Cyber Security

Cyberattacks on Critical Infrastructure Originate from Nation-State Actors or Sophisticated APT Groups

Published

1 month ago

February 8, 2025

Saran B. Paramasivam, the Regional Director for Middle East and Africa (MEA) at Zoho says the most notable trends in cyber attacks targeting critical infrastructure systems are the rise of ransomware and social engineering attacks

Can you provide an overview of the current cybersecurity landscape for critical infrastructure in the MEA region?
The cybersecurity landscape for critical infrastructure in the MEA region is increasingly challenged by advanced persistent threats (APTs), ransomware, and state-sponsored attacks targeting vital sectors like energy, healthcare, and finance. In response, governments are prioritising cybersecurity, and establishing national strategies and agencies to safeguard these sectors. AI-powered predictive analytics and zero-trust principles in cloud security are being adopted to enhance threat detection and protect digital assets. Additionally, the region is seeing a rise in the talent pool of skilled cybersecurity professionals, driven by targeted educational initiatives, ensuring the workforce is prepared to address the growing and pressing cybersecurity challenges.

What are the most notable trends in cyber attacks targeting these systems?
The most notable trends in cyber attacks targeting critical infrastructure systems are the rise of ransomware and social engineering attacks. These attacks exploit both human behaviour and technological vulnerabilities, often manipulating individuals to gain unauthorised access to systems. Ransomware, in particular, has become increasingly sophisticated, demanding large ransoms in exchange for restoring access to vital systems. Another concerning trend is the shift in tactics, particularly supply chain attacks. Cybercriminals are targeting third-party vendors and service providers, using them as entry points to infiltrate larger, more secure organisations.

Which sectors in the MEA region are most vulnerable to cyber-attacks?
In the MEA region, sectors such as healthcare, finance, and energy are particularly vulnerable to cyber attacks due to the sensitive and highly confidential nature of the data they handle. Healthcare institutions store valuable personal health information, making them prime targets for ransomware and data breaches. Financial organisations on the other hand are highly attractive to cybercriminals as they can access sensitive financial information and use it for personal gain. Similarly, the energy sector affecting critical national assets like oil fields, power plants and other national infrastructure are prime targets for state-sponsored attacks as well as ransomware. These sectors face increasing pressure to strengthen cybersecurity due to the potential impact of a successful breach.

What are the primary motivations behind cyber attacks on critical infrastructure in the MEA region?
The primary motivations behind cyber attacks on critical infrastructure in the MEA region are both geopolitical and financial. The rise of hacker groups, driven by political agendas or the desire for financial gain, has intensified in recent years. Amidst rising conflicts in the region, cybercriminals exploit these tensions to create political pressure or influence events. Additionally, the region’s wealth, particularly in oil-based economies, makes it an attractive target for financially motivated attackers. These criminal groups aim to disrupt key sectors, steal valuable data, or demand ransoms, capitalising on the region’s economic significance and political instability.

How important is employee training and awareness in preventing cyber attacks on critical infrastructure?
Human error is one of the most common entry points for cyber threats, and well-trained employees can significantly reduce risks. Educating, empowering, and encouraging the right security behaviour is essential. The aim should be to build a security-conscious culture within the organization and inculcate the concept that security belongs to everyone in the organisation. Training employees makes them more proactive in identifying suspicious activities and enhancing the detection and response process. Regular, engaging, and contextual scenario-based cybersecurity training is one of the most effective ways to strengthen an organization’s security posture

What role does proactive threat intelligence play in securing critical infrastructure systems?
Many cyberattacks on critical infrastructure originate from nation-state actors or sophisticated APT groups. Tracking such threat actors with the help of threat intelligence proactively helps in predicting potential targets and the possibility of organization impact. The cyber security team can use the intelligence data to actively search for hidden threats in their network before they can cause damage. Also by understanding adversary tactics (TTPs -Tactics, Techniques, and Procedures), proactive preventive measures can be implemented by the security team. Threat intelligence integration with SIEM and SOAR provides real-time data to automate threat detection and response which helps in reducing the time required to detect and respond to cyber incidents.

