CISA releases new strategy to improve industrial control system cybersecurity

The Cybersecurity and Infrastructure Security Agency (CISA) released a strategy to strengthen and unify industrial control systems (ICS) cybersecurity for a more aligned, proactive and collaborative approach to protect the essential services Americans use every day.

The strategy, Securing Industrial Control Systems: A Unified Initiative is intended to help architects, owners and operators, vendors, integrators, researchers, and others in the ICS community build capabilities that lead to more secure ICS operations. Ultimately, it strives to move CISA and the ICS community beyond reactive measures to a more proactive ICS security focus.

“In recent years, we have seen industrial control systems around the world become a target for an increasing number of capable, imaginative adversaries aiming to disrupt essential services,” said Christopher Krebs, Director of CISA. “As attackers continue trying to exploit vulnerabilities in ICS, we need to make sure we’re staying ahead of them. Together with our partners in the ICS industry and the security community, this strategy will lead us to new, unified initiatives and security capabilities that will markedly improve the way we defend and secure ICS.”

Although ICS owners and operators manage their own security, CISA’s mission is to assist through delivery of a broad portfolio of ICS security products and services, especially when an exploitation may threaten people or property or undermines confidence in critical infrastructure safety and reliability.

The CISA ICS initiative is a five-year plan that builds on the collaborative work already done and the existing support CISA provides to the community. It also elevates ICS security as a priority within CISA, coalescing CISA’s organizational attention around the implementation of a unified, “One CISA” strategy. The initiative organizes our efforts around four guiding pillars:

Pillar 1: Ask more of the ICS Community, deliver more to them.

Pillar 2: Develop and utilize technology to mature collective ICS cyber defense.

Pillar 3: Build “deep data” capabilities to analyze and deliver information that the ICS community can use to disrupt the ICS cyber kill chain.

Pillar 4: Enable informed and proactive security investments by understanding and anticipating ICS risk.

The CISA ICS Strategy can be found at www.cisa.gov/ICS.

EU Funds EUR 13 Million Natural Disasters Project Linking IOM, Oxfam in Burundi

The International Organization for Migration (IOM) and Oxfam have joined forces to launch an EU backed multi-million Euro Disaster Risk Reduction (DRR) project that will help hundreds of thousands of Internally Displaced Persons (IDPs) and other communities in Burundi.

Every year tens of thousands of people are displaced by natural disasters and climatic events, ranging from earthquakes, flooding, landslides, hail, and heavy and torrential rains that claim many lives and destroy thousands of homes. Over 112,000 people in Burundi are currently displaced due to such weather disasters.

This has negatively impacted Burundi’s efforts to reduce poverty, fight climate change, and build sustainable cities, in line with the Sustainable Development Goals.

The EUR 13 million, 3-year project—funded through “TUBEHONEZA,” the “Rural Development” component of the European Union’s Resilience Programme—includes nationwide risk mapping, building the capacity of the Government of Burundi to coordinate DRR initiatives and leading community-based DRR interventions.

IOM will focus on Burundi’s 18 provinces and 119 communes, while Oxfam will target 11 provinces and 22 communes. Though the scope of each organization’s work is slightly different, actions will be synergized and coordinated to complement each other, avoiding duplication and ensuring a joint approach throughout the country.

The project will be implemented in co-ordination with the Ministry of Home Affairs, Community Development and Public Security, particularly including the National Platform for Risk Prevention and Disaster Management of Burundi.

“Local communities suffer not only from the direct consequences of the events, such as through destruction of shelter, agricultural fields and displacement, but are also exposed to significant direct and indirect public health risks created by the disasters,” said AJ Morgen, IOM Burundi Chief of Mission. “Supporting DRR efforts in Burundi, therefore, is not only important but essential for reducing displacement and improving the conditions needed for long-term, sustainable development.”

