Connect with us

TECHNOLOGY

Gas stations and beyond: Why cybersecurity is a top priority for industrial infrastructure

December 19, 2021 1:55 p.m.

By Chris Connell, Managing Director for Asia Pacific at Kaspersky

Industrial Control Systems (ICS) demand specific approaches to cybersecurity due to their complex structure, connected devices with different capabilities, software and operating systems, and critical functions. And this isn’t just a theory. 

Something as common as a gas station has all the attributes of an ICS, such as connected equipment including pumps and tanks, controllers, a management system, a payment system, as well as connection to the corporate network, third-party service systems, and the internet. Just like any industrial facility, it has cybersecurity issues that companies should consider, to avoid disruptions that may affect the business, its employees, and the general public. This happened recently when gas stations in Iran were shut down because of a targeted attack. 

This look through an ICS infrastructure is based on our research carried out at the end of 2020. It included the analysis of a modern gas station’s automation software architecture, a typical infrastructure, and the communications inside it. This allowed us to classify potential attack vectors and their impact on the fuel station’s network. 

At a gas station

Imagine you’re driving your car and you need to fill it. You stop at a gas station, put the dispenser in the tank, and go to the convenience store to pay for the fuel. Once inside, the fresh coffee smells nice, you take some snacks for the road, complete your purchase and return to your vehicle.

To deliver the fuel to your tank, several systems should work: the back-office system and point of sales are used for payments and management functions. They are connected to the forecourt controller (FCC). This is the area with pumps outside the convenience store where customers park their cars to fill up. It is equipped with many systems such as a pump control, an automatic tank gauge (ATG), payment systems, etc. The FCC is the main device that controls fuel distribution, so when you pay through a cashier, the FCC commands the pump to supply it to your car so you can continue your journey. 

Information about operations, the amount of fuel sold and available is transmitted to the management system locally and then to a head office that accumulates information from all stations. 

Where are the problems? 

Through our research, we managed to classify what could go wrong in this process. There are several potential operational technology (OT) and IT security issues that can affect the work of the station. 

The first group of risks involves potential remote access from external networks. Just like many industrial systems today, the gas station employs solutions that are connected to public services through the internet, these include cloud banking systems or specialised fleet management systems. Remote access to the fuel station allows further malicious actions inside the network. 

This was a real case described in one of Kaspersky’s studies. At the gas station, fuel management software was used to track the amount stored, set the price, and process payments. The system was connected to the internet and had vulnerabilities that allowed remote admin access with the ability to even change the fuel price. 

There are also suppliers and service companies that have access to some parts of the infrastructure. Compromising these third parties may open doors to the target system for attackers. In fact, this type of threat is of great concern for companies of any size profile: a third (32%) of large organizations suffered attacks involving data shared with suppliers. What’s more, the financial impact of such incidents on enterprises is the highest across all types of attacks in 2021. 

Another set of risks involves network and device issues that may potentially lead to the disruption of fuel station services or direct financial impact. Attacks can come from remote networks or by connecting to wireless networks or wired network ports available onsite. 

Then, if the network is not segmented, the attack can spread from entry points such as secondary equipment in a shop and office workstations to critical components such as fuel management controls. The usage of unencrypted protocols (HTTP, CDP, FTP, Telnet, etc.) in the gas station network may allow adversaries to disclose sensitive information for further attack development. 

Another critical but evergreen problem is vulnerabilities or security flaws in the fuel controller, POS terminals, and network equipment, as well as corporate endpoints and applications. In 2015, 5,800 automatic tank gauges (ATGs) were found to be exposed to unauthorized access from the internet because of a lack of password protection on a serial port. ATG is an electronic component placed in the tank that monitors the level of fuel and checks if it is leaking fluid. And through this serial port, the ATG can be programmed. If the signal it transfers is not correct, the operator won’t get an alert about any deviation. Figures from 2015 also suggested that at the time, most systems were in gas stations in the US and represented 3% of those used in the country. By compromising such critical systems as automatic tank gauges, criminals can unlock options for fraud or even physical damage. 

It is also important to verify all workstations used on the forecourt such as points of sale, back-office systems, fuel controllers or payment terminals, as well as their configuration and even access to USB ports. For example, a lack of encryption or incompliancy to the PCI DSS standard in a payment system can contribute to the risk of an attack. For a fuel controller, it is also important to check industrial protocols. Lack of source authentication or integrity control may give adversaries, performing a man-in-the-middle attack, the opportunity to intercept data and manipulate station controllers. 

