HelpNet Security reported today that ASCO Industries, a privately held company acquired by Kansas-based Spirit AeroSystems in 2018, has been hit by a ransomware attack that disrupted its production around the world.
Experts Comments:
Tim Erlin, VP, Product Management and Strategy at Tripwire:
“This isn’t the first manufacturer to be hit by ransomware and it won’t be the last. Ransomware is successful when victims actually pay the ransom. It might seem like a simple solution to the ransomware problem would be to stop paying the ransom, but that’s easier said than done when your data, and your business, are being held hostage. The best protection against ransomware is a good set of backups and the ability to restore systems quickly.”
“This is yet again a tragic example of when systems within a network fulfilling critical functions have been subject to a relatively open network environment allowing the attack to propagate and affect related systems. Hardening and defense in depth, as well as isolation of production environments, is critical to decreasing the impact of breaches. In this case the breach was a ransomware, but it could equally well have been a targeted attacker gaining persistent access to the environment. Given what this vendor produces, a ransomware while disastrous for them financially, it’s far better than having an attacker with a potential to affect the integrity of their fighter jets.”
Hugo van den Toorn, Manager of Offensive Security at Outpost24:
“This also highlights once again the importance of proper security measures, not just within traditional IT but also in operational technology (OT) and cyber-physical systems. If you are unable to properly secure a system, it needs to be isolated to the greatest extent.
Whether it is a single IP camera, or a complete factory, become resilient and ensure your complete organisation is able to withstand an attack against these systems. As first layer of defence, ensure nothing can easily get into your network from the outside. And if ransomware hits, make sure it is contained and cannot propagate through your network. Just like building a dominoes chain, make sure to put blockers in between. Otherwise if one domino topples, you have to start all over again.”
Chris Doman, Security Researcher at AT&T Alien Labs:
To provide the best experiences, we use technologies like cookies to store and/or access device information. Consenting to these technologies will allow us to process data such as browsing behavior or unique IDs on this site. Not consenting or withdrawing consent, may adversely affect certain features and functions.
Functional
Always active
The technical storage or access is strictly necessary for the legitimate purpose of enabling the use of a specific service explicitly requested by the subscriber or user, or for the sole purpose of carrying out the transmission of a communication over an electronic communications network.
Preferences
The technical storage or access is necessary for the legitimate purpose of storing preferences that are not requested by the subscriber or user.
Statistics
The technical storage or access that is used exclusively for statistical purposes.The technical storage or access that is used exclusively for anonymous statistical purposes. Without a subpoena, voluntary compliance on the part of your Internet Service Provider, or additional records from a third party, information stored or retrieved for this purpose alone cannot usually be used to identify you.
Marketing
The technical storage or access is required to create user profiles to send advertising, or to track the user on a website or across several websites for similar marketing purposes.