SIEM deployment in OT environments

Posted on 14/11/2019, by
INCIBE (INCIBE)
SIEM OT
Today, it is common to find SIEM deployed in the IT infrastructures of all kinds of organisations, to be able to monitor and analyse security alerts in applications, systems, network devices, etc. However, though time and resources are being invested in industrial environments, it is still unresolved.

Aurora vulnerability: origin, explanation and solutions

Posted on 26/09/2019, by
INCIBE (INCIBE)
Aurora_ICS
Perhaps, given the many important cybersecurity leaks and intrusions in recent years involving everything from social media accounts to critical infrastructure and classified military secrets, the attention paid to the Aurora vulnerability has not been proportional to its seriousness and systems affected. This is because it affects almost every electrical system in the world, and potentially any rotating equipment, whether it generates energy or is essential for an industrial or commercial installation. If the threat is so widespread, why isn’t the industry more worried and actively looking for solutions? From this article various possible reasons for this are given.

My industrial devices support LDAP, now what?

Posted on 19/09/2019, by
INCIBE (INCIBE)
Keyring
The main security standards and best practice guidelines in industrial cybersecurity include as a requirement the need for a user authentication system. The options involve implementations in each device of this system or being integrated into a centralised user authentication system. One of the most-used options is the use of the LDAP protocol, but there are a number of points to consider in the design phase, which are key when implementing a specific centralised user management system for industrial control systems, under LDAP.

Attacking a BusyBox, the small Gaulish village

Posted on 05/09/2019, by
INCIBE (INCIBE)
Busybox
A BusyBox is software or a program that combines several functionalities in a small executable. This small tool was created for use in integrated operating systems with very limited resources, and they are usually used in control systems. But, as in all tools, you have to know what security level they have and if it can be improved.

The importance of the cybersecurity strategy for the industry

Posted on 22/08/2019, by
INCIBE (INCIBE)
cybersecurity strategy
The union of the IT and OT worlds is unstoppable, which means that the cybersecurity strategy, traditionally focused on the IT field, must now include aspects related to the industrial world. Having a good cybersecurity strategy is essential for IC systems to survive in this new era.