Segmentados Administración sistemas y redes TI

Contenido Segmentados Administración sistemas y redes TI

En esta sección se ofrecen contenidos de interés para los profesionales en entornos TO que se ocupan de administrar y mantener aplicaciones, sistemas, equipos de redes, gestión de usuarios y accesos, servicios, soporte técnico y respuesta a incidentes de TO.

Las tareas de estos profesionales son muchas veces análogas a las de los profesionales de TI, con la salvedad de que tratan con sistemas en los que la disponibilidad es a menudo más crítica que la confidencialidad.

Microsegmentation of industrial networks

Updated on 31/10/2024, by
INCIBE (INCIBE)
microsegmentation of industrial networks decorative image
Larger scale and complexity industrial control networks present risks, and cybersecurity needs that usually cannot be met by applying a traditional segmentation model. Factors such as the presence of critical obsolete equipment, equipment managed by third parties or the increased presence of IoT technologies that require external connections, are motivating the adoption of more advanced architectures when applying the principle of defense in depth.Proper segmentation can be a fundamental aspect in preventing attacks, especially in their propagation to essential and critical production assets. It is also important to adapt to the environment to be segmented. It is a common mistake to try to segment networks based on concepts and schemes like the IT environment.This article will present some new network models and tips to work on a correct segmentation in an environment where different components are involved (OT, IIoT, IT, IoT).

Using the Calera OT tool

Posted on 19/09/2024, by
INCIBE (INCIBE)
Using the Calera OT tool cover
MITRE Caldera OT stands out mainly for being an open-source tool that allows the simulation of different cyber-attacks in industrial environments. This tool was created by MITRE and CISA (US Cybersecurity and Infrastructures Security Agency), as the experts saw the need to be able to improve and understand cybersecurity in industrial environments without using a high number of resources.In addition, this tool is designed to be used by both the Red Team and the Blue Team, allowing both teams to collaborate with each other to improve the level of cyber security in these environments.

Fuxnet: the malware that paralyzed ICS systems

Updated on 26/09/2024, by
INCIBE (INCIBE)
Portada de blog Fuxnet: El malware que paralizó sistemas SCI
The increasing development of malware targeting the industrial world has not halted its momentum in the slightest. Several research groups have detected a new malware called Fuxnet and are currently investigating its scope. This malware has the capability to send specific requests at the serial level, via RS485/MBus, executing floods to more than 87.000 assets, including control systems and integrated sensors deployed across different sectors. Among the infrastructures compromised by this malware, we find hospitals, airports and other critical infrastructures that provide essential services to the population.

ICS risk analysis

Updated on 12/09/2024, by
INCIBE (INCIBE)
Blog image Análisis de riesgos en SCI
In the era of interconnection and digitization, industrial control systems (ICS) are increasingly exposed to cyber threats. These systems are vital for energy production, manufacturing and critical infrastructure management, and their protection has become an essential priority.Risk analysis is fundamental in this context, as it allows identifying, assessing and prioritizing the risks that can affect ICS. This process, ranges from technical vulnerabilities to emerging threats, and is crucial for developing effective mitigation and protection strategies.In this article, the challenges and solutions related to risk analysis in ICS will be explored, as well as the importance of the IEC 62443-3-2 standard in this critical process.

Cybersecurity challenges of digital twins: threats and security measures

Updated on 02/09/2024, by
INCIBE (INCIBE)
Imagen de portada del blog gemelos digitales
The digital twins are virtual recreations of real-world objects or processes. This innovative idea, proposed by Dr. Michael Grieves, has become increasingly relevant in various industrial sectors thanks to the advancement of technologies such as 3D modelling, the Internet of Things (IoT), the IIoT (Industrial Internet of Things), machine learning and big data. Its application makes it possible to simulate and analyse physical processes efficiently, thus contributing to the digital transformation of industry, also known as Industry 4.0.The fundamental purpose of digital twins is to facilitate the understanding of how elements operate in the physical world. For example, in manufacturing, it is possible to create a digital twin of a factory and through simulations explore different scenarios: what would happen if a machine were modified, how would it impact production, and what would happen if a machine were changed? The digital twin provides answers before real changes are made to the physical environment, speeding up decision-making and optimising processes.

