Authentication is an important part of working on a computer, whether logging on, opening encrypted data or using web services like PayPal. Usernames and passwords still play an important role, even if many experts advise against using passwords as the only authentication method. Even approaches to passwords have changed over time. Until recently, experts recommended choosing complex passwords using special characters, numbers and uppercase and lowercase letters. However, many professionals now consider that complex passwords are inconvenient for users, especially if they must be changed frequently. Phrases such as a quote from a book or a sentence which is relevant to the log-in context are more meaningful for users. Such phases can easily reach more than 20 characters and are nevertheless much easier to remember than complex, eight-letter combinations of letters and numbers.
A hacking and cyberespionage group is currently targeting industrial control systems at energy companies. According to a survey by Symantec they have broken into 27 corporate networks so far. The Dragonfly group, also known as Energetic Bear is using spear phishing campaigns and malware-infected websites to collect credentials for corporate networks. Dragonfly has been active since at least 2011 and was exposed by security analysts in 2014. Afterwards, the group seemed to go underground and has only recently emerged again in the public eye. Symantec researchers refer to the current attacks as “Dragonfly 2.0” because they replicate many aspects of the previous attacks. The attacks target industrial control systems (ICS) which belong to companies that operate pipelines, generate electricity, and other energy-related companies. The Dragongly group appears to be particularly active in Switzerland, Turkey and North America.
A VPN needs both a client and remote gateway. While NCP offers a complete solution with Secure Enterprise Client and Secure Enterprise VPN Server, some manufacturers only develop their own gateways. Client software is then purchased from another company such as NCP. This type of cooperation is rare in the security sector, as the compatibility of the products is very important and may not meet all the requirements of a given scenario. This is not the case at NCP which shows that partnerships without compromise can be achieved in the security sector. NCP has been working with Juniper Networks for many years and this partnership recently reached a new level of cooperation.
Not a day goes by without Industry 4.0 being touted as the future of the manufacturing industry. And it’s true, the digitization of production environments is already gaining traction, in some sectors more than others. And with all these developments, everyone is concerned with the security of the brave new interconnected world. Now standard hardware and software are in control of motors, switches and pumps, the security risks must be kept in mind by automation engineers. This requires a methodological approach, which is best adapted and linked to a central ISMS policy.
According to the leading analyst firm Gartner Group over 50% of major new business processes and systems will incorporate some element of the Internet of Things (IoT) by the year 2020. The potential for IoT to revolutionize existing business models is very exciting. Industrial manufacturers are clearly in a hurry to capitalize on this virtual world of opportunities where new revenue streams flow from managing and servicing customers’ equipment remotely.
But before everyone gets carried away it is important to pause for a moment to consider how with the rush towards digitalization there is also a risk that IoT growth will outstrip cybersecurity considerations.