Facebook Twitter LinkedIn RSS
    Trending
    • NCSC 2025: CSEAN received the cybersecurity research excellence award
    • GEFAS unveils new office to deepen digital engagement for Anambra people
    • Telecom operators raise alarm over soaring theft of critical infrastructure
    • NCC introduces framework for agile and forward-looking authorization processes
    • NDPC and Meta legal battle continues over $32.8 million data privacy sanction
    • Galaxy Backbone remains strategic partner in civil service digitalisation reforms – Walson-Jack
    • Konga launches exclusive 30-day Starlink promo and free nationwide delivery
    • Pre-orders Samsung Galaxy Z Fold7 and Flip7 Series on Konga
    Facebook Twitter LinkedIn
    ITPulse.com.ngITPulse.com.ng
    • News
    • Interviews
    • Blogs
    • Analysis
    • Opinion
    • Videos
    • Press Releases
    • Pictures
    • Advertise
    ITPulse.com.ngITPulse.com.ng
    Home»News»Human factors, insufficient security measures among top factors driving APT attacks in industrial
    News 5 Mins Read

    Human factors, insufficient security measures among top factors driving APT attacks in industrial

    mmBy ITPulseJune 26, 2023
    Facebook Twitter WhatsApp Pinterest LinkedIn Reddit Tumblr Email
    Kaspersky, anti virus, Cybercrime
    Share
    Facebook Twitter LinkedIn Pinterest Email

    Six factors have been identified as the key contributors to the success of Advanced Persistent Threat (APT) operations inside their victims’ networks.

    According to Kaspersky, the six factors are human factors, insufficient security measures, challenges with updates and configuration of cybersecurity solutions, explaining that while some of these reasons may appear trivial, they are frequently encountered by Kaspersky experts during their incident response activities. To assist companies to mitigate related threats and to ensure the implementation of best practices.

    Lack of OT network isolation

    During incident investigations, Kaspersky experts witnessed cases when there were problems with keeping the Operational Technology (OT) network separate and secure. For example, there are machines such as engineering workstations connected to both the regular IT network and the OT network.

    “In situations where the OT network’s isolation solely relies on the configuration of networking equipment, experienced attackers can always reconfigure that equipment to their advantage,”  said Evgeny Goncharov, Head of Industrial Control Systems Cyber Emergency Response Team at Kaspersky. “For instance, they can turn it into proxy servers to control malware traffic or even use it to store and deliver malware to networks that were believed to be isolated. We have witnessed such malicious activities on multiple occasions.”

    Human factor remains a driver of cybercriminal activities

    When granting access to OT networks to employees or contractors, information security measures are often overlooked. Remote administration utilities like TeamViewer or Anydesk, initially set up temporarily, may remain active unnoticed. However, it’s crucial to remember that these channels are easily exploited by attackers. In 2023, Kaspersky investigated an incident where a contractor attempted sabotage, by taking advantage of remote access to the ICS network legitimately granted to them several years before.

    This story demonstrates the importance of considering the human factor as any potentially dissatisfied employees may be driven by their work assessments, income, or political motivations, leading them to engage in cybercriminal actions. A possible solution in such a situation can be Zero Trust – the concept assuming that neither the user, device, nor application within the system is trusted. Unlike other Zero-Trust solutions, Kaspersky extends Zero Trust approach down to the Operating System level with its KasperskyOS-based solutions.

    Insufficient protection of OT assets

    During incident analysis, Kaspersky experts discovered outdated security solution databases, missing license keys, user-initiated removal of keys, disabled security components, and excessive exclusions from scanning and protection – all contributing to the spread of malware.

    For example, if your databases are not up-to-date and a security solution can’t be updated automatically, it can allow advanced threats to quickly and easily propagate as in APT attacks, where sophisticated threat actors are trying to avoid detection.