The initial stage of the project entails a country-wide, multi-hazard assessment and risk mapping at the national level, to be scientifically tailored to meet five primary hazards: torrential rains, strong winds, flooding, landsides, and earthquakes. The data collected during the risk assessment will produce risk assessment maps for each of the five hazards.

The second stage will utilize the risk maps to update or elaborate contingency plans in all 18 provinces of Burundi. Combined with institutional capacity building of the country’s Disaster Risk Management (DRM) platforms, this will enable communities, local authorities, humanitarian and development organizations to better prepare for, and respond to, those risks.

The final component of the project will engage communities most at-risk of disasters to implement disaster prevention and mitigation activities.

The projects also include emergency response funding to enable IOM and Oxfam to provide emergency non-food items and/or shelter support if a significant disaster occurs during the project’s lifetime.

“Climate change is severely affecting the Burundian population and will increase the frequency and magnitude of natural disasters in the future. The EU has reacted and is now supporting efforts to prevent these disasters. The EU will remain alongside the Burundian people and will draw on the experience of IOM and Oxfam in dealing with these risks,” explained H.E Claude Bochu, Ambassador of the European Union to Burundi.

Criminals infiltrating Africa’s booming mobile money industry

A new INTERPOL report has found the billion dollar mobile money industry in Africa is being exploited by organized crime groups – a trend only set to increase as the service is rolled out across the continent.

The ‘Mobile money and organized crime in Africa’ report presents an overview of the criminal exploitation of mobile money services, including fraud, money laundering, extortion, human trafficking and people smuggling, the illegal wildlife trade and terrorism.

The African continent is the “world leader” in the mobile money industry, accounting for nearly half of all registered mobile money accounts globally.

The prominent role that mobile money plays in African societies and economies, and the rapid pace at which its infrastructure has been developed, has enabled criminals to “exploit weaknesses in regulations and identification systems” and commit mobile money-enabled crimes.

Lack of robust identity checks
The report notes that mobile money itself has proven to be a positive force for financial inclusion and economic development in many African countries, and that a more cash-based informal economy can sometimes present even graver challenges to law enforcement.

However, a lack of robust identity checks to verify users combined with a need for greater law enforcement resources and training on mobile money-enabled crimes have created a financial system distinctly vulnerable to criminal infiltration.

Types of ID required to register for a mobile money account are not standardized across Africa and acceptable documents range from national identity cards to company IDs, tax certificates and drivers licenses.

While such a broad spectrum of acceptable IDs benefit the growth of mobile money services, it also increases their vulnerability to fraud, money laundering and other crimes.

In parallel, despite progress in conviction rates for mobile money-enabled crimes, the technical expertise and equipment required to complete investigations can prove difficult to integrate into the court process.

“The time to act is now”
With mobile money poised for even greater growth in Africa, unless the vulnerabilities are addressed, these services pose a significant threat to consumers and national security.

By 2025, smartphone user rates in Sub-Saharan Africa alone are projected to rise from roughly 39 per cent today to 66 per cent. Higher smartphone adoption, combined with a wider array of mobile money services on offer, will likely increase the number of transactions performed through smartphone apps.

“The evidence shows that criminals are already exploiting mobile money services in Africa. The anonymity that these services too often allow and the technical nature of the industry also present a challenge to law enforcement in investigating and prosecuting these crimes,” said Cyril Gout, INTERPOL Acting Director of Operational Support and Analysis.

“This report emphasizes the need to act is now. By addressing the vulnerabilities highlighted by Project ENACT, we can ensure that the mobile money industry continues to grow throughout Africa without being compromised by those who seek to undermine it,” added Mr Gout.

Project ENACT
Through ENACT, INTERPOL assists police in Africa to adopt proactive strategies to combat organized crime threats, facilitate information exchange and enhance investigative skills.

Project ENACT is the first initiative of its kind to cover the entire African continent in analysing the scale of organized crime and its impact on security, governance and development. This analysis serves to inform decision-makers and strengthen law enforcement cooperation at regional and continental levels.

