Blog

The Resource Public Key Infrastructure (RPKI) is essential for Internet routing security, as it provides a method to securely connect IP addresses to autonomous systems (AS) by validating route information. RPKI effectively prevents BGP Hijacking-type attacks, where potential attackers maliciously redirect Internet traffic. This article aims to explore the design, implementation, and benefits of using RPKI to ensure security and authenticity in Internet routing.

After the pandemic, it has been observed that the healthcare sector has been one of the most attacked by cybercrimilas and organizations. This has generated a significant impact on the affected organitations, making it essencial to protect this sector due to its strategic nature and to achieve this, it is neccesary to understand its characteristics and the threats that affect it.

Article summarizing the Industrial Control Systems (ICS) alerts published during the year 2023 on the INCIBE-CERT website, with emphasis on different indicators, such as criticality, type of attack, etc.The motivation is to give the published notices an added value, in order to compile the information of the whole year as a logbook. In addition, this type of article was well received in previous years, showing in several talks the graphs of the article to argue the exponential growth of vulnerabilities in ICS. 

The OPC UA (OPC unified architecture) communication protocol is the most modern standard presented by OPC Foundation. Currently, the OPC UA protocol is one of the most widely used in industrial environments, due to its ability to interconnect different devices, regardless of their base protocol and vendor.Throughout this article, a technical assessment of the protocol will be conducted, explaining in detail the technical capabilities that allow a high level of cybersecurity to be implemented without causing performance losses in the devices. 

Ransomware, one of the top cybersecurity threats in today's landscape, allows criminals to hijack data and demand ransoms. Although there are various families and variants, some are especially destructive. These cybercriminals have refined their methods, using everything from complex extortion to bug bounty-type programs. In the face of these challenges, we will explore tools and strategies to recover from and defend against such attacks.

Second part of the Top 20 mitigations for industrial environments. This part will focus on mitigations related to network architecture, industrial protocols, network configuration and vulnerability scanning.

In the industrial world, there are a large number of systems, equipment, networks, areas, ducts, cloud environments, IT-OT environments, etc. In recent years, the number of attacks on industrial environments has been growing exponentially, and not only on purely industrial environments, but also on corporate environments that are connected to industrial environments. These IT environments being access points for attackers due to this IT/OT connectivity.

Managing and predicting vulnerabilities has become an essential task for cybersecurity. The Exploit Prediction Scoring System  (EPSS) is a methodology launched in 2019, which uses algorithms and threat intelligence data to predict the likelihood of a specific vulnerability being exploited by threat actors in a short space of time.In an environment where organizations are faced with an increasing number of vulnerabilities, EPSS effectively prioritizes responses to vulnerabilities based on their risk of exploitation. Through meticulous information collection and analysis, this system offers an efficient view of the threats affecting the business, allowing organizations to act proactively. This article focuses on understanding EPSS, how it improves security posture, and best practices for its implementation. 

The security gaps and issues that exist within industrial environments are sometimes unknown to many information consumers. This article aims to bring first hand some of the most interesting issues and attack trends in 2023 in the industrial sector. Different industrial cybersecurity incidents so far this year will be described at a high level and a comparison will be made with the trend presented at the beginning of the year.