Are there any technologies being deployed to safeguard critical infrastructure in the region?
Zero-trust principles—”never trust, always verify”—are being widely implemented in the MEA region with critical infrastructure and regulated industries such as finance and oil and gas leading the way. While progress is being made, organizations do face implementation challenges, including complexities in identity management, lack of expertise, and budget constraints. Despite these barriers, Zero Trust is seen as an imperative cybersecurity strategy for safeguarding digital infrastructure and ML is being leveraged widely to detect anomalies, automate threat detection, and enhance security operations centres (SOCs) . The rapid adoption of generative AI has also increased the concerns about security risks in AI-driven environments

What role do MEA governments play in regulating and enforcing cybersecurity standards for critical infrastructure?
Governments across the MEA region have developed national cybersecurity strategies to protect critical sectors. Examples include the National Cybersecurity Strategy and Critical Information Infrastructure Protection (CIIP) Framework for UAE, Essential Cybersecurity Controls (ECC) and Critical National Infrastructure (CNI) Protection Strategy in Saudi. Several MEA countries have adopted sector-specific cybersecurity standards to mitigate threats unique to these industries. Governments are also pushing for public-private collaboration in cybersecurity, promoting threat intelligence sharing.

How can companies ensure business continuity while recovering from a cyber attack on their critical systems?
Handling a cyber attack on critical systems requires a structured approach that involves immediate response, system restoration, and long-term resilience measures. The immediate response involves containment and reducing the blast radius by isolating the affected systems. Communication with key stakeholders should be initiated – the internal leadership team, IT team and legal team. Regulatory reporting should be initiated if applicable. Business continuity should be ensured by triggering the pre-defined BCP plans. It can be activating Disaster Recovery systems, deploying workaround solutions, or operating with minimum essential offline services till the restoration is completed. Restoration should involve restoring from secure backup, rebuilding and patching systems and resetting credentials and access control.

Cyber Security

Positive Technologies Discovery Leads D-Link to Recommend Router Replacements

Published

16 hours ago

March 19, 2025

Priyan Sampath

Vladimir Razov, an expert from the PT SWARM team, has discovered a vulnerability in several models of D-Link routers. According to Mordor Intelligence, D-Link is one of the top three Wi-Fi router manufacturers in the world. The vendor has been notified of the threat in line with the responsible disclosure policy and recommends that users switch to more recent devices.

The vulnerability, which is registered as BDU:2024-06211 with a CVSS 3.0 score of 8.4, affects the following D-Link models: DIR-878, DIR-882, DIR-2640-US, DIR-1960-US, DIR-2660-US, DIR-3040-US, DIR-3060-US, DIR-867-US, DIR-882-US, DIR-882/RE, DIR-882-CA, and DIR-882-US/RE. At the time of the research, vulnerable routers could be discovered using search engines in the United States, Canada, Sweden, China, Indonesia, and Taiwan.

According to the manufacturer, these models are no longer supported. D-Link recommends retiring the outdated devices and replacing them with supported devices that receive firmware updates. “If this vulnerability is successfully exploited, a malicious user authorized in the router’s web interface can compromise the entire device and gain access to all traffic passing through it,” says Vladimir Razov, Web Application Security Analyst at PT SWARM, the offensive security department at Positive Technologies.

As a temporary measure to mitigate the threat, Vladimir Razov recommends using OpenWrt (an open-source embedded operating system based on the Linux kernel and designed specifically for routers) or changing the login credentials for accessing the router’s web interface. Previously, Positive Technologies helped address vulnerabilities in Zyxel routers and other Zyxel devices. Positive Technologies also enhanced its PT Industrial Security Incident Manager (PT ISIM) with an additional expertise pack, enabling cybersecurity teams to detect attempts to exploit vulnerabilities in MikroTik routers and Cisco switches.

Cyber Security

Sophos Study: MDR Users Claim 97.5% Less in Cyber Insurance

Published

2 days ago

March 18, 2025

Chris Fernando

Leading cybersecurity provider Sophos has released findings from a new study quantifying the financial impact of various cybersecurity controls on cyber insurance claims. The research compares the effect of endpoint solutions, EDR/XDR technologies, and MDR services on claim amounts, offering valuable insights for both insurers and organizations.

Sally Adam, Senior Director, Solution Marketing at Sophos, said, “Every year, organisations spend huge amounts of money on their cybersecurity. By quantifying the impact of controls on the outcome of cyberattacks, this study enables them to focus their investments on the most cost-effective options. At the same time, insurers have a major influence on cybersecurity spending through the controls they require of organisations wishing to be covered and the discounts they offer when a given scheme is in place. This study enables them to encourage investments that can make a real difference to incident outcomes and the resulting claim amounts.”

The Sophos study reveals a dramatic difference in cyber insurance claims: organizations using MDR services claim a median compensation of just $75,000, a staggering 97.5% less than the $3 million median claimed by organizations relying solely on endpoint solutions. This means that endpoint-only users typically claim 40 times more in the event of an attack. The study attributes this significant reduction to the rapid threat detection and blocking capabilities of MDR services, which can effectively prevent extensive damage.

