TECHNOLOGY
Gas stations and beyond: Why cybersecurity is a top priority for industrial infrastructure
December 19, 2021 1:55 p.m.
By Chris Connell, Managing Director for Asia Pacific at Kaspersky
Industrial Control Systems (ICS) demand specific approaches to cybersecurity due to their complex structure, connected devices with different capabilities, software and operating systems, and critical functions. And this isn’t just a theory.
Something as common as a gas station has all the attributes of an ICS, such as connected equipment including pumps and tanks, controllers, a management system, a payment system, as well as connection to the corporate network, third-party service systems, and the internet. Just like any industrial facility, it has cybersecurity issues that companies should consider, to avoid disruptions that may affect the business, its employees, and the general public. This happened recently when gas stations in Iran were shut down because of a targeted attack.
This look through an ICS infrastructure is based on our research carried out at the end of 2020. It included the analysis of a modern gas station’s automation software architecture, a typical infrastructure, and the communications inside it. This allowed us to classify potential attack vectors and their impact on the fuel station’s network.
At a gas station
Imagine you’re driving your car and you need to fill it. You stop at a gas station, put the dispenser in the tank, and go to the convenience store to pay for the fuel. Once inside, the fresh coffee smells nice, you take some snacks for the road, complete your purchase and return to your vehicle.
To deliver the fuel to your tank, several systems should work: the back-office system and point of sales are used for payments and management functions. They are connected to the forecourt controller (FCC). This is the area with pumps outside the convenience store where customers park their cars to fill up. It is equipped with many systems such as a pump control, an automatic tank gauge (ATG), payment systems, etc. The FCC is the main device that controls fuel distribution, so when you pay through a cashier, the FCC commands the pump to supply it to your car so you can continue your journey.
Information about operations, the amount of fuel sold and available is transmitted to the management system locally and then to a head office that accumulates information from all stations.
Where are the problems?
Through our research, we managed to classify what could go wrong in this process. There are several potential operational technology (OT) and IT security issues that can affect the work of the station.
The first group of risks involves potential remote access from external networks. Just like many industrial systems today, the gas station employs solutions that are connected to public services through the internet, these include cloud banking systems or specialised fleet management systems. Remote access to the fuel station allows further malicious actions inside the network.
This was a real case described in one of Kaspersky’s studies. At the gas station, fuel management software was used to track the amount stored, set the price, and process payments. The system was connected to the internet and had vulnerabilities that allowed remote admin access with the ability to even change the fuel price.
There are also suppliers and service companies that have access to some parts of the infrastructure. Compromising these third parties may open doors to the target system for attackers. In fact, this type of threat is of great concern for companies of any size profile: a third (32%) of large organizations suffered attacks involving data shared with suppliers. What’s more, the financial impact of such incidents on enterprises is the highest across all types of attacks in 2021.
Another set of risks involves network and device issues that may potentially lead to the disruption of fuel station services or direct financial impact. Attacks can come from remote networks or by connecting to wireless networks or wired network ports available onsite.
Then, if the network is not segmented, the attack can spread from entry points such as secondary equipment in a shop and office workstations to critical components such as fuel management controls. The usage of unencrypted protocols (HTTP, CDP, FTP, Telnet, etc.) in the gas station network may allow adversaries to disclose sensitive information for further attack development.
Another critical but evergreen problem is vulnerabilities or security flaws in the fuel controller, POS terminals, and network equipment, as well as corporate endpoints and applications. In 2015, 5,800 automatic tank gauges (ATGs) were found to be exposed to unauthorized access from the internet because of a lack of password protection on a serial port. ATG is an electronic component placed in the tank that monitors the level of fuel and checks if it is leaking fluid. And through this serial port, the ATG can be programmed. If the signal it transfers is not correct, the operator won’t get an alert about any deviation. Figures from 2015 also suggested that at the time, most systems were in gas stations in the US and represented 3% of those used in the country. By compromising such critical systems as automatic tank gauges, criminals can unlock options for fraud or even physical damage.
It is also important to verify all workstations used on the forecourt such as points of sale, back-office systems, fuel controllers or payment terminals, as well as their configuration and even access to USB ports. For example, a lack of encryption or incompliancy to the PCI DSS standard in a payment system can contribute to the risk of an attack. For a fuel controller, it is also important to check industrial protocols. Lack of source authentication or integrity control may give adversaries, performing a man-in-the-middle attack, the opportunity to intercept data and manipulate station controllers.
Another point to manage is wireless gateways and reader units. A security assessment should be performed to identify insecure industrial protocols, the possibility of jamming and spoofing attacks.
