Businesses with systems accessible from internet urged to review cyber defences: CSA

Businesses that rely on connected operational systems accessible from the internet have been urged to review their cyber defences, said Cyber Security Agency of Singapore (CSA) chief executive Gwenda Fong.

Referring to the recent spate of cyberattacks targeting remotely accessible refrigeration and other operational technology systems, Fong said these incidents serve as reminders that even sectors which may not traditionally consider themselves cyber targets can be vulnerable.

In these incidents, threat actors purportedly gained unauthorised remote access to refrigeration management systems and manipulated temperature settings, resulting in food spoilage, financial losses and operational disruptions.

A separate incident involved cold storage room monitoring and control systems used by the French blood bank.

An advisory issued by CSA on Friday (Nov 6) pointed out that these incidents are illustrative of a wider and growing threat — poorly secured remote access to operational technology control systems can allow threat actors to manipulate physical processes and disrupt operations across different sectors.

"The consequences can go beyond data loss — potentially disrupting business operations, supply chains and essential services," Fong, who is also Commissioner of Cybersecurity, elaborated in a LinkedIn post published on the same day.

And while CSA has not received reports of similar incidents in Singapore, businesses and organisations should not wait for an incident to happen here before taking precautions, she said, posing five cybersecurity health check questions to administrators:

• Do you know which of your systems are accessible from the internet?
• Are remote access arrangements adequately secured?
• Are vulnerabilities being identified and addressed?
• What about your customers' personal data?
• Are they being properly managed?

Fong pointed out that while these may appear to be "basic questions", they are important ones.

What businesses and organisations can do

In its advisory, CSA pointed out that the recent attacks in Europe appear to have involved the exploitation of poorly secured, internet-accessible refrigeration controllers.

The agency added that similar risks exist across a wide range of operational technology environments, including but not limited to, energy and utilities infrastructure, water treatment and distribution systems, manufacturing and industrial facilities, building management and heating, ventilation, and air conditioning (HVAC) systems, cold-storage and logistics operations, and healthcare facility management systems.

CSA urges entities operating remotely accessible operational technology control systems to implement the following measures:

• Restrict internet exposure of remote management interfaces
• Strengthen authentication and access controls
• Update and secure operational technology systems and devices
• Implement network segmentation and security monitoring
• Strengthen operational monitoring and incident response.

CSA is also working with agencies and industry partners to reach operators who may be exposed to these risks. Fong said, "Cybersecurity starts with understanding what your business depends on — and making sure those systems are protected."

[[nid:750000]]

editor@asiaone.com