(TLP:CLEAR) CISA’s Red Team Advisory Puts a Water Utility Under the Microscope, With Encouraging Results

Summary: CISA has published a Cybersecurity Advisory, “A Tale of Two SOCs: Insights From Two Red Team Assessments” (AA26-237A), describing two simulated red team engagements that were run at the same time against two critical infrastructure organizations. Notably, the organization that performed better (Organization B) was a water and wastewater utility. The other (Organization A) was a government services and facilities sector organization.

Both tests used nearly identical methods, but the two organizations responded very differently. In each case, the red team eventually gained full control of the network and reached cloud accounts. The difference was speed of detection. Organization A never noticed the attack, as its team was buried under thousands of routine alerts and slowed by disconnected staff who were unsure about who had authority to act. Organization B (the utility) caught the break-in almost immediately; isolating three phished computers within 2, 10, and 20 minutes; and later blocked an attempt to reach its control network.

Analyst Note: The encouraging takeaway is that a water utility performed well, and not because of a bigger budget. Its edge came from knowing what normal activity looks like so unusual activity stands out, and from empowering its defenders to act fast. For the small, stretched teams common in our sector, that matters more than how many security tools you own.

Two gaps still hurt the utility. Passwords for systems were stored in plain, readable text, and some accounts lacked multifactor authentication (MFA). The red team also reached the cloud email of every employee through the connection that links in-house and cloud systems. Catching an intruder quickly inside your building does not automatically protect your cloud accounts.

Original Source: https://www.cisa.gov/news-events/cybersecurity-advisories/aa26-237a

Additional Reading:

• Detecting and Mitigating Active Directory Compromises

Related WaterISAC PIRs: 6, 10, 12