Deception ICS

Posted on 14/08/2024, by
INCIBE (INCIBE)
Portada del blog Deception SCI
Durante este artículo indagaremos en el funcionamiento y objetivos de una nueva tecnología de nueva adopción en el campo de la ciberseguridad, consistente en la creación de señuelos o información engañosa dentro de un Sistema de Control Industrial, permitiendo detectar y retrasar la intrusión de un ciberatacantes en un tiempo menor.

Cybersecurity in the agri-food industry

Updated on 22/08/2024, by
INCIBE (INCIBE)
Portada del blog La ciberseguridad en el sector agroalimentario
The agri-food sector is one of the most critical sectors today because it is one of the most important sectors for the country's economy, as it produces food.This sector, like many others, is in continuous evolution. An example of this is the automation and digitalization of the many processes that are carried out. These new technologies bring many advantages, such as more efficient processes, less water consumption, detection of possible risks, etc. These great advantages also bring with them some problems, such as increased exposure to cyber-attacks.Therefore, this article provides some basic knowledge to make the industry aware of the importance of implementing cybersecurity in their technologies. 

Cybersecurity applied to railway technology

Updated on 01/08/2024, by
INCIBE (INCIBE)
Imagen decorativa del blog
Today, rail transport is a key strategic sector, both for the transport of people and goods of all kinds. It is also a sector in constant evolution and progress, which has adopted new technologies, from Wi-Fi zones for employees and customers, to new remote distributed control technologies, GPS and IoT.While all applied technologies provide many advantages, they can also bring problems and introduce cybersecurity risks. The objective of this article will be to raise awareness of some of the most important cyber-attacks that have occurred in the industry and to contribute to the general awareness of the evolution of railway cybersecurity and cyber-attack protection measures available to the industry. 

Mapping between NIST FW and IEC 62443 2-1

Updated on 18/07/2024, by
INCIBE (INCIBE)
Cover blog NIST FW
There are currently many standards and regulations in the industrial sector. A wide variety of them allow industrial organizations to check their level of maturity, such as IEC 62443, or to improve the security level of the organization through the application of a series of guidelines, good practices or guides, as in the case of the NIST Framework.Given the growth of the industrial sector, and the increase in capabilities, both in production and connectivity, thanks to the consolidation of Industry 4.0 and the emergence of Industry 5.0, industrial environments are in the focus, not only of technological improvements, but also of cyber-attacks.The application and implementation of the IEC 62443 family, in combination with the NIST Framework, will enable organizations to reduce, mitigate and control the possibility of suffering a cyber-attack by implementing the controls and best practices defined in both standards.

UMAS and the cybersecurity of this communications

Updated on 11/07/2024, by
INCIBE (INCIBE)
Cover UMAS
UMAS (Unified Messaging Application Services) is a Schneider Electric (SE) proprietary protocol used to configure and monitor Schneider Electric programmable logic controllers (PLCs). While it is true that the protocol is related to this manufacturer, the use of the protocol is quite widespread in different sectors, especially the energy sector, as is obvious.The article will focus on the technical breakdown of the protocol and the use of the protocol. The article will also show weaknesses, strengths and some technical vulnerabilities detected in this protocol.

Protocols and architectures in IIoT environments

Updated on 27/06/2024, by
INCIBE (INCIBE)
Portada blog IIoT
In today's business landscape, the digital revolution has led to an unprecedented transformation, and at the epicenter of this evolution are Industrial Internet of Things devices (IIoT). These devices, skilled in collecting and transmitting data in real-time, have emerged as fundamental pillars, that drive operational efficiency and decision-making in industrial environments.From advanved sensors to smart sctuators, the network of IIoT devices implemented in the industrial fabric is improving the frontiers of connectivity, impacting the way companies design, implement, and manage their operations.In this article, we will learn about the role of these devices within Industry 4.0, analyzing how different types of architectures are implemented and how their communications protocols shape the future of the industry. 

New 2024 cybersecurity regulations for vehicles

Posted on 13/06/2024, by
INCIBE (INCIBE)
cybersecurity regulations for vehicles study cover
The UN R155 and UN R156 regulations are of vital importance for vehicle cybersecurity. From July 2022, all car manufacturers that want to be type-approved must comply with both regulations, but from July 2024 this requirement will be extended to all new vehicles sold in the European Union, regardless of when the manufacturer obtained type-approval. One of the most important aspects of compliance with both regulations is the completion of a cybersecurity risk assessment of the vehicle, including all integrated components of the vehicle's supply chain. On the other hand, it also specifies how to incorporate cybersecurity from design, how to detect and respond to incidents, how to securely update vehicle software, etc.