Project ENACT is funded by the European Union and implemented by INTERPOL and the Institute for Security Studies, in partnership with the Global Initiative Against Transnational Organized Crime.

Italy & Romania Take Down €20m Cyber Fraud Ring

The Italian National Postal and Communication Police Unit (Polizia Postale e delle Comunicazioni) and the Romanian National Police (Poliția Română), supported by Europol and Eurojust, dismantled an organised criminal group involved in financial fraud, cybercrime and money laundering.

On 7 July, Italian and Romanian law enforcement authorities carried out 12 house searches and arrested 12 individuals (8 in Italy and 4 in Romania). The operation led to the seizures of personal computers, credit cards, properties, vehicles and other assets with an overall estimated value of over €1.5 million.

The criminal organisation was using a wide network of money mules in Italy, created to launder criminal proceeds from a variety of cybercrime activities. The criminal group was involved in financial frauds and cyber scams such as rental fraud (fraud through the advertisement of non-existent properties to rent) and CEO fraud (impersonating a company official to trigger large transfers to bogus accounts). With these frauds, the criminals were deceiving victims across Europe into making wire transfers to Italian bank accounts, owned by the money mules. It is estimated that the criminal group has generated up to €20 million losses per year for victims across Europe.

Europol supported the operation by facilitating information exchange and providing analytical support. During the two action days, Europol deployed an expert to Italy to cross-check in real time operational information against Europol’s databases and provide leads to the investigators in the field.

Eurojust facilitated the coordination of the operation and the cooperation between the judicial authorities involved in the case.

Dismantling of an encrypted network sends shockwaves through organised crime groups across Europe

At a joint press conference French and Dutch law enforcement and judicial authorities, Europol and Eurojust presented the impressive results of a joint investigation team to dismantle EncroChat, an encrypted phone network widely used by criminal networks.

Over the last months, the joint investigation made it possible to intercept, share and analyse millions of messages that were exchanged between criminals to plan serious crimes. For an important part, these messages were read by law enforcement in real time, over the shoulder of the unsuspecting senders.

The information has already been relevant in a large number of ongoing criminal investigations, resulting in the disruption of criminal activities including violent attacks, corruption, attempted murders and large-scale drug transports. Certain messages indicated plans to commit imminent violent crimes and triggered immediate action. The information will be further analysed as a source of unique insight, giving access to unprecedented volumes of new evidence to profoundly tackle organised criminal networks.

In recent years, European countries have been increasingly affected by organised crime groups who are pervasive and highly adaptive, posing one of the most pressing security challenges faced by law enforcement and judicial authorities. In this regard, the abuse of the encrypted communication technologies is a key facilitator of their criminal activities.

Since 2017, the French Gendarmerie and judicial authorities have been investigating phones that used the secured communication tool EncroChat, after discovering that the phones were regularly found in operations against organised crime groups and that the company was operating from servers in France. Eventually, it was possible to put a technical device in place to go beyond the encryption technique and have access to the users' correspondence.

In early 2020, EncroChat was one of the largest providers of encrypted digital communication with a very high share of users presumably engaged in criminal activity. User hotspots were particularly present in source and destination countries for cocaine and cannabis trade, as well as in money laundering centres.

Given the widespread use of the encrypted telephone solution by EncroChat among international criminal networks around the world, French authorities decided to open a case at Eurojust, the EU Agency for Criminal Justice Cooperation, towards the Netherlands in 2019. Further developments in the investigations led to organising the processing of the data, which was captured on the basis of the provisions of French law and with judicial authorisation, through the frameworks for international judicial and law enforcement cooperation.

The data was in first instance shared with the Netherlands. Eurojust facilitated the creation of a joint investigation team (JIT) between the two countries and with the participation of Europol, the European Union Agency for Law Enforcement Cooperation, in April 2020.

