DHS Warns Critical System Operators of Cyberattacks

The Department of Homeland Security on Wednesday urged companies operating critical systems to review their cybersecurity security measures following a ransomware attack on a natural gas compression facility that caused management to lose access and visibility to certain data and operations.

“Although they considered a range of physical emergency scenarios, the victim’s emergency response plan did not specifically consider the risk posed by cyberattacks. Consequently, emergency response exercises also failed to provide employees with decision-making experience in dealing with cyberattacks,” noted the alert from the Cybersecurity and Infrastructure Security Agency.

The cyberthreat actor used a spear-phishing link to obtain initial access to the organization’s IT network, then deployed commodity ransomware to encrypt data for impact on both networks.

“The victim cited gaps in cybersecurity knowledge and the wide range of possible scenarios as reasons for failing to adequately incorporate cybersecurity into emergency response planning,” CISA noted.

“Consequently, emergency response exercises also failed to provide employees with decision-making experience in dealing with cyberattacks.”

CISA didn’t identify the source of the attack.

• Fed Doesn't Want Another Repo Crisis, But Treasury Isn't Helping
• US Spy Agencies Move to Counter Foreign Influence Operations