How to improve
There are major security measures that should help increase the overall level of operational technology infrastructure. It is applicable to fuel stations but is no less relevant to any industrial network.
Network security: Purpose-based network segmentation enhances overall security and minimizes the surface of a possible attack. The segment of the network that has access to untrusted parts of it, such as corporate IT, should also be separated and protected with appropriate enterprise-grade protection software.
Passive OT network monitoring is essential for asset and communication inventory and detection of intrusions before they affect the technological process. Monitoring data also helps IT security teams to analyze events and consider hardening measures.
Access control: This should include restricting physical and logical access to the automation and control system. Security measures for remote access control for service companies will help to avoid third-party incidents.
Endpoint protection: It is important to implement specialized industrial-grade security software for OT hosts and servers. Ensure that the software is approved by the automation vendor and compatible with its solutions. This should help to avoid a situation where the protection product affects operation functions.
Security management: A system for centralized security event collection and protection software policy management should be implemented. It is also important that the solution allows vulnerability and patch management. If the system can be integrated with Security Information and Event Management (SIEM), that is a ‘nice to have’ option for organizations that plan to upgrade their protection level. Real-time continuous monitoring and endpoint data collection with rules-based response and analysis capabilities will help to further improve protection from advanced attacks.
A more fundamental approach that involves long-term measures is also important to improve the overall cybersecurity posture. This means adhering to industry standards for information security controls such as IEC 62443, NIST, NERC CIP, and so on. The organization should also conduct penetration testing or security analysis regularly, to identify vulnerabilities and information security problems before they are exploited by someone. And then, of course, follow all recommended measures to fix them properly.
Going deeper, there are specific requirements for companies with different levels of protection. But the measures listed above are essential to fill most cybersecurity gaps. Be it a fuel station, refinery, or giant car manufacturer, the basic principles of OT and IT protection should allow the company to build a reliable cybersecurity system and develop it according to their needs. This will provide a great foundation for satisfied business owners and happy clients.
TECHNOLOGY
TECHSHAKE announces strategic business alliance with Mirai Works
6:00 p.m. July 18, 2024
TECHSHAKE PTE. LTD., headquartered in Makati City, Philippines, with a branch office in Singapore, is pleased to announce that it has entered into a business alliance agreement with Mirai Works Inc., headquartered in Minato-ku, Tokyo, a professional-focused human resource service provider in Japan.
This alliance aims to provide support for the growth and market entry of startups in Japan and Southeast Asia.
TECHSHAKE’s Business
TECHSHAKE’s vision is to expand the startup ecosystem in Southeast Asia, with a focus on the Philippines, and to connect Southeast Asia with the world.
TECHSHAKE (Kotaro Adachi, CEO & Co-Founder) manages and runs the Philippines’ premier innovation conference “IGNITE” in collaboration with dentsu X, a subsidiary of Dentsu Inc. and a provider of integrated media planning, branding, and marketing services. Furthermore, TECHSHAKE operates media platforms, matches startups with established companies and investors, and provides essential support for startups to thrive.
TECHSHAKE is committed to fostering a global environment for business development in the Philippines.
TECHSHAKE is dedicated to nurturing the startup ecosystem in Southeast Asia by connecting entrepreneurs with the necessary resources and networks to succeed. With a strong presence in the Philippines and extensive experience in supporting startups, TECHSHAKE aims to bridge the gap between Southeast Asia and global markets.
Mirai Works (Nagaharu Okamoto, CEO & Co-Founder) is driven by a mission to empower individuals to embrace challenges that shape the future of Japan. Their vision is to cultivate an ecosystem where professionals thrive, regardless of traditional work structures. They are developing a business to provide opportunities for professionals to navigate changes throughout their careers and to support them in the midst of diverse career paths, including independence, entrepreneurship, side businesses, and full-time employment.
Mirai Works’ initiatives aim to provide resources for individuals to succeed in an evolving work landscape, fostering innovation and growth.
In May 2023, Mirai Works launched “Booster,” (https://booster.mirai-works.co.jp/) a startup support platform aimed at empowering professionals to start and scale their businesses. Booster facilitates growth through acceleration programs, providing information regarding startup ecosystem events and pitch competitions, and personalized mentorship, ensuring startups have access to critical resources for success.
In this collaboration, TECHSHAKE will leverage its expertise and network to support Japanese startups looking to enter the Southeast Asian market. Mirai Works, known for its professional human resource services and startup support platforms, will enhance TECHSHAKE’s efforts by providing hands-on support in various aspects of business promotion. This partnership underscores Mirai Works’ commitment to facilitating cross-border collaboration and growth opportunities for startups in Japan and Southeast Asia.