Europol has been actively involved in the investigations led by France and the Netherlands since 2018, relating to the provision and use of encrypted communication services by organised crime groups. Through its role as an information hub and its extensive analytical and technical support system, Europol was able to create and provide a unique and global insight on the scale and functioning of organised crime, as a result of this investigation. This will help law enforcement to combat organised crime in the future more successfully. Europol’s support from the early stages of this JIT included: promoting and arranging international cooperation, providing extensive analytical and financial support, technical expertise and a secured platform for the exchange of information between the countries involved. A large dedicated team at Europol investigated in real time millions of messages and data that it received from the JIT partners during the investigation, cross-checked and analysed the data, and provided and coordinated with the JIT partners the information exchange to concerned countries.

A large number of suspects have also been arrested in several countries which were not participating in the JIT but particularly affected by the illegal use of these phones by individuals active in organised crime, including in the UK, Sweden and Norway. Many of these investigations were connected with international drug trafficking and violent criminal activities.

At the same time, numerous operational meetings for the daily coordination between the law enforcement entities of the JIT partners and other countries took place at Europol, partly during COVID-19.

Eurojust intensively facilitated the judicial cooperation, during the extensive use of European judicial cooperation instruments such as European Investigation Orders. Throughout the investigation, the JIT members organised five coordination meetings at Eurojust to bring all involved parties together in a secure environment, identify parallel or linked investigations, decide on the most suitable framework for cooperation and solve potential conflicts of jurisdiction.

In France, where the operation takes place under the code name "Emma 95", the Gendarmerie has set-up a Taskforce since March 2020. With more than 60 officers, the Gendarmerie leads the investigations targeting the EncroChat encrypted telephone solution under the supervision of the magistrates of the JIRS of Lille. The Taskforce has been monitoring the communications of thousands of criminals, leading to the opening of a wide range of incidental proceedings. France does not wish to communicate further on these on-going investigations nor on the results obtained. The considerable resources deployed demonstrate the importance of these investigations and the importance attached to their success in France.

In the Netherlands, where the operation went under the code name “Lemont”, hundreds of investigators have, with authorisation of the examining magistrate, followed the communications of thousands of criminals day and night since the operation began to unravel and act on the intercepted data stream. The criminal investigation has been led by prosecutors from the Dutch National Public Prosecution Service and the information has been made available to about a hundred ongoing criminal investigations. The investigation has so far led to the arrest of 60 suspects, the seizure of drugs (more than 10 000 kilo cocaine, 70 kilo heroin, 12 000 kilo cannabis, 1 500 kilo crystal meth and 160 000 liter of a substance used to produce synthetic drugs), the dismantling of 19 synthetic drugs labs, the seizure of dozens of (automatic) fire weapons, expensive watches and 25 cars, including vehicles with hidden compartments, and almost EUR 20 million in cash. The expectation is that information will be made available in more than 300 investigations. In a number of cases, more arrests are very likely to follow in the coming period.

The interception of EncroChat messages came to an end on 13 June 2020, when the company realised that a public authority had penetrated the platform. EncroChat then sent a warning to all its users with the advice to immediately throw away the phones.

While the activities on EncroChat have been stopped, this complex operation shows the global scope of serious and organised crime and the connectivity of criminal networks who use advanced technologies to cooperate on a national and international level. The effects of the operation will continue to echo in criminal circles for many years to come, as the information has been provided to hundreds of ongoing investigations and, at the same time, is triggering a very large number of new criminal investigations of organised crime across the European continent and beyond.

Ericsson to boost 5G mission-critical connectivity in European rail industry

Building on its commitment to the railway sector, Ericsson has joined the Association of the European Rail Supply Industry (UNIFE) to show how 5G and mission-critical networks can enable the rail industry to meet the challenge of rail digitalization.

UNIFE, a major industry association, represents European train builders and rail equipment suppliers. By joining UNIFE, Ericsson strengthens its commitment to developing critical network capabilities for the rail industry. Its membership will make an important contribution to accelerating the modernization of railway communications with 5G for FRMCS (Future Railway Mobile Communication Systems).

