Industrial Control Systems
Cyber Attacks: Protecting National Infrastructure
July 15, 2012 Added by:Ben Rothke
Protecting “systems and assets, whether physical or virtual, so vital to the United States that the incapacity or destruction of such systems and assets would have a debilitating impact on security, national economic security, national public health or safety, or any combination of those matters”...
Comments (0)
Free Power on the Grid?
July 15, 2012 Added by:Jayson Wylie
Sometimes the wrong people get the code and use it maliciously. It is in the nation’s best interest to keep the power infrastructure safe and keep meters fool proof, but it depends on how effective a tool is to be able to effectively manipulate the technology to an individual’s own financial advantage...
Comments (0)
Yahoo Voices Accounts Exposed and Available to the General Public
July 13, 2012 Added by:Marc Quibell
If Yahoo took "security very seriously" this probably may not have happened. This is obviously a fail in their IT Security practices, on many accounts, beginning with the SQL Injection attack used to compromise the server - yes, it only took one server to compromise for this to occur...
Comments (0)
NIST: Test Framework for Upgrading Smart Electrical Meters
July 13, 2012 Added by:Infosec Island Admin
"Companies will be able to tailor these generic test criteria to their own systems. To make it an effective framework, we made sure that it contains consistent, repeatable tests they can run, producing documentation that contains adequate, accurate information regardless of the individual system..."
Comments (0)
What Actions Do Your Security Metrics Promote?
July 12, 2012 Added by:Tripwire Inc
“It is possible to focus on a single metric and drive it up or down, but wreak havoc on the organization through unintended side effects. Some organizations have to deal with some people “gaming the metrics”, which again can lead to unintended side effects. Other organizations use metrics as a way to begin a conversation..."
Comments (0)
EU-US Workshop on Cyber Security of ICS and Smart Grids
July 12, 2012 Added by:Infosec Island Admin
ICS and the smart grids are two of these priority areas identified by the EU-US WG. In the last decade, these systems have been facing a notable number of incidents, including the manifestation of Stuxnet which raised a lot of concerns and discussions among all the actors involved in the field...
Comments (0)
Shodan: There is Now an App for That
July 11, 2012 Added by:shawn merdinger
Since October, 2010, Shodan has consistently made waves in the information security world. Like any security tool, Shodan can be leveraged by both malicious attackers and legitimate security operations to gain insights into the public IP exposure of an organization. Now enters the Shodan App...
Comments (1)
NIST Guidelines for Securing Mobile Devices in the Enterprise
July 11, 2012
The purpose of this publication is to help organizations centrally manage and secure mobile devices against a variety of threats. This publication provides recommendations for selecting, implementing, and using centralized management technologies, and it explains the security concerns inherent in mobile device use...
Comments (0)
ICS-CERT: Removable Media Flash Drive Attacks
July 10, 2012 Added by:Infosec Island Admin
A shift supervisor was using a portable flash drive for downloading information from an HMI connected to the industrial control systems. Antivirus scanners run on the removable media, the HMI machine, and other systems found the Hamweq virus on the removable media, but the other systems were clean...
Comments (0)
ENISA Report: Ten Smart Grid Security Recommendations
July 10, 2012
By making energy distribution more efficient, smart grids give clear benefits to users, electricity suppliers, grid operators, and society as a whole. At the same time, their dependency on computer networks and Internet makes our society more vulnerable to cyber-attacks, with potentially devastating results...
Comments (0)
ICS-CERT: WellinTech KingView and KingHistorian Vulnerabilities
July 09, 2012 Added by:Infosec Island Admin
Researchers have identified multiple vulnerabilities in WellinTech’s KingView and a single vulnerability in WellinTech’s KingHistorian application which are exploitable remotely and could lead to arbitrary code execution, information disclosure, and denial of service...
Comments (0)
ICS-CERT Incident Response Summary Report
July 05, 2012
DHS Control Systems Security Program operates ICS-CERT to provide focused operational capabilities for defense of control system environments against emerging cyber threats. This report provides a summary of cyber incidents, onsite deployments, and associated findings from 2009 through the end of 2011...
Comments (0)
ICS-CERT: Pro-Face Pro-Server EX Multiple Vulnerabilities
July 04, 2012 Added by:Infosec Island Admin
The vulnerabilities affecting Pro-face Pro-Server include invalid memory access, integer overflow, unhandled exception, and memory corruptions. Each of these vulnerabilities are remotely exploitable, and public exploits are known to target these vulnerabilities...
Comments (0)
Electricity Subsector Cybersecurity Capabilities Maturity Model
July 03, 2012
The goal of the Electricity Subsector Cybersecurity Capability Maturity Model (ES-C2M2) is to support ongoing development and measurement of cybersecurity capabilities within the electricity subsector. The model was developed to apply to all electric utilities, regardless of ownership structure, size, or function...
Comments (0)
ICS-CERT: Sielco Sistemi Winlog Multiple Vulnerabilities
July 02, 2012 Added by:Infosec Island Admin
Sielco Sistemi Winlog Version 2.07.14 can be exploited remotely by sending specially crafted requests to TCP/46824. ICS-CERT is issuing this alert to provide early notice of the report and identify baseline mitigations for reducing risks to these and other cybersecurity attacks...
Comments (0)
ICS-CERT: GE Intelligent Platforms Proficy HTML Vulnerability
June 28, 2012 Added by:Infosec Island Admin
Andrea Micalizzi identified a command injection vulnerability in a third-party HTML help application used by some GE Intelligent Platforms Proficy products. GE identified a stack-based buffer overflow vulnerability that also existed in the same component. An attacker could exploit these vulnerabilities...
Comments (0)
- Improving Security by Failing Faster
- BYOD: Should It Be the Wave of the Future?
- Trend Micro Discovers "SafeNet" - a New Targeted Espionage Operation Online
- Managing My Company’s Security is a Nightmare
- Bridging the Cybersecurity Divide, Why Security Innovation Must Lead the Way
- The Evolution of Industrial Control System Information Sharing
- ATM Security (And Really Learning from the Past)
- Complimentary IT Security Resources [May 13, 2013]
- Steps Toward Weaponizing the Android Platform
- Mobile Security Processes Could Be Applied to Medical Devices: Bluebox