Intelligent CISO Issue 42 | Page 45

While Advanced Persistent Attacks ( APTs ) on utilities and critical infrastructure are not a novel phenomenon , they are increasing at a disturbingly fast pace . attacks begin by entering vulnerable devices like a sensor or meter either remotely or locally . Once inside , the bad actors inject malicious code into the Flash or Non-Volatile Memory of the device in order to survive a restart or power loss , allowing an attacker to cause more damage over a longer period of time – hence the term ‘ persistent ’ in the name . As these devices are brought onto an IT network , actors can use their persistent presence in the device to get into the IT system itself , at which point they can manipulate data , change commands , seize control from operators , or simply lay dormant until the time is right . www . intelligentciso . com
APT attacks can stem from a wide range of vectors , including outsider groups like ( allegedly ) stateindustry unlocked initiative to install 240M smart meters across the country , faced a sabotage of its smart meters , which left 160,000 homes without power . The breach was the largest of its kind in India ’ s history and forced the project to pause its massive rollout .
These hacks indicate that while Advanced Persistent Attacks ( APTs ) on utilities and critical infrastructure are not a novel phenomenon , they are increasing at a disturbingly fast pace .
The rise of APT attacks for critical infrastructure
Though not a new category of attack , APTs like ransomware , DDoS and others , are rising in popularity as more legacy OT devices become connected . These

While Advanced Persistent Attacks ( APTs ) on utilities and critical infrastructure are not a novel phenomenon , they are increasing at a disturbingly fast pace . attacks begin by entering vulnerable devices like a sensor or meter either remotely or locally . Once inside , the bad actors inject malicious code into the Flash or Non-Volatile Memory of the device in order to survive a restart or power loss , allowing an attacker to cause more damage over a longer period of time – hence the term ‘ persistent ’ in the name . As these devices are brought onto an IT network , actors can use their persistent presence in the device to get into the IT system itself , at which point they can manipulate data , change commands , seize control from operators , or simply lay dormant until the time is right . www . intelligentciso . com

45