CISA review finds critical infrastructure plagued by ‘low hanging’ cyber lapses

TLDR:

Phishing, stolen credentials, and other basic cybersecurity lapses are allowing hackers, including China-linked threat groups, to infiltrate U.S. critical infrastructure networks. CISA report highlights low-hanging vulnerabilities like phishing, valid accounts, and default passwords. The agency’s assessment teams have been emulating tactics used by threat groups to test cyber defenses.

Key Points:

• Phishing, stolen credentials, and basic cybersecurity lapses are primary vulnerabilities for critical infrastructure.
• CISA report emphasizes low-hanging cyber vulnerabilities like phishing, valid accounts, and default passwords.

According to a recent analysis by the Cybersecurity and Infrastructure Security Agency (CISA), vulnerabilities such as phishing, stolen credentials, and basic cybersecurity lapses continue to provide avenues for hackers, including China-linked threat groups like “Volt Typhoon,” to infiltrate critical infrastructure networks in the U.S. The report presents findings from 143 Risk Vulnerabilities and Assessments completed by CISA and the U.S. Coast Guard in fiscal 2023, highlighting common attack methods like phishing, valid accounts, and default passwords.

These vulnerabilities are considered low-hanging fruit that hackers can exploit without sophisticated tactics. CISA’s assessment teams have been emulating the tactics used by threat groups like Volt Typhoon to test the cyber defenses of critical infrastructure organizations across different sectors. The goal is to raise awareness among operators about the real threat of exploitation and the need to address these vulnerabilities.

The report reveals that attackers often gain initial access to networks through valid accounts, spearphishing links, and brute force password cracking. Once inside, attackers aim to escalate privileges to gain further access to systems and sensitive data, often using shared user accounts and administrative credentials. CISA recommends organizations adopt voluntary cross-sector cybersecurity performance goals to strengthen their defenses.

Overall, the report underscores the importance of addressing basic cybersecurity lapses to enhance the security of critical infrastructure networks and mitigate the risk of cyber threats from nation-state actors. By focusing on low-hanging vulnerabilities and implementing best practices, organizations can enhance their cyber resilience and protect critical infrastructure from potential attacks.