SANS Industrial Control Systems Security Blog: Tag - cyber attack

One CIP, Two CIP, Red CIP, Blue CIP

This blog was written by - Tim Conway with contributions, edits, and research from Ted Gutierrez and Kevin Perry Looking at the Ukraine cyber-attacks through the various lenses of NERC CIP Following the cyber-attacks which impacted the Ukrainian electric system on December 23, 2015 there were a number of public statements and discussions asking … Continue reading One CIP, Two CIP, Red CIP, Blue CIP


Fourth Sample of ICS Tailored Malware Uncovered and the Potential Impact

I looked at the S4 Europe agenda which was sent out this morning by Dale Peterson and saw an interesting bullet: "Rob Caldwell of Mandiant will unveil some ICS malware in the wild that is doing some new and smarter things to attack ICS. We are working with Mandiant to provide a bit more … Continue reading Fourth Sample of ICS Tailored Malware Uncovered and the Potential Impact


Ukrainian Grid Attack: How NERC CIP-like Measures Might Have Helped

With the recent release of the E-ISAC and SANS ICS Defense Use Case (DUC) #5 which analyzed the cyber-attack that impacted Ukraine on December 23, 2015, I wondered how NERC CIP might have helped. I want to preface this analysis with acknowledgement that the Ukrainian event was wholly contained at the distribution level of their … Continue reading Ukrainian Grid Attack: How NERC CIP-like Measures Might Have Helped


E-ISAC and SANS Report On The Ukrainian Grid Attack

Yesterday the SANS ICS team released its Defense Use Case (DUC) #5 analyzing the cyber-attack that impacted Ukraine on December 23, 2015. The paper is written from the perspective of what lessons that can be learned from the event. The unprecedented cyber induced power disruption provides an opportunity for US electric grid asset owners and … Continue reading E-ISAC and SANS Report On The Ukrainian Grid Attack


Context for the Claim of a Cyber Attack on the Israeli Electric Grid

*Update* A cyber analyst in Israel (Eyal Sela) messaged me to add that the media reporting so far is misleading with regards to the context around the incident. The "Israel Electric Authority" the Minister mentioned is in no way related to the networks of the Israeli electric companies, transmission, or distribution sites. The Israeli Electric … Continue reading Context for the Claim of a Cyber Attack on the Israeli Electric Grid