    Insecure configurations of security solutions

    Proper configurations of a security solution are crucial to prevent it from disabling or even abusing it – a tactic that has often seen to be employed by APT groups/actors. They may steal information on the victims’ network stored in the security solution to get into other parts of the system or move laterally, using professional infosec language.

    In 2022, Kaspersky ICS CERT noticed a new trend in APT tactics, which makes proper configurations even more vital. For instance, when searching for ways to move laterally, the attackers no longer stop at hijacking critical IT systems, like domain controllers. They proceed to the next target – the administration servers of security solutions. The goals may vary – from putting the malware on a list of programs that won’t be checked to using tools in the security system to spread it to other systems, even those that are supposed to be completely separate from the infected network.

    The absence of cybersecurity protection in OT networks

    It might be hard to believe, but on some OT networks, cybersecurity solutions are not installed on many endpoints at all. Even if the OT network is completely separated from other networks and not connected to the Internet, attackers still have ways of gaining access to it. For example, they can create special versions of malware that are distributed via removable drives, such as USBs.

    Workstations and servers’ security updates challenges

    Industrial control systems have a unique way of functioning, where even simple tasks like installing security updates on workstations and servers need careful testing. This testing often happens during scheduled maintenance, causing updates to be infrequent. This gives threat actors plenty of time to exploit known weaknesses and carry out their attacks.

    “In some cases, updating the server’s operating system may require updating specialised software (like the SCADA server), which in turn requires upgrading the equipment – that all may be too expensive. Consequently, there are outdated systems found on industrial control system networks,” adds Goncharov. “Surprisingly, even Internet-facing systems in industrial enterprises, which can be relatively easy to update, can remain vulnerable for a long time. This exposes the operational technology (OT) to attacks and serious risks, as real-world attack scenarios have shown.”

    APT attacks kaspersky
    Share. Facebook Twitter Pinterest LinkedIn Tumblr Telegram Email
    mm
    ITPulse
    • Website
    • Facebook
    • Twitter
    • LinkedIn

    ITPulse is a wholly information technology communication (ICT) news website, with a special focus on the African continent. The website provides up-to-date biz-tech news, analysis and comprehensive and thorough insight into the continent's ICT terrain

    Related Posts

    NCSC 2025: CSEAN received the cybersecurity research excellence award

    July 19, 2025

    GEFAS unveils new office to deepen digital engagement for Anambra people

    July 19, 2025

    Telecom operators raise alarm over soaring theft of critical infrastructure

    July 17, 2025

    Leave A Reply Cancel Reply

    Subscribe to Updates

    Get the latest creative news from FooBar about art, design and business.

    Latest Posts

    NCSC 2025: CSEAN received the cybersecurity research excellence award

    July 19, 2025

    GEFAS unveils new office to deepen digital engagement for Anambra people

    July 19, 2025

    Telecom operators raise alarm over soaring theft of critical infrastructure

    July 17, 2025
    About
    About

    Itpulse.com.ng is a wholly information technology communication (ICT) news website, with special focus on the African continent. The website provides up-to-date biz-tech news, analysis and a comprehensive and thorough insight info the continent's ICT terrain.

    Contact us: editorial@itpulse.com.ng

    Facebook Twitter LinkedIn RSS
    Latest Posts

    NCSC 2025: CSEAN received the cybersecurity research excellence award

    July 19, 2025

    GEFAS unveils new office to deepen digital engagement for Anambra people

    July 19, 2025

    Telecom operators raise alarm over soaring theft of critical infrastructure

    July 17, 2025
    Popular Posts

    GEFAS unveils new office to deepen digital engagement for Anambra people

    July 19, 2025

    Telecom operators raise alarm over soaring theft of critical infrastructure

    July 17, 2025

    Why trust is the real currency in Nigeria’s digital asset market – By Emelia Sunday-Edet

    July 16, 2025
    © 2017 - 2025 Itpulse. Designed by Max Excellence.
    • Terms & Conditions
    • Privacy Policy
    • Advertise
    • Contact Us

    Type above and press Enter to search. Press Esc to cancel.