Blog

Honeypots and their implementation in a network, known as a honeynet, are a powerful tool for defending your system and safely monitoring the attacks carried out against it. In this article we will detail what honeypots are, their implementation in OT environments, the advantages and disadvantages of their implementation in the system and the latest honeypots developed for industrial control systems.

Not only is the interpretation of network traffic crucial to analyse the safety and performance of a network structure, but also for other tasks, such as incident management, the optimisation of our network infrastructure or for didactic purposes. In order to do so, it is necessary to have dissectors that help separate each of the fields that make up a protocol, and allow them to be individually analysed.

From the point of view of cybersecurity, access to automation and industrial control systems is one of the most critical control points and that's why special care must be taken when it comes to applying access security and fortification policies. On occasions, it is necessary to carry out remote tasks such as, for example, maintenance, upgrading or device or application management work. Thus, external personnel outside our company may perform said tasks, including manufacturers, wholesalers or providers of services, making it necessary to protect these accesses from potential threats.

I have identified a vulnerability in a device within an industrial control system... Now what? This article provides the guidelines to be followed when a vulnerability within an industrial control system is detected, and the different phases of this process.

It is increasingly common to find malware related to cryptocurrencies, either to use them as payment currency in extortions and illegal activities, cryptocurrency theft or infiltrate on systems and equipment from all areas to take advantage of the resources of the victims' equipment to undermine cryptocurrency

Computers used in control systems to perform a particular process usually have high costs due to their specialisation for a very specific task. But is it possible to manage a process with a small-dimension mass-produced generic system? In some cases, yes, and this is being increasingly demonstrated by low-cost hardware available to both industry and individuals.

In recent years, indicators of compromise have become the best way of exchanging information when it comes to managing an incident. But, do we really know how to manage an indicator of compromise? The aim of an indicator of compromise is to map the information that is received or extracted during the analysis of an incident. This is done in such a way that it can be reused by other investigators or affected people, in order to discover the same evidence in their systems and to be able to determine if they have been compromised or not.

The problems originating from the application of patches in an industrial setting have consequently led to them being rejected by the operators. For years they were practically abandoned, but thanks to the support from security companies and IT departments they are now receiving their due credit.

Today, we are unable to picture cars without a hands-free system, TVs which are not smart and a bunch of other devices without information processing systems. This can be achieved thanks to embedded systems, the use of which entails security risks.