TechHub: 6 Steps to Protect Backup Power Supplies from Cyber Threats
Apr. 26 – emPOWERUP Live: An Insider’s Guide to Plant Apps 8.2 & the Future of MES
March 21, 2022
GrayMatter & Industrial Defender Equip Energy, Water Industries with Holistic Cybersecurity Defenses
March 31, 2022
An internet-connect UPS, or Uninterruptible Power Supply, is one of the common types of IoT device on the market today.
Industrial organizations worldwide put a high value on availability, so they invest in monitoring electricity consumption and preparing for power outages. APC, owned by Schneider Electric, says it has sold more than 20 million UPS devices globally, and that’s just one leading brand.
In March, the Cybersecurity Infrastructure Security Agency released an alert that says it’s aware of cybersecurity attacks on Internet-connected UPS devices. It outlined how industrial organizations can protect UPS devices.
It’s important to note the recommendations are applicable to IoT devices in general, and the steps align with how GrayMatter performs comprehensive cybersecurity assessments for industrial clients with enterprise-level, highly distributed device networks.
What Industrial Organizations Can Do
- Identify All Networked UPS and Emergency Power Systems
- Remove/Disable Internet-Accessible Management Interfaces (When Possible)
- Put Internet-Connected UPS Devices Behind a Virtual Private Network (VPN)
- Enable Multi-Factor Authentication
- Ensure Factory-Default Passwords Are Not In Use
- Implement Strong Passwords to Mitigate Brute-Force Attacks
Patching specific vulnerabilities can also come into play.
Armis researchers recently found a trio of zero-day vulnerabilities (dubbed TLStorm) could allow an unauthenticated user to remotely control smart-UPS devices from APC.
A zero-day exploit refers to a new vulnerability, at first known only to the bad actor or actors trying to exploit it. The term itself derives from the fact that software developers have zero days remaining to fix or patch the vulnerability because it's already compromised.
The TLSTorm exploit could allow someone to “disable, disrupt or destroy” an APC device or a device connected to it. APC/Schneider Electric has made information about a patch available. APC is a leading vendor of UPS devices used by industrial facilities.
GrayMatter’s OT Cybersecurity Assessment can help industrial clients identify potentially vulnerable UPS and other connected devices. Contact GrayMatter to learn more or schedule a cybersecurity briefing.