Details of Cooperation
Not only does Mirai Works support startups registered with Booster, but it also offers a service called “Free Consultant,” (https://freeconsultant.jp/) a freelancer business matching platform. Through Free Consultant, Mirai Works plans to connect highly skilled professionals with Southeast Asian startups supported by TECHSHAKE. Mirai Works provides hands-on support in various aspects of business promotion, including management strategy planning, marketing and PR, IPO preparation, and M&A activities, to drive business growth. Furthermore, Mirai Works will collaborate with TECHSHAKE to hold acceleration programs and offer support for overseas expansion.
TECHNOLOGY
Last Call for Entries to the OPPO imagine IF Photography Awards 2024
8:59 p.m. July 15, 2024
OPPO today issued a last call for entries to the OPPO imagine IF Photography Awards 2024. Since the competition was launched on January 17, over one million submissions have been received from 73 countries and regions, each showcasing a vibrant tapestry of cultures and traditions from around the world. As the global submission deadline approaches on July 28, OPPO is calling on photography enthusiasts to seize the final opportunity to capture spectacular moments through the lens of their cameras and collectively demonstrate the power of mobile imaging.
imagine IF Campaigns Gather Inspiring Work from around the World
Since inaugurating the competition at the start of the year, OPPO has initiated a series of themed activities aimed at encouraging its global user base to use the power of images to expand their imaginative boundaries. From May to July, coinciding with Mother’s Day and the beginning of the summer season, the ‘Road to Paris’ campaign invited users to portray the grace of mothers and capture the excitement of sport through the photographic lens for the chance to win a spot at Paris Photo 2024. The ‘In Sync with the World’ campaign meanwhile sought images that portrayed exploration around the world. Across both campaigns, the wide breadth of entries received showcased strong and emotive works that help to foster exchange and understanding between different cultures.
Photo 1 Shot by Isthisreal; Photo 2 Shot by Andrewoptics; Photo 3 Shot by Shisan and Petrichor
Celebrating Culture in All Its Diversity
Many of the entries submitted so far this year have seen participants from around the world showcase the unique landscapes and traditions of their home countries through stunning photographs. From the lively coastal life of Rio de Janeiro to the profound natural wonders of the Amazon rainforest, each image offers a portal into a new world for audiences to step into.
Alongside the main OPPO imagine IF Photography Awards, OPPO has also collaborated with Discovery Channel to showcase the diversity and allure of world cultures through the ‘Culture in a Shot’ program. Kicking-off in June in northern Thailand, the program has so far seen OPPO capture traditional crafts and musical instruments in a series of captivating images that bring the region’s rich and colorful cultural heritage to global audiences while advocating for deeper cross-cultural exchange.
Shot by Jerome Teo
Share Your Imagination for the Chance to Win Incredible Prizes
Entries for the OPPO imagine IF Photography Awards 2024 remain open until 24:00 (UTC+8) on July 28. Submission to this year’s competition will be judged by a prestigious global judging panel that includes the likes of contemporary photography icon Steve McCurry, together with National Geographic Photographer Michael Yamashita, Hasselblad Master Tina Signesdottir Hult, Magnum Photos member Alec Soth, and OPPO Senior Vice President and Chief Product Officer Pete Lau. A series of exciting awards are on offer to all participants, including individual prizes of up to USD24,000 and the chance to have their work exhibited at Paris Photo 2024.
Schedule and Prizes of OPPO imagine IF Photography Awards 2024
More than just a photography competition, the OPPO imagine IF Photography Awards is a platform for cultural exchange and creative inspiration. All photography enthusiasts are invited to take part and share moving moments that ignite inspiration and imagination through the global platform. To learn more about the OPPO imagine IF Photography Awards and to submit an entry, please visit the official website at https://imagine-if.oppo.com/en/.
TECHNOLOGY
ZTE CEO Xu Ziyang at MWC Shanghai 2024: Ingenuity for Solid Foundation, Openness for Win-Win
10:20 p.m. July 12, 2024
ZTE Corporation (0763.HK / 000063.SZ), a global leading provider of integrated information and communication technology solutions, announced today that the company’s CEO, Xu Ziyang, has delivered keynote speeches at both the “AI First” session and the GTI Summit themed “5G-A×AI” at MWC Shanghai 2024. Mr. Xu shared ZTE’s practices and innovations in intelligent digitalization amidst the AI wave.