Another point to manage is wireless gateways and reader units. A security assessment should be performed to identify insecure industrial protocols, the possibility of jamming and spoofing attacks. 

How to improve

There are major security measures that should help increase the overall level of operational technology infrastructure. It is applicable to fuel stations but is no less relevant to any industrial network. 

Network security: Purpose-based network segmentation enhances overall security and minimizes the surface of a possible attack. The segment of the network that has access to untrusted parts of it, such as corporate IT, should also be separated and protected with appropriate enterprise-grade protection software. 

Passive OT network monitoring is essential for asset and communication inventory and detection of intrusions before they affect the technological process. Monitoring data also helps IT security teams to analyze events and consider hardening measures. 

Access control: This should include restricting physical and logical access to the automation and control system. Security measures for remote access control for service companies will help to avoid third-party incidents. 

Endpoint protection: It is important to implement specialized industrial-grade security software for OT hosts and servers. Ensure that the software is approved by the automation vendor and compatible with its solutions. This should help to avoid a situation where the protection product affects operation functions. 

Security management: A system for centralized security event collection and protection software policy management should be implemented. It is also important that the solution allows vulnerability and patch management. If the system can be integrated with Security Information and Event Management (SIEM), that is a ‘nice to have’ option for organizations that plan to upgrade their protection level. Real-time continuous monitoring and endpoint data collection with rules-based response and analysis capabilities will help to further improve protection from advanced attacks. 

A more fundamental approach that involves long-term measures is also important to improve the overall cybersecurity posture. This means adhering to industry standards for information security controls such as IEC 62443, NIST, NERC CIP, and so on. The organization should also conduct penetration testing or security analysis regularly, to identify vulnerabilities and information security problems before they are exploited by someone. And then, of course, follow all recommended measures to fix them properly. 

Going deeper, there are specific requirements for companies with different levels of protection. But the measures listed above are essential to fill most cybersecurity gaps. Be it a fuel station, refinery, or giant car manufacturer, the basic principles of OT and IT protection should allow the company to build a reliable cybersecurity system and develop it according to their needs. This will provide a great foundation for satisfied business owners and happy clients. 

Continue Reading
Advertisement

Click to comment

Leave a Reply

Your email address will not be published.

TECHNOLOGY

HONOR is launching world’s thinnest foldable phone in PH 

January 6, 2024 1:00 a.m.

Leading smart devices provider HONOR Philippines has yet again teased its fans with what seemed to be the launch of its much-anticipated foldable smartphone of the year.

It was just recently that the tech giant released its newest viral smartphone HONOR X9b 5G. While its reign is far from over, HONOR Philippines is highly excited to introduce the world’s thinnest foldable smartphone in the market. 

“HONOR fans asked for it and now, we’re finally bringing it! This is by far the most anticipated launch we have and we are very proud of it. What we’re unveiling in the coming weeks is the world’s thinnest foldable smartphone to date so tech enthusiasts and alike really have to watch for it,” said HONOR Phlippines Vice President Stephen Cheng. 

As seen on its social media pages, HONOR Philippines hinted the launch of its first foldable smartphone in the Philippines. More updates will be shared in the coming days that HONOR fans should definitely monitor very closely! 

For more information and announcements, you may visit HONOR’s website www.hihonor.com or social media platforms: Facebook (Facebook.com/HonorPhilippines), Instagram (Instagram.com/honorph/) and TikTok Shop: (Tiktok.com/@honorphilippines). To check out HONOR’s complete list of retail stores, go to https://www.hihonor.com/ph/retailers/

In the meantime, check out HONOR’s wide array of mobile phones, tablets, and laptops at any HONOR Experience and Partner Stores nationwide or online via Shopee (https://bit.ly/HONORPHShopee), Lazada (https://bit.ly/HONORPHLaz) and TikTok Shop (https://bit.ly/HONORTikTokShop). 

Continue Reading

TECHNOLOGY

LG’s commitment to innovation recognized with numerous awards at CES 2024

January 29, 2024 6:35 p.m.

LG Continues Long-Standing History of Honors at World’s Preeminent Consumer Technology Show With More Than 200 Awards & Accolades

At this year’s CES®, LG Electronics (LG) was honored with more than 200 awards and recognitions for a wide range of innovations and technologies across the home appliance, home entertainment and B2B categories.

The LG SIGNATURE OLED T – the world’s first 4K wireless transparent TV – led the way with countless honors as the Best TV or Best in Show from a wide range of press outlets.

