.cs 클라우드 보안에 대해 자세히 알아보고, 클라우드 계정을 온보딩하는 것이 얼마나 쉬운지 확인하고, 몇 분 내에 클라우드 구성 오류와 취약성에 대한 가시성을 얻으십시오.

Nessus Expert 무료로 사용해 보기

7일간 무료

최신 공격 표면을 방어하기 위해 구축된 Nessus Expert를 사용하면 IT부터 클라우드까지, 더 많은 것을 모니터링하고 조직을 취약성으로부터 보호할 수 있습니다.

Nessus Professional이 이미 있습니까?
7일간 Nessus Expert로 무료 업그레이드하십시오.

Nessus Expert 구매

최신 공격 표면을 방어하기 위해 구축된 Nessus Expert를 사용하면 IT부터 클라우드까지, 더 많은 것을 모니터링하고 조직을 취약성으로부터 보호할 수 있습니다.

라이선스 선택

프로모션 가격이 2월 28일까지 연장되었습니다.
여러 해 라이선스를 구매하여 비용을 더 절감하십시오.

지원 및 교육 추가