Warum Triton Malware weiterhin Industriesicherheit bedroht: Schneider Electrics Expertenmeinung

Ende 2017 zielte ein Sophisticated Cyberattack namens Triton (auch Trisis Genannt) auf das Safety Shutdown System einer Middle East Facility Ab. Entdeckt von Cybersecurity Firm Dragos im November 2017, Could The Malware Catastrophic Failure Ausgelöst Haben – Potenziell Killing Personnel Und Releasing Hazardous Chemicals. Glücklicherweise Backfired Tritons Attempt, Das Triconex Safety System Zu Disable, Activating The Emergency Shutdown It Sought To Suppress Und Revealing The Attack.

Dragos Labels The Group Behind The Assault „Xenotime“ Und Warns That They May Launch Future Disruptive Oder Destructive Attacks. The Incident Also Provides A Dangerous Blueprint Für Other Attackers Wishing To Target Safety Instrumented Systems (SIS).

Schneider Electric Chose Transparency Over Silence. Andrew Kling, Director Of Cybersecurity Und System Architecture, Erklärte: „We Knew A Certain Level Of Openness Was Required. Once The Attack's True Nature Was Understood, We Realized The Seriousness Und The Industry-wide Call To Action It Demanded.“ Kling Also Authored One Year After Triton: Building Ongoing, Industry-wide Cyber Resilience To Share Lessons Learned.

[IoT Security Summit – Learn To Secure The Full IoT Stack, From Cloud To Edge To Hardware. Get Your Ticket Now.]

What Sets Triton Apart Is That It Was The First Known Malware Designed To Attack A Safety Instrumented System. Kling Notes: „This Wasn't A One-off Legacy Exploit; It Was A Deliberate Attempt To Undermine Safety Controls For Strategic Gain. Ignoring It Would Be Unacceptable.“

Wie Bewusst Ist Die Industrie Über Triton Und Die Breitere Bedrohung Für Industrial Safety Systems?

Andrew Kling: „Industry Awareness Should Be 100%. Everyone Must Act Immediately. We Run A Dedicated Malware Detection Service Für Triconex Controllers, Offer It To All Customers, Und Have Detected No Additional Compromises. This Is The First Service That Detects Malware Directly In A Safety Device.“

Welche Rolle Spielt Schneider Electric Bei Der Bildung Der Industrie?

Kling: „We're Calling For A Collective Response – Customers, Service Providers, OEMs, Und Network Vendors Must Prioritize Safety Systems As Fiercely As They Do Process Controls. Through Standards Committees, We Collaborate With Peers To Share Lessons Und Promote Best Practices. Transparency Is Key; We Explain The Attack Details Und The Techniques Used So Others Can Defend Themselves.“

Was Wissen Wir Über Die Angreifer?

Kling: „Attribution Remains Unclear; Speculation About Nation-state Involvement Exists, But Concrete Evidence Is Lacking. What We Do Know Is That The Attackers Possessed Specialized Knowledge Of Safety System Architecture, Embedded Processors, Und Proprietary Protocols. Their Malware Contained Multiple Bugs That Inadvertently Triggered The Safety Shutdown, Suggesting Limited Resources Or Testing. Nonetheless, The Skill Set Required Is Non-trivial Und Indicates A Highly Motivated Adversary.“

Advice Für Industrial Organizations Concerned About Cyberrisk?

As A Member Of ISA99's IEC 62443 Working Group, Kling Recommends Aligning Procurement With The IEC 62443 Cybersecurity Standard. „When Tendering For New Safety Or Process Control Systems, Specify IEC 62443 Compliance. Hundreds Of Man-years Of Expert Work Define What Security Means In Industrial Automation. By Selecting Certified Products Und Delivery Partners, You Leverage That Collective Expertise Without Becoming A Cybersecurity Specialist Yourself.“

Schneider Also Collaborates With U.S. Government Agencies Such As NCCIC/ICS-CERT, Ensuring That Operational Technology (OT) Security Best Practices Are Shared Across The Community. The OT Cybersecurity Community Remains Tightly Knit, With Regular Collaboration To Address Emerging Threats.