0100110001101111011100100110010101101101001000000110100101110 0000111001101110101011011010010000001100100011011110110110001 1011110111001000100000011100110110100101110100001000000110000 1011011010110010101110100001011000010000001100011011011110110 1110011100110110010101100011011101000110010101110100011101010 1110010001000000110000101100100010100110001101111011100100110 0101011011010010000001101001011100000111001101110101011011010 0100000011001000110111101101100011011110111001000100000011100 1101101001011101000010000001100001011011010110010101110100001 0110000100000011000110110111101101110011100110110010101100011 0111010001100101011101000111010101110010001000000110000101100 10001 0100110001101111011100100110010101101101001000000110100 1011100000111001101110101011011010010000001100100011011110110 1100011011110111001000100000011100110110100101110100001000000 1100001011011010110010101110100001011000010000001100011011011 1101101110011100110110010101100011011101000110010101110100011 1010101110010001000000110000101100100010100110001101111011100 1001100101011011010010000001101001011100000111001101110101011 0110100100000011001000110111101101100011011110111001000100000 0111001101101001011101000010000001100001011011010110010101110 1000010110000100000011000110110111101101110011100110110010101 1000110111010001100101011101000111010101110010001000000110000 1011001000101001100011011110111001001100101011011010010000001 1010010111000001110011011101010110110100100000011001000110111 1011011000110111101110010001000000111001101101001011101000010Your Critical Infrastructure 0000011000010110110101100101011101000010110000100000011000110 1101111011011100111001101100101011000110111010001100101011101is No Longer Immune 0001110101011100100010000001100001011001000101001100011011110 1110010011001010110110100100000011010010111000001110011011101to Cyber Attacks 010110110100100000011001000110111101101100011011110111001000 Learn How to Protect it Before it is Too Late Whitepaper WHITEPAPER TABLE OF CONTENTS Executive Summary 3 More Threats Than Ever, No Slowing Down 4 Concurrently Increasing Threat Sophistication 4 Everyone is Affected – But CIs See Highest Impact 5 Where are CIs Vis à Vis These Threats? 5 Six Factors Making CIs More Vulnerable to Cyber Threats Than Any Other Organization 6 Security for ICS/SCADA Was Not Built-In From the Get Go 6 Reluctance to Replace/Update Equipment and Software 7 Cyber Security Directives are Mostly Voluntary 7 Assumed Physical Isolation, Obscurity, Are Myths 8 Using Security Solutions That Don’t Fit the Job 8 CIs are Prime Target for Hostile Hackers, Hacktivists and Nation States 9 What Can CIs Do to Dramatically Lower risk Exposure? 9 Periodic Training and Awareness Campaigns 9 Strategic Segmentation 10 Defense in Depth 10 Real-Time Malware Protection 10 Detect Unknown Cyber and Operational Threats 11 Keep Evolving! Threats Are a Moving Target 11 Your Critical Infrastructure is No Longer Immune to Cyber Attacks Confidential 2 WHITEPAPER EXECUTIVE SUMMARY Researchers and organizations tasked with evaluating the evolution of cyber threats as they apply to consumers, businesses and critical infrastructure (CI), have been increasingly sounding the alarm that threats are growing in severity. Cyber- borne malice is on the rise in scale and sophistication, frequently bringing highly targeted, complex, and dangerous attack scenarios to light. The information revolution launched by the Internet has reached into every corner of our lives, and cyber threats nowadays adversely affect every type of organization. However, there is one sector where impact by an attack can be devastating. That sector is the industries defined as critical infrastructure; the backbone of the economy and the facilitator of life as we know it. Critical infrastructure is not only where impact from cyber-attacks can reach catastrophic dimensions, it is also a very vulnerable sector due to the historical way security was neglected for most systems still being used today. This paper will explore the particularities that result in significantly higher risk levels for CIs as compared with those encountered by other organizations. The conclusion section offers some best practices and suggests ways to use technological innovations to make CIs more resilient and better protected in the face of a brave new world of connectivity and threats from cyber space. Your Critical Infrastructure is No Longer Immune to Cyber Attacks Confidential 3 WHITEPAPER MORE THREATS THAN EVER, NO SLOWING DOWN The way things stand in the world of online threat nowadays, the information revolution and Internet connectivity have brought with them the threat of constant cyber-attacks that increase in number every year. Looking at some statistics, 2013 was the seventeenth record year for phishing attacks, with over 450,000 incidents. The number of phishing attacks have increased every single year since 1996 when this type of cyber threat started gaining momentum. On the malware front, new malicious code of all types exceeded the 20 million variant mark in the third quarter of 20131, and the tally grows every year. In fact, one AV vendor2 claimed that 20% of all malware ever invented saw light in 2013. Another stark example is mobile malware. 