Recent threats to US critical infrastructure based on current events have led to heightened concern in the security community. Bugcrowd CEO Dave Gerry and Bugcrowd founder Casey Ellis recently recorded a Security Flash discussing key takeaways and action items for security defenders. Their key message? Prioritize resilience over fear.
The recent warnings from entities like the Department of Homeland Security and the New York Department of Financial Services are not new revelations, but rather urgent reminders of existing vulnerabilities. Organizations must assess their infrastructure, identify weak points, particularly with third-party partners, and ensure their incident response plans are succinct and up-to-date.
A significant focus for critical infrastructure, especially those utilizing OT, ICS, or SCADA systems, should be re-checking for foundational security weaknesses. Common targets for threat actors include default credentials, credential stuffing, orphaned accounts, and forgotten publicly addressable infrastructure. These “pedestrian” vulnerabilities are easily exploited and demand immediate attention.
Beyond technical defenses, there is also the escalating risk of information operations, exacerbated by AI-generated misinformation. We urge everyone to exercise journalistic diligence when consuming and sharing information online. Verifying the credibility of sources and pausing before retweeting or sharing content is paramount to avoid amplifying false narratives fueled by various motivations, including those aiming to manipulate public opinion.
In essence, the message is clear: revert to security fundamentals, exercise good judgment on social media, and recognize the presence of AI-generated content. This current threat environment, while intensified, is not unprecedented. It serves as a vital opportunity to harden systems, implement defense-in-depth strategies, and secure supply chain partners. Proactive measures against threats like exploited default credentials, DDoS attacks, and website defacements are crucial. If uncertainties about your security posture persist, particularly for critical infrastructure, consider re-evaluating and seeking expert assistance.