Enterprise Network Protection against Cyberattacks: Black Energy

View Enterprise Network Protection against Cyberattacks: Black Energy

The Internet has made the world more connected, allowing people to connect to almost everything from personal devices and home appliances to transportation, utilities, and industrial systems. But this interconnectivity comes at a price: they're open to cyber attacks that could impact more than just information loss.

The recent attack against power facilities in Ukraine is an example of a threat with real-world impact. Executed using malware identified as BlackEnergy and KillDisk, the attack did not end with information theft, as often seen in cyber-attacks, but something much worse: it destabilized a country’s critical infrastructure. And they did it by relying on one of the most intrinsic and inherent flaws in any network: the human factor. With the use of spearphishing—a tactic that depends on deception to work—a group of threat actors managed to bring down an entire power grid. It also subsequently affected a top mining facility, followed by a major rail transit company.

[Report: First malware-driven power outage reported in Ukraine]

What makes this particular attack noteworthy—and an alarming portent of things to come—is that it exposed how vulnerable critical facilities are, now that they’re connected to the Internet. It also demonstrated how, in our desire to get everything conveniently ‘online’, we’ve neglected to secure systems that are in desperate need of securing. Cybercriminals now know just how vulnerable these facilities are and how easy they are to attack, and it could be a sign that we should expect more such incidents in the months (or even days) to come.

Now, more than ever, we need to take cybercrime seriously. We need to take online security seriously, not just in the solutions we install on our systems, but also in the education and expertise of those handing the systems themselves.

Because like we’ve predicted—and reported—countless times before, the lines of reality are blurring. Attackers are getting bolder, their tools becoming more sophisticated, and their methods more refined.

Get the full details of BlackEnergy in the primer, The Ukrainian Power Facility Attack.

Visit the Threat Intelligence Center for more on ICS and SCADA systems and industrial cyber security.