In fact, industrial control system networks often lack the various security protocols that have been used in networks for more than two decades. And the one-and-done slogan in the network leads to versions that are outdated and unsupported etc. making it easier for attackers to exploit them. For example, attackers launched a weaponized virus and targeted specific oil and energy companies. It focuses on securing old kernels that were in the network months if not years ago. Many claim the attack was more destructive and directly impacted the environment than the industry had seen before. Any manufacturing facility, industrial operation, or critical infrastructure can become ground zero for a devastating attack if threats to the network are not addressed. Attackers use similar stages as they do in their environment including reconnaissance mapping weaponized installation and execution.
In many cases the first two phases can take longer than the Germany Email Database attack itself. This is typical because finding a vulnerability to exploit takes time and attackers are careful not to set off an alarm by doing a lot of probing. The rule set governing the threat environment may include scanning and port knocking on the reconnaissance side and denial of service malware ransomware and special targets on the attack side. There are a few key areas that a security professional must consider when tasked with creating a ruleset optimized for the environment. They must strike a balance between developing quality rules to catch detection and reconnaissance even over long periods of time while eliminating false positives or false negatives at the same time.
Building these types of rule sets requires a great deal of knowledge and expertise in security and infrastructure so you can be alerted to relevant threats to your network. Rules are created and collected from many sources. They are tested and implemented into security products and solutions to provide the necessary protection for the new security realities that exist in today's environment. To keep your network safe from new developments and activities that are constantly evolving you must update your rules. Every environment is different so part of the art is fine-tuning the ruleset for each specific environment to catch every attempted attack while still doing business as usual.
|
發表於