POWER September 2015 - 56

CYBERSECURITY
Four Stealthy Cyber Attacks
Targeting Energy Companies
Newer types of cyber attacks are harder to identify and protect against than previous
types because they can bypass traditional cybersecurity defenses.
Jason Glassberg
I
t's certainly no secret that for many years,
the power industry has been a top target
for hackers around the world. However,
whereas in the past, many of these attacks
were relatively easy to block using standard
security tools like malware detection
software, firewalls, and intrusion detection
systems, recent advances by state-sponsored
hacking teams and criminal groups have
made these attacks considerably more sophisticated
and harder to prevent.
That's likely a key reason why 68% of
energy companies and others in the critical
infrastructure sector admit they've been
breached by hackers, resulting in either data
loss or disruption of operations, according
to a 2014 estimate by Unisys and Ponemon
Institute.
The reality today is that these attacks are
far stealthier than anything the industry has
seen before. And the increasingly complex
nature of these cyber attacks corresponds directly
with the growing level of danger they
pose to the power sector.
In 2013 the Department of Homeland Security
(DHS) issued an industry-wide alert
about the growing threat of cyber sabotage
attacks to the power sector after its incident
response teams noticed an alarming trend
of hackers, possibly from the Middle East,
systematically breaching U.S. energy companies
in an effort to probe their networks
and determine how to take control of key
processing systems.
This warning was echoed by National
Security Agency Director Admiral Michael
Rogers in 2014, when he testified before
Congress about the growing threat of cyberinduced
power outages and disruptions by
foreign governments.
No longer is the theft of trade and technology
secrets, or customer data, the top hacking
threat for power companies. Instead, their
security teams need to be actively preparing
for a new wave of stealthy cyber attacks that
could be used as a precursor to industrial
control system (ICS) " probes " and physically
disruptive attacks. While there are a number
56
of different attacks now used by hackers,
power companies should focus on these four:
cross-site scripting, drive-by downloads,
wrappers/packers, and watering holes. All of
them can potentially bypass traditional defenses
(including both security tools and employee
security awareness training) and gain
remote access to the network or infect it with
dangerous malware.
Understanding the Threat
There are essentially five ways a hacker can
gain access to an ICS:
■ Get direct physical access to the ICS (such
as via a malicious employee or contractor
or an infected hardware device).
■ Find an open Internet-facing port on a
control system device using the Shodan
search engine or a specialized scanning
tool.
■ Steal an employee's credentials or password
to a web application, which is used
to access the ICS.
■ Bypass the security configuration of the
above-mentioned web application to get
access to the control system without a
password.
■ Install specialized malware on the energy
company's network that is capable of
spreading to the control system.
Out of all of these threats, open Internetfacing
ports should be the easiest to prevent
simply by auditing the ICS and doing an
external search of the network using Shodan.
Insider threats are a different breed altogether,
and require strict access controls
for employees and contractors, as well as
background checks, regular supervisory
oversight, employee auditing and monitoring,
and a diligent password reset policy for
terminated personnel.
For the purposes of this article, we'll be
1. Weakest link: employees. Courtesy: Casaba Security
Cybercriminal
sends a phishing
email with a
legitimate-looking
URL
Employee clicks
on the link,
launching
the attack
Hacker gets
remote access
to ICS interface
Compromising ICS by
Targeting Employees
The attack goes
undetected
by the
company's
monitoring
systems
A malicious script
attacks the ICS
web application
directly, steals
user credentials
or leads to
hard drive infection
As the page
opens, the
victim is
exploited within
the browser
www.powermag.com
POWER | September 2015
http://www.powermag.com
POWER September 2015

Table of Contents for the Digital Edition of POWER September 2015
