Top 20 ICS mitigations during 2023. Part 2

Posted on 28/12/2023, by
INCIBE (INCIBE)
Top 20 ICS mitigations during 2023. Part 2
Second part of the Top 20 mitigations for industrial environments. This part will focus on mitigations related to network architecture, industrial protocols, network configuration and vulnerability scanning.

Top 20 ICS mitigations during 2023. Part 1

Posted on 21/12/2023, by
INCIBE (INCIBE)
Top 20 ICS mitigations during 2023. Part 1
In the industrial world, there are a large number of systems, equipment, networks, areas, ducts, cloud environments, IT-OT environments, etc. In recent years, the number of attacks on industrial environments has been growing exponentially, and not only on purely industrial environments, but also on corporate environments that are connected to industrial environments. These IT environments being access points for attackers due to this IT/OT connectivity.

EPSS: advancing in vulnerability prediction and management

Posted on 14/12/2023, by
INCIBE (INCIBE)
EPSS: advancing in vulnerability prediction and management
Managing and predicting vulnerabilities has become an essential task for cybersecurity. The Exploit Prediction Scoring System  (EPSS) is a methodology launched in 2019, which uses algorithms and threat intelligence data to predict the likelihood of a specific vulnerability being exploited by threat actors in a short space of time.In an environment where organizations are faced with an increasing number of vulnerabilities, EPSS effectively prioritizes responses to vulnerabilities based on their risk of exploitation. Through meticulous information collection and analysis, this system offers an efficient view of the threats affecting the business, allowing organizations to act proactively. This article focuses on understanding EPSS, how it improves security posture, and best practices for its implementation. 

Attack trends in the industrial sector during 2023

Posted on 30/11/2023, by
INCIBE (INCIBE)
Attack trends in the industrial sector during 2023
The security gaps and issues that exist within industrial environments are sometimes unknown to many information consumers. This article aims to bring first hand some of the most interesting issues and attack trends in 2023 in the industrial sector. Different industrial cybersecurity incidents so far this year will be described at a high level and a comparison will be made with the trend presented at the beginning of the year.

Securing routing: challenges and solutions in BGP

Posted on 23/11/2023, by
INCIBE (INCIBE)
Securing routing BGP
The Border Gateway Protocol (BGP) is fundamental to the functioning of the Internet as we know it, as it serves to route data flows along the optimal routes, through several different hops (or IPs). However, it was not designed with security by design, which opens the door to hijacking BGP-type  threats. Through these types of attacks, malicious actors can redirect traffic, causing data loss, such as  in Man-in-the-Middle, among others. This article explores in depth these types of attacks, their impact, and the countermeasures available through mechanisms such as RPKI, IRR, and ROA. 

Open Intelligence in Industry: An Analysis of OSINT

Posted on 16/11/2023, by
INCIBE (INCIBE)
Inteligencia abierta en la industria: un análisis sobre el OSINT
OSINT (Open-Source Intelligence) is a technique that focuses on the collection, evaluation and analysis of public information through different methods and techniques, with the objective of discovering vulnerabilities or collecting sensitive information that could become threats. It should be emphasized that the data collection is not called OSINT, it would be raw information. Once this information is evaluated and treated, it could be said that we are really talking about open-source intelligence (OSINT).Initially it has been used in the military and government sector. Its use in OT, with disciplines such as SIGINT (Signals Intelligence), IMINT (Imagery Intelligence) or even 'Sock Puppets' (fake profiles or intruders in technical forums) is making havoc due to the criticality of this equipment. Disinformation or the compilation of sensitive industrial technical information are some of the serious consequences that this sector is exposed to.

Avaddon: response and recovery actions

Posted on 09/11/2023, by
INCIBE (INCIBE)
Avaddon: response and recovery actions
The  Avaddon ransomware appears as a disturbing threat that has demonstrated its ability to exploit vulnerabilities in systems, compromising the security and integrity of critical data. This article dives into the details of how Avaddon works, while also providing a comprehensive analysis of strategies to detect and mitigate the threat. 

Hive: response and recovery actions

Posted on 04/11/2023, by
INCIBE (INCIBE)
Hive: response and recovery actions
The  Hive ransomware (especially in its v5 version) stands out for its sophistication, and for the impact caused to hundreds of companies and organizations worldwide, bypassing conventional defenses and challenging analysts with its advanced techniques.In this article, we unravel its features, from its encryption methods to its anti-analysis countermeasures, illustrating not only the threat it poses, but also how it can be combated. Through a technical analysis, it is intended to empower readers with the knowledge necessary to understand and ultimately defend against these types of threats.

Is it secure to charge your vehicle in publics places?

Posted on 02/11/2023, by
INCIBE (INCIBE)
¿Es seguro cargar tu vehículo en lugares públicos?
The automotive sector is currently moving towards electric consumption, as society is becoming more and more aware of the problems that environmental pollution can cause.One of the big challenges of this trend is how to charge electric vehicles, for which charging points are currently used.But like most of today's technological devices, they will also need to have access to an Internet connection in order to be able to monitor in real time the use of the station, the customer's banking information, etc.For this reason, in this article we want to talk about the different risks or cyber-attacks that these charging points may suffer and the problems they may cause, as this is a very important sector for society and one that is capable of managing very sensitive information