As a UNIFE member, Ericsson will support the railway sector in tapping the potential of digitalization to improve the quality and efficiency of operation, passenger experience and network and data security.

Manuel Ruiz, Head of Mission Critical Networks at Ericsson, says that fundamental changes in technology that come with 5G and mission-critical networks will enable the rail industry to meet the challenge of digitalization and business transformation.

“With the standardization of the Future Railway Mobile Communications Systems expected to be based on 5G, Ericsson is honored to join UNIFE,” Ruiz says. “Many communications service providers in Europe have already chosen Ericsson’s 5G technology. We look forward to helping the railway sector achieve their operational goals using this technology.”

Already in 2018, Ericsson and Swisscom demonstrated end-to-end network slicing to meet the needs of the railway sector. Ericsson is currently testing connectivity together with national rail companies.

As a UNIFE member, Ericsson will also be able to participate in EU-funded innovation and research projects. Built on its leading 3GPP 4G and 5G technology, Ericsson’s mission-critical networks and applications deliver next-generation, secure, resilient, and high performance mission-critical mobile broadband communication services.

The EU Cybersecurity Act’s first anniversary: one step closer to a cyber secure Europe

On 27 June 2020, the European Union Agency for Cybersecurity (ENISA) celebrated the first anniversary of the EU Cybersecurity Act (CSA) and its strengthened role towards securing Europe’s information society. The CSA gave the Agency a permanent mandate, a new list of tasks and increased resources, and also established the EU cybersecurity certification framework.

The Agency now plays a key role in setting up the framework and builds on its past work towards achieving a high common level of cybersecurity across the European Union by actively supporting Member States, EU institutions, industry, academia and citizens. Regarding the framework, the Agency is close to completing the first cybersecurity certification scheme and is making rapid progress towards a second one, on cloud services.

The mandate has also expanded the Agency’s role in supporting capacity-building and preparedness capabilities, as well as operational cooperation - areas that continue to be put to the test during the COVID-19 pandemic. ENISA acted quickly at the onset of the pandemic by preparing awareness campaigns, sets of tools and publications offering in-depth guidance on cyber safety for organisations, businesses and citizens, all publically available on the webpage COVID19.

Under its expanded role in policy development and implementation, ENISA has thrived, especially in the area of emerging technologies. For 5G security, ENISA has been involved in each phase and continues to support the European Commission and Member States as a common toolbox is being implemented. Last year, the Agency also supported the EU Member States with developing an EU-wide joint risk assessment regarding the 5G roll out, and delivered a 5G threat landscape report, which analyses threats at a more technical level. On Artificial Intelligence, the Agency has set up a 15-member ad-hoc working group on Cybersecurity for AI that will further advance European expertise on AI threats and solutions.

In addition, ENISA has welcomed the newly mandated tasks around research and innovation by creating the EU cybersecurity skills framework and fostering collaboration amongst the four cybersecurity pilot projects of the European Cybersecurity Competence Network.

EU funds research in rail cybersecurity

The Safety4Rails research programme to improve the resilience of railways and metros to cyber and physical attacks is one of five projects that will share €38m in funding from the EU’s Horizon 2020 research budget.

The package announced by Commissioner for Innovation, Research, Culture, Education & Youth Mariya Gabriel on June 15 also includes the 7Shield project to improve prevention, detection, response and mitigation of cyber and physical threats to space infrastructure and the Ensures project covering e-commerce and delivery services.

The Impetus and S4AllCities projects are respectively aimed at enhancing the resilience of cities’ infrastructure and services and at protecting citizens in the event of security incidents in public spaces. All five are due to start by October 2020 and run for two years.

Horizon 2020 is contributing €7·7m towards the €9·6m Safety4Rails project, which will be co-ordinated by Germany’s Fraunhofer Institute.