2014 marks the tenth anniversary of this threat, which saw a major boom throughout the past four years, evolving to include Trojans, spyware, adware, and most troubling – leveraged in the facilitation of targeted cyber espionage attacks. Researchers3 note having found an average of 272 new malware variants and five new families per month in 2013. In a report released late March 2014, it was further indicated that mobile malware and high risk apps reached the 2 million milestone, which is double the number reported a mere six months earlier. The picture is clear: the number of threats and attacks they are used in is growing exponentially and their rapid evolution is unstoppable. CONCURRENTLY INCREASING THREAT SOPHISTICATION Beyond their sheer number, cyber threats and the attacks experts who see the escalation first hand. Take for they are linked with have also been evolving in terms example the espionage operation dubbed Careto / of sophistication. This trend holds true for commercially The Mask; the campaign was named “One of the most available threats, sold in underground markets, where a new, advanced global cyber espionage campaigns to date5” notable maturity has been emerging, pointing to greater by Kaspersky Labs researchers. sophistication, stealthier malware, and better encryption keeping attackers anonymous and out of sight4. Another recent example is the Uroburos APT; it was named “one of the most advanced rootkits we have ever analyzed”, It is quite alarming that the same progression applies by G-Data’s research team. to targeted attacks (and advanced persistent threats). Carefully tailored to their victims’ systems, APTs are made To that effect, in a recent interview at the RSA Conference to circumvent existing security, infiltrate the infrastructure, 2014, Wade Baker, principal analyst at Verizon, noted: and slowly make their way toward the final mark. Those targeted attack schemes are one of the top concerns for security teams in all types of organizations. “…The bad guys are winning at a faster rate than The notable, increased intricacy of the targeted breed the good guys are winning and we’ve got to of cyber-attacks is frequently underscored by industry solve that; we’ve got to do something different. ” Phishing: Over 450,000 unique attacks in 2013 Malware: Tens of millions of variants per quarter in 2013. 20% of all malware ever was released in 2013. Mobile Malware: On average 272 new malware variants and five new families per month in 2013. Variant count doubles within six months from 1 million to 2 million. 1 Source: McAfee Labs 2 Source: Panda Security 3 Source: Symantec 4 Source: RAND Corp. 5 Source: Kaspersky Labss Your Critical Infrastructure is No Longer Immune to Cyber Attacks Confidential 4 WHITEPAPER EVERYONE IS AFFECTED – Another quote on the subject came from former head of the NSA Gen. Keith Alexander (see side bar). In a speech to the BUT CIs SEE HIGHEST IMPACT senate, Alexander described the imminence of a devastating cyber-attack that would affect critical infrastructure and the High profile cyber-attacks publicized over the past five years population as a whole, indicating it was only a matter of time have organizations of all sizes more invested than ever in before such a scenario becomes reality. protecting their sensitive data and that of their customers. Nevertheless, adversaries still seem to be getting through, disrupting, destroying, stealing intellectual property and valuable, sensitive data even from organizations with the WHERE ARE CIs VIS À VIS largest security budgets. THESE THREATS? The list of victims exposed in the aftermath of large scale operations is widely diverse. While some industries suffer Facing the increasing threats and the new means attackers more attacks than others, not one sector is exempt from the have nowadays to infiltrate organizations and inflict harm, threats posed by hackers and attackers, which can result in critical infrastructure IT security teams are under major customer data breaches, bank account heists, intelligence pressure to find ways to secure their mixed environments collection, and the theft of invaluable intellectual property. of machines, computers and connectivity. Well known cases of targeted attack campaigns, like The task is daunting; much more daunting in fact