In his keynote speech at the “AI First” session, Xu Ziyang shared insights under the theme “Ingenuity for Solid Foundation, Openness for Win-Win.” He emphasized that while the world has already entered an AI-driven industrial revolution, the development of generative AI faces challenges that extend from hallucinations, security, and ethics, to computing power, energy consumption, datasets, standardization, and commercial applications. To address these challenges, ZTE proposes three major principles: openness and decoupling, computing and network evolution, and training and inference enhancement.
Centered on customer value, ZTE provides a full-stack and full-scenario intelligent computing solution encompassing computing power, networks, capabilities, intelligence, and applications. This establishes a robust foundation through technical expertise and fosters innovation through collaborative partnerships, aimed at empowering various industries in their digital transformation. By continuously injecting momentum into high-quality economic development, ZTE plays a pivotal role in shaping a brighter future in the AI era.
At the GTI Summit during MWC Shanghai 2024, Xu Ziyang participated in the GTI-GSMA 5G-A×AI cooperation signing ceremony and delivered a speech titled “Computing and Network Evolution Towards an Intelligent Future.” He detailed the transition from traditional industrialization to new industrialization, addressing core challenges, proposing solutions, and citing practical cases. The critical pathway involves breakthroughs in core digital and intelligent technologies, enhancing infrastructure efficiency and capability, and deeply integrating industry expertise. This accelerates the convergence of digital and physical realms, enhances production and transaction efficiency, and establishes agile, resilient organizations prepared for an uncertain future.
According to Mr. Xu, ZTE advocates focusing on four dimensions – digitalization, networking, intelligence, and low-carbon initiatives – to tackle current challenges and drive continuous innovation and development. The company promotes openness and decoupling, unleashing superior computing with advanced networks, enhancing intelligence capabilities, and driving business growth through green initiatives, with a strong commitment to vigorously supporting the healthy and sustainable development of the industry chain, fostering a thriving digital economy.
Below is the original text of Xu Ziyang’s speech titled “Ingenuity for Solid Foundation, Openness for Win-Win”:
Good day, everyone. It’s an honor to be invited to speak here at the MWC Shanghai. Today, I’d like to share ZTE’s insights and practices under the theme of “Ingenuity for Solid Foundation, Openness for Win-Win”.
Embracing Changes and Promoting Intelligent Evolution
Over the past year, large language models and generative AI have accelerated the transformation towards an increasingly digital and intelligent world. With the rapid emergence of new technologies and products, new business scenarios and models are also gaining momentum. Although generative AI is still in the early stage, there is a growing consensus that the world has already entered an AI-driven industrial revolution. AI will have disruptive and far-reaching impacts on all aspects of production and life, and significantly reshape the global economic landscape. According to forecasts by a consulting firm, by 2030, AI will boost China’s GDP by 26% and North America’s by 14.5%. This is equivalent to USD 10.7 trillion and accounts for almost 70% of the global economic impact. Apparently, AI will bring unprecedented business opportunities in various sectors such as retail, financial services, and healthcare.
Apart from issues concerning hallucinations, security, and ethics, the development of generative AI also faces challenges in terms of computing power, energy consumption, dataset, standardization, commercial application, etc. Therefore, advancements in multiple areas are required. As such, ZTE proposes three major principles: computing and network evolution, training and inference enhancement, openness and decoupling.
First, to break through technology bottlenecks, it’s crucial to strengthen research on architectures, algorithms, computing networks, and hardware-software synergy, thus improving AI training and inference efficiency. Second, various solutions such as Retrieval-Augmented Generation (RAG) and AI agents should be employed to ensure reliability, security, and interpretability, thereby facilitating the widespread application of large models and higher value creation, and building a data flywheel that improves both capabilities and business efficiency. Finally, accelerating standardization through openness and decoupling will help build a thriving industrial and commercial ecosystem.
Building a Highly-Efficient Foundation Through Computing and Network Evolution
To begin with, we emphasize computing and network evolution to build a highly-efficient foundation. For intelligent computing, high-speed network connections are not just vital but also indispensable. From die-to-die connectivity to interconnects of chips, servers, and data centers, continuous innovation and breakthroughs in network technology will greatly enhance the performance and efficiency of intelligent computing.
More specifically, Die-to-Die (D2D) emphasizes high-speed interconnects between bare dies in a single package. Combined with the full series of in-house parallel and serial D2D interface IPs, as well as the advanced 2.5D and 3D packaging technologies, our solution enables heterogeneous integration and disaggregation. To a certain extent, challenges arising from the slowdown of Moore’s Law and constraints in manufacturing can be effectively mitigated. We have developed chip architectures that enable heterogeneous computing and network processing, which in turn deliver enhanced performance and cost efficiency.
TECHSHAