Integrated SOC for IT/OT systems

The threat landscape for industrial systems (OT) is increasingly resembling threats to business networks (IT). The same categories of malware used to attack conventional IT systems and networks are relevant for OT systems, including spyware (Trojan-Spy and Trojan-PSW), ransomware, backdoors and eraser utilities (KillDisk). At the same time, malware specifically developed for OT systems is also becoming increasingly important.

Targeted attacks on industrial companies are a worrying trend. The purpose of such advanced persistent threats (APTs) is often cyber espionage and serve to prepare for subsequent phases of attack. The goals of the attackers include stealing business-critical information and intellectual property. The number of APTs is increasing and attacks such as Snake or LockBit are targeting industrial control systems.

To demonstrate that their IT and/or OT systems are secure, organizations must comply with a rapidly increasing number of security standards. The German Federal Office for Information Security (BSI), the US National Institute of Standards and Technology (NIST) and the International Electronical Commission (IEC) have developed standards and security requirements such as BS3, IEC 622443 or ATT&CK to protect companies against cyber attacks. Our security experts will help you implement the requirements and good practice guidelines that are relevant to your company.

An international household appliance manufacturer was the victim of a ransomware attack in early December 2020. The hackers stole data, encrypted devices and, among others, published employee files containing medical information.

In mid-October 2020, a multinational energy company fell victim to a ransomware attack for the second time in a year. The attackers reportedly stole about 5 terabytes of data from the company, which they intended to analyze for critical content and gradually publish it piece by piece.

In December 2020, a European helicopter manufacturer was attacked with ransomware. Hackers penetrated the company's network, encrypted files and, after failed negotiations with the extortionists, published aviation specialist's files.

In November 2020, a South American aerospace and defense company was the target of a cyber attack that affected the company's operations. The attack led to the disclosure of company data. It was a ransomware attack that required disabling a significant portion of the company's servers, which in turn led to a partial and temporary disruption of internal processes.