With LG’s reputation as the global leader in OLED technology – the company continues to assert its dominance at CES, taking home the industry’s top awards and honors for its latest OLED TV lineup including the aforementioned LG SIGNATURE OLED T and the LG OLED evo M4, G4 and C4 TVs. Utilizing the wireless technology introduced in last year’s M3 TV, LG’s 77-inch LG SIGNATURE OLED T is considered the next step in the evolution of OLED TV technology and was honored by major tech publications including CNET, Digital Trends, TechRadar, Tom’s Guide, Forbes, The Verge, Wirecutter, PCMag and Mashable.

The LG OLED evo series featuring a new 144Hz refresh rate and LG’s Alpha 11 AI processor was also applauded by CNETTechRadar ProPCGamer and BGR. Additionally, Digital Trends highlighted the LG UltraGear OLED gaming monitor 32GS95UE in its lineup of best monitors seen at CES 2024 noting its one-of-a-kind ability to toggle between 4K at 240Hz and FHD at 480Hz with the press of a button.

LG also garnered accolades from top publications such as USA Today and Tom’s Guide for its new LG Wash Combo™ All-In-One with Heatpump™ Technology. Marking LG’s commitment to a greener world – the new Wash Combo uses 60 percent less energy than a vented model.The cutting-edge home appliance was widely recognized for its compact ventless design and ability to complete a wash-and-dry cycle in under two hours.

Named as a winner of Reviewed’s Accessibility Awards for CES 2024 –  LG’s Universal UP Kit – a collection of innovative home appliance accessories and add-ons embracing universal design has been crafted to enhance usability for individuals facing physical challenges. It was also recognized in Apartment Therapy’s Best Home Design Products from CES 2024.

From the Consumer Technology Association’s (CTA) CES Innovation Award program alone, LG won 34 CES Innovation Awards including two Best of Innovation Awards given to the LG 4K Transparent OLED T and the 83-inch 4K OLED Zero Connect TV (M4).

Highlights from LG’s over 200 awards and recognitions earned at CES 2024 include:

LG SIGNATURE OLED T (77-inch)

·   CNET: Best TVs of CES 2024

·   Digital Trends: Top Tech of CES 2024 Awards

·   PCMag: The Biggest (and Coolest) TVs at CES 2024

·   Engadget: Best of CES 2024

·   Reviewed: The Reviewed Awards: CES 2024 – Home Theater

·   TechRadar: Best Gadgets of CES 2024 – Best TV

·   The New York Times: Wirecutter: Best of CES 2024

·   Tom’s Guide: Best of CES 2024 Awards – Best Design

·   The Verge: The Verge Awards at CES 2024 – Best in Show

·   CNN Underscored: Best of CES 2024 – Best TV

·   NBC News: Best of CES 2024

·   Fox News: Top 10 Tech of CES 2024

·   The Hollywood Reporter: Best of CES 2024 – Best OLED TV

·   Variety: Best of CES 2024 – Best 4k TV

·   Popular Science: Best New Gadgets and Tech from CES 2024

·   Rolling Stone: Best of CES 2024

LG OLED TVs (M4, G4, C4 and B4)

·   Tom’s Guide: Best TVs of CES 2024 – LG OLED evo G4

·   Reviewed: The Reviewed Awards: CES 2024 – LG OLED evo G4

·   TechRadar Pro: 2024 Pick Awards – LG OLED evo M4

·   Tech Advisor: Best of CES 2024 – LG OLED B4

·   Gear Patrol: Coolest TVs and Monitors Revealed at CES 2024 – LG OLED evo G4, C4, and OLED B4

LG QNED TVs

·   Tom’s Guide: Best TVs of CES 2024 – LG 98 inch QNED TV

·   Residential tech today : CES 2024 Reflections and Superlatives- LG 98 inch QNED TV

LG gram Pro Laptops

·   Digital Trends: Best and Most Exciting Laptops at CES 2024 – LG gram Pro

·   Inverse: Best Laptops Announced at CES 2024 – LG gram Pro 2-in-1

·   Laptop Mag: Best of CES 2024 – Best 2-in-1: LG gram Pro 2-in-1

·   Live Science: CES 2024: Best Laptops for Coding & Programmers – LG gram Pro 2-in-1