Recognising that railways and metros could be an attractive target for cyber and/or physical attacks, Safety4Rails is intended to ‘deliver methods and systems to increase the safety and recovery of track-based inter-city railway and intra-city metro transport’. This could range from cyber attacks such as the WannaCry virus or physical attacks like the Madrid commuter train bombings in 2014 to combined cyber-physical attacks, which the promoters suggest are ‘an important emerging scenario given increasing IoT infrastructure integration’.

The research will focus on rush-hour scenarios where many passengers are using metros and railways to commute or attend mass events, including multi-venue sporting tournaments. In the event of an incident, operators have to consider many aspects of passenger safety and security, ranging from threat analysis and situation awareness to the establishment of crisis communication and communicating any responses to passengers and other organisations.

The project aims to take a holistic approach to incident handling, analysing the cyber-physical resilience of metro and railway systems and providing mitigation strategies for an efficient response, as well as facilitating continuous adaptation to address ‘ever-changing novel emerging risks’. Various proposals will be validated by two rail transport operators and fed back into the design of the final recommendations.

GNSS Firewall Software to Strengthen Global Navigation Satellite System (GNSS) Protection

Critical infrastructure systems including power utilities, financial services, mobile networks and transportation rely on Global Positioning System (GPS)-delivered timing to ensure ongoing operations. Microchip Technology Inc. (Nasdaq: MCHP) today announced the release of a major software update for its BlueSky™ GNSS Firewall product, providing a higher level of resiliency against GPS vulnerabilities for systems dependent on GPS signal reception.

Microchip's BlueSky GNSS Firewall Software Release 2.0 performs real-time analysis to detect jamming and spoofing for protecting reception of the GPS signal and hardening response and recovery to avoid signal disruption. BlueSky GNSS Firewall Software Release 2.0 includes charting and advanced threshold settings of Global Navigation Satellite System (GNSS) observables such as satellites-in-view, carrier-to-noise, position dispersion, phase time deviation and radio frequency (RF) power level to simplify system turn-up and deployment.

BlueSky GNSS Firewall Software Release 2.0 includes improvements developed by Microchip as a result of participation in an industry live-sky testing event hosted by the U.S. Department of Homeland Security (DHS) Science and Technology Directorate and open to all providers. Microchip's participation in the DHS-hosted GPS Testing for Critical Infrastructure (GET-CI) events, with scenarios including spoofed signals, has helped the company to identify new solutions to prevent signal disruptions. As a result of 2019 live-sky testing and other input, Microchip developed the Blue Sky GNSS Firewall Software Release 2.0 to address operators' evolving requirements.

Critical Infrastructure Protection Market Size to Surpass US$ 132750 million By 2025

The global Critical Infrastructure Protection market size is expected to gain market growth in the forecast period of 2020 to 2025, with a CAGR of 5.3% in the forecast period of 2020 to 2025 and will expected to reach USD 132750 million by 2025, from USD 108100 million in 2019.

Growth forecast report " Critical Infrastructure Protection Market size by Product Type (Security technologies and Services), By Application (Risk management services, Consulting services, Managed services and Maintenance and support services), By Region Outlook (North America, Europe, Asia-Pacific, South America & Middle East and Africa), Top Manufacturer, Growth Potential, Price Trends, Competitive Market Share & Forecast 2020-2025 added by Market Study Report LLC.

The Critical Infrastructure Protection market stands tall as one of the most proactive industry verticals, as claimed by a new research report. This research study forecasts this space to accrue substantial proceeds by the end of the projected period, aided by a plethora of driving forces that will fuel the industry trends over the forecast duration. A gist of these driving factors, in tandem with myriad other dynamics pertaining to the Critical Infrastructure Protection market, such as the risks that are prevalent across this industry as well as the growth opportunities existing in Critical Infrastructure Protection market, have also been outlined in the report.

1 2 3 4 6