The study also highlights a clear benefit to combining EDR or XDR with endpoint solutions, as the average insurance claim for users of these tools is just $500,000, which is one-sixth of the $3 million average claim for those using only endpoint solutions.

The Sophos study indicates that the predictability of cyber insurance claims varies significantly depending on the security controls in place. Claims from organizations utilizing MDR services show the highest predictability, suggesting consistent and reliable threat mitigation. This is likely due to the 24/7 expert monitoring, investigation, and response that allows for swift action against threats at any time. Conversely, claims from users of EDR/XDR tools are the least predictable, implying that their effectiveness in preventing major damage heavily depends on the user’s expertise and speed of response.

The Sophos study also reveals significant differences in recovery times from ransomware attacks. Endpoint solution users average a 40-day recovery, while EDR/XDR users take the longest at 55 days. In stark contrast, organizations using MDR services recover the fastest, with an average downtime of just three days. These findings underscore MDR’s effectiveness in minimizing the impact of cyberattacks and highlight the less predictable recovery experiences associated with EDR/XDR tools, whose success is dependent on user expertise.

Adam concludes, “The research confirms what many people instinctively know: the type of security solution used has a significant impact on cyber insurance claims. Cyberattacks are inevitable, but defences are not. These results are a useful tool for organisations wishing to optimise their cyber defence and their return on investment in cybersecurity. They will also be useful for insurers looking to reduce their exposure and offer suitable policies to their customers.”

Cyber Security

Fortinet Strengthens OT Security for Critical Infrastructure

Published

2 days ago

March 18, 2025

Chris Fernando

Fortinet has enhanced its OT Security Platform to better protect critical infrastructure from modern cyberthreats. The upgraded platform offers more than basic OT visibility with the new FortiGuard OT Security Service, expanded hardened solutions for network segmentation and 5G in demanding environments, and an improved OT SecOps portfolio for automated threat response and compliance management.

“Fortinet has been building an industry-leading OT Security Platform for 20-plus years and remains at the forefront of OT security innovation,” said Nirav Shah, Senior Vice President, Products and Solutions at Fortinet. “As cyberthreats against critical infrastructure and across industries such as energy, transportation, and manufacturing continue to grow, Fortinet remains committed to delivering comprehensive security solutions tailored for operational technology environments. These latest enhancements give organizations the tools they need to improve their OT security posture and adhere to regulatory requirements—all managed through a single, unified platform.”

The latest Fortinet OT Security Platform enhances OT security with:

Advanced Threat Protection: New FortiGate Rugged NGFWs combined with the enhanced FortiGuard OT Security Service offer superior security enforcement, detecting threats using over 3,300 OT protocol rules, nearly 750 OT IPS rules, and 1,500 virtual patching rules. This protects against known exploited vulnerabilities and provides virtual patching for older OT systems. Secure remote access is also improved with updates to FortiSRA, including enhanced secrets and password management.
Secure Segmentation: The new FortiSwitch Rugged 108F and FortiSwitch Rugged 112F-POE industrial-grade switches enable precise security control at the port level, preventing unauthorized lateral movement within OT networks. Built on Fortinet’s unified FortiOS, these switches simplify network and security management.
Resilient Connectivity: Two new ruggedized 5G solutions are introduced: the IP67-rated FortiExtender Rugged 511G for secure, high-speed connectivity to remote OT sites, and the IP64-rated FortiExtender Vehicle 511G for fleet vehicles. Both feature embedded Wi-Fi 6 and new eSIM capabilities for easier carrier selection.
Enhanced OT SecOps: Fortinet’s AI-driven security operations capabilities are strengthened with updates to FortiAnalyzer 7.6 and FortiDeceptor 6.1, offering deeper threat insights and simplified compliance reporting for OT security teams. FortiNDR Cloud now includes OT protocol support for threat hunting, while FortiNDR (on-premises) adds features like a Purdue Model view and a device inventory covering OT and the Mitre ATT&CK ICS Matrix.

The Fortinet OT Security Platform delivers a unified view and comprehensive security tools to simplify the management of OT and remote site security. It empowers organizations to easily assess, secure, and report on risks, including meeting complex regulatory compliance. Fortinet uniquely offers seamless segmentation and a complete ruggedized portfolio of OT security solutions all managed by a single operating system, FortiOS. Its deep integration within the Fortinet Security Fabric makes it a leading platform in the industry, providing an effective, efficient, and holistic approach to OT security and compliance that surpasses standard offerings.