All Articles by Ryan Bringhurst
TSA Will Issue New Cybersecurity Regulations on Railroad and Aviation Industries
The Transportation Security Administration (TSA) will impose new cybersecurity regulations on the railroad and airline industries, including reporting requirements as part of a department effort to force compliance in the wake of the high-profile cyber attacks on critical industries [1]. The regulations will come later this year for aviation and railroad transit systems. The TSA will issue separate guidance that encourages, rather than requires, lower risk entities from other transportation sectors to take the same measures, according to Mayorkas [2]. The new regulations will require transportation industries to meet a cybersecurity baseline, instead of a voluntary cybersecurity incident reporting.
Dragos Discusses Possible Vulnerabilities in Positive Train Control (PTC)
ICS security vendor Dragos released a blog post discussing possible weaknesses in the US government-mandated Positive Train Control (PTC) system. PTC technology is designed to prevent train-to-train collisions or derailments caused by unauthorized train movement onto sections of track where maintenance activities are taking place. Dragos expressed concerns that wifi and cellular modems used in PTC installations may provide attack paths for various threat actors. Dragos mentioned Meteorcomm as “the single supplier across most PTC installations in the U.S.” and warned that “a vulnerability in the design of Meteorcomm PTC radios would likely impact rail infrastructure across the country.” While we are unaware of the public disclosure of such vulnerabilities, the specificity of Drago’s comments and the recent TSA announcement of impending regulations for the rail transportation sector [2], may raise concerns. We recommend rail transportation providers check the configuration of these wireless PTC systems.
aDolus Raises $2.5 Million For Supply Chain Security
aDolus Technology, an industrial cybersecurity vendor, announced they have raised $2.5 million to expand its Framework for Analysis and Coordinated Trust (FACT) platform [1]. FACT generates enriched software bills of materials (SBOMs), a formal record containing the details and supply chain relationships of various components used in building software [2]. By improving understanding of software components, including third party and open source software, organizations can better identify and manage risks associated with software vulnerabilities.
Siemens and Merck KGaA Implement Better Solutions for Machine-to-Machine Trust
Siemens and Merck KGaA plan to develop and implement digital trust solutions in machine-to-machine (M2M) value chains. This implementation would help industrial customers comply with stricter regulations in the value chain in different countries and in a wide variety of industrial sectors [1-2]. Given the current complexity of value chains, and pressure for interoperability, the partnership envisions implementing smart contracts, tokens, and blockchain technologies to provide enhanced traceability, transparency and quality control.
Rockwell Automation Announces New Initiatives to Bolster Cybersecurity Offering for Customers
Rockwell Automation announced new investments to enhance its IT and OT cybersecurity offering, which would better equip customers with the protection they need in today’s perilous environment. These initiatives include strategic partnerships with Dragos and CrowdStrike, as well as the establishment of a new Cybersecurity Operations Center in Israel [1]. The partnership will focus on initiatives for CrowdStrike’s cloud-native, AI-powered Falcon Platform in combination with Rockwell’s global deployment, network architecture, support, OT, and managed service capabilities to deliver differentiated solutions that address customers’ needs. These services plan to be remote capable and will increase the speed in which customers can access and remediate a cybersecurity threat [2]. We suggest companies investigate ways to further increase cybersecurity defense capabilities such as what Rockwell and CrowdStrike are researching.
Water Sector a Weak link in Cybersecurity
The Foundation for Defense of Democracies (FDD) revealed in a memo that the cybersecurity of the water sector is a potential weak link in the national infrastructure, which could affect health and human safety, national security, and economic stability [1]. Cybersecurity deficiencies observed in the drinking water and wastewater sectors result in part from structural challenges [2]. The United States has approximately 52,000 drinking water and 16,000 wastewater systems, most of which service small- to medium-sized communities of less than 50,000 residents [3]. As every human and industry in the United States relies on water and water treatment systems. We recommend accountability of automation and cybersecurity systems in the water and water treatment industries. We recommend the sector employ appropriately qualified personnel to oversee these systems.
Applied Risk Releases Report Revealing Companies are Struggling to Keep Up with Cyber Attack Defenses
Applied Risk released a report revealing that companies are struggling to develop their OT (operational technology) security defenses at a pace comparable to the speed of cyber-attackers. The OT landscape is becoming more and more complex due to a convergence between information technology, operational technology, and cybersecurity. The report can be found in the sources link below [1]. The report takes into account issues that surround people, processes, and technologies that underlie current conditions in OT security. The report notes the sector has been shaped by numerous factors including lower-than-ideal staff levels, supply chain issues, nation-state attacks, rising number of sophisticated cyber-attacks, adoption of risk-based and OT-specific standards, and the failure to adopt enabling technologies. We suggest all companies to stay up to date on guidance from the industry's best cybersecurity professionals.