LG CineBeam Qube Projector

·   PCMag: Best of CES 2024 – Best Projector

·   WIRED: Best of CES 2024 – Best Home Theater

·   Gizmodo: Best, Coolest, and Weirdest Gadgets at CES 2024

·   Yanko Design: Best of CES 2024

LG UltraGear OLED Gaming Monitor

·   Digital Trends: Best Monitors of CES 2024

·   Inverse: Most Eye-Popping Gaming Monitors from CES 2024

·   The Shortcut: The Shortcut CES 2024 Awards

·   Windows Central: Best of CES 2024 – Best Gaming

LG Wash Combo™ All-In-One with Heatpump™ Technology

·   Reviewed: The Reviewed Awards: CES 2024

·   Tom’s Guide: Best Smart Home Gadgets of CES 2024 – Best Smart Appliance

·   Tom’s Guide: Best of CES 2024 – Best Home Appliance

·   Good Housekeeping: Coolest Gadgets at CES 202

LG Smart Home AI Agent

·   Reviewed: CES 2024 – Top 9 New Gadgets You Need To See

·   Mashable: The Best of CES 2024

·   The Washington Post: The Best (and Strangest) Tech We Found at CES 2024

·   T3: Best of CES 2024 Awards – T3’s Top Tech from This Year’s Show
 

For more information on LG’s CES 2024 awards and honors and additional information about LG’s products announced at CES, please visit LG Newsroom.

Life’s about more than having the latest technology, rather, it’s about the experiences technology creates that impact our lives. LG Electronics Philippines delivers consumer electronics through top-of-the-line home entertainment, home appliances, and air solution products that prepare Filipinos for their greatest moments. LG promises to bring “Innovation for a Better Life” nationwide – from Luzon, to Visayas, and Mindanao. For more details, follow LG Philippines on FacebookInstagramYoutube and Tiktok. LG products are available in all authorized dealers nationwide both in-store and online. Visit lg.com/ph for a complete list of our retail partners. You can also visit LG’s Official Flagship Stores in Lazada and Shopee.

Continue Reading

TECHNOLOGY

GCash, Heart Evangelista collaborate

January 19, 2024 8:30 p.m.

GCash, the country’s leading finance super app, brings a powerful start to 2024 with the launch of its newest endorser — international fashion icon, Heart Evangelista-Escudero.

The unveiling of Heart as the new face of GCash was announced together with the release of the brand’s latest digital film, set to take over our feeds. The film not only showcases Heart’s exciting partnership with GCash, but also demonstrates how GCash has made its way into her heart, being her go-to super app for easy, safe & secure transactions, whether it be online, in-store, or even abroad.

Inspired by her travels and experiences, Heart shared her anecdotes of the moments GCash saved her in times of need –from receiving a sweet gift from her loved ones by using the app’s Send Money feature, to shopping online for cute trinkets for her dog, Panda. She even talked about how the ease of the Scan to Pay feature when it comes to simple things, like buying kwek-kwek when the craving strikes, and of course, who could forget her delighted reaction when she successfully used her GCash Card for the first time to pay for a coffee run in Paris!

“For me, GCash has been a game changer. You can use it for so many things, and literally EVERYWHERE! From my local cravings, shopping finds and even now that I’m getting ready to head out for Fashion Week season, there is no limit when I’ve got my GCash with me. Ang galing diba? ” – Heart Evangelista-Escudero

Much like Heart, there are so many new things to discover and love about GCash! Apart from being able to send and receive money for FREE, and get free vouchers and discounts when paying online, thanks to the GCash Card, its users can transact seamlessly in over 200 countries — with lower foreign exchange rates vs. competitors, it instantly became one of her travel essentials!

The different scenes showcased in the brand’s new film were inspired by the star’s day-to-day life. In fact, Heart was heavily involved in crafting the script, and dressing herself in some of her signature pieces from her personal wardrobe, some of which we’ve seen all over social media!

“In my Heart, GCash is the best way to pay”

Quoting Heart’s ending line in her newest film, GCash invites its users to enjoy the best things life has to offer in the most convenient and secure way possible.

“Heart was really the perfect, and easy, choice for us when it came to developing this campaign. She gave a mountain’s worth of ideas from the very first time we met her and the team was left inspired! Her attention to every detail was key for us to develop a material that was unique but also very personal to her. We loved the way she was able to share her personal experiences with us in highlighting how her GCash has made her transactions easier, not only in the Philippines but all over the globe. ” – Neil Trinidad, GCash Chief Marketing Officer

GCash, the country’s no. 1 finance super app continues its mission to empower Filipinos to move towards financial progress. Through this new collaboration between Heart and GCash, users can only expect more to come in 2024 as they continue to open doors to a brighter future for all Filipinos, so that they too can say that GCash is the best way to pay.

Watch the full GCash short film produced with Heart through the official GCash page @gcashofficial on Facebook and YouTube.

Continue Reading