Rockwell Automation tells administrators to disconnect ICS devices

Rockwell Automation has warned customers to disconnect all industrial control systems (ICS) not designed for online exposure from the Internet due to increasing malicious activity worldwide

See also: Ransomware gang targets Windows administrators via PuTTy

Internet defenders should never configure such devices to allow remote connections from systems outside the local network. By taking them offline, they can drastically reduce their organizations' attack surface.

This ensures that threat actors will no longer have direct access to systems that may not yet have been patched against security vulnerabilities, allowing attackers to gain access to their targets' internal networks.

“ Due to heightened geopolitical tensions and adversarial internet activity worldwide, Rockwell Automation is issuing this announcement urging all customers to take IMMEDIATE action to assess whether they have devices connected to the public internet and, if so, to urgently remove that connectivity for devices not specifically designed for public internet connectivity ,” Rockwell said

Rockwell also warned customers to take the mitigation measures needed to secure their devices from security vulnerabilities affecting Rockwell ICS devices. CISA also issued a warning about Rockwell Automation’s new guidance to reduce the exposure of ICS devices to cyberattacks.

See also: BlackTech hackers distribute Deuterbear RAT through a special technique

In September 2022, the National Security Agency (NSA) and CISA published a joint advisory on securing operational technology (OT) devices and industrial control systems (ICS) against attacks.

Previously, guidance was released on stopping malicious attacks targeting OT control systems (2021) and defending OT assets exposed on the Internet (2020).

This advice was based on several initiatives led by the Biden administration, including a July 2021 national security memorandum that directed CISA and NIST to develop cyber performance goals and guidance for critical infrastructure operators to help strengthen the security of U.S. critical infrastructure.

In addition to Rockwell Automation's warnings, earlier this month, multiple U.S. federal agencies, including the NSA, FBI, CISA, and cybersecurity agencies from Canada and the United Kingdom , warned of pro-Russian hacktivists disrupting critical infrastructure operations by infiltrating insecure operational technology (OT) systems

See also: CISA, FBI and DHS publish cybersecurity plan for society

What are the basic protection measures against cyberattacks?

One of the key measures to protect against cyberattacks is the use of strong and unique passwords. Training employees on how to recognize and avoid malicious email and phishing attacks is also critical. Employees must be aware of the techniques that cybercriminals to gain access to sensitive information. Regularly updating and upgrading software and systems is essential to protect against known vulnerabilities. Using antivirus and antimalware software can help detect and remove threats before they cause damage. Finally, backing up data on a regular basis is another critical protection measure.

Source: bleepingcomputer