I remember being taught about the big gas shortages of 1973 and 1979.
Back in grade school, times were certainly different then.
Gas was 89 cents a gallon and the first personal computer was still years away.
More importantly, gas lands would stretch for blocks and consumers
were only allowed to go get gas based on the last digit of their license plate.
Fast forward to 2021 and I find myself sitting on a very similar gas line,
this time for a very different reason.
The recent ransomware attack against Colonial Pipeline, which is responsible for nearly
half of the gasoline, diesel, jet fuel, and home heating oil
for the Eastern US, is the largest compromise of US critical infrastructure to date.
In today's video, we will discuss the threat landscape surrounding digital
critical infrastructure and why machine speed cyber threats
such as ransomware are becoming an increasing challenge for organizations
overseeing Industrial Control Systems, ICS, and Operational Technology, OT.
If you are new, welcome to the Darktrace YouTube channel.
We are the world's leading AI company for cyber security and
the pioneers of Autonomous Response technology.
My name is Justin Fier and I'm the Director of Cyber
Intelligence and Analytics here at Darktrace.
So, what do we know about this attack so far?
Details are still sparse as an open investigation is currently underway,
but according to open source intel, this was indeed likely
the result of a ransomware infection by the now defunct DarkSide group.
And, while we don't officially know the initial attack vector,
you don't need to go far to hypothesize over what happened.
It's the same case over and over as seen in past attacks; a phishing email, a misconfigured server,
stolen credentials, or even third party supply chain compromise,
are just a few scenarios that come to mind.
On the surface, the attackers appear to have been
financially motivated as opposed to the political motivation seen in the 1970s
and while they targeted the IT side of the network, Colonial Pipeline,
out of an abundance of caution, took the proactive measure to shut down parts of its OT network.
The result of this was, or better yet is, long lines at the pump and ultimately an entire Eastern
gas shortage and total outage in some areas of the middle East here in the United States.
This outage lasted for a total of six days and was felt across
thousands of gas stations, and still very much is.
Everything from the pump down to the very trucks that deliver the fuel
literally dried up overnight.
Now what does this attack reveal about the evolution
in the industrial cyber-threat landscape?
Well, the industrial cyber-threat landscape is not immune to the same
threat seen on the IT side and quite simply Industrial Control Systems
or OT networks or national critical infrastructure are adapting with the times.
As to be expected, they're modernizing and
upgrading to ensure that we, the consumer, have the best service experience possible.
But, with that comes risks, some avoidable and some that we must accept,
but let's not forget about the fact that this attack targeted the IT system.
This is a perfect example of the unintended or unpredictable consequences
of a ransomware attack against certain industries.
Pair that with the fact that cyber-criminals are getting smarter and faster and thus so are the
tools and tactics that they're using, today it's a gas shortage but I fear what tomorrow might be.
At a recent senate hearing, a top Biden administration cyber security official warned
that cyber-attacks on the nation's infrastructure are, and I quote,
"growing more sophisticated, frequent, and aggressive".
President Biden himself even addressed this very case and announced a new executive order in the
wake of the SolarWinds and Hafnium compromises that happened over the last few months.
Colonial Pipeline confirms that the ransomware temporarily halted all pipeline operations and
affected some of its IT systems, so how does the interdependence of OT and IT,
as well as the IT/OT convergence complicate industrial cyber security?
OT needs IoT to survive, and especially with newly updated and connected OT being rolled out daily.
And, while we could argue that a good old-fashioned air gap would
have solved this problem, it's not that simple.
Even air gaps can be compromised but that's a conversation for another day.
But just a little hint for you, it's likely going to be through an IT system
The last thing I'll leave you with is this: in the IT world,
a compromise network can lead to lost data, lost revenue, and lost time.
In the OT world, a compromise network can result in real-world,
kinetic damage like a pipeline exploding, environmental pollution, and even death.
So on that note, I want to thank everybody for tuning in today.
If you'd like to learn more about what Darktrace is doing for various
OT environments around the world, head on over to the Darktrace blog at darktrace.com
or come find me on LinkedIn and we can chat about all things cyber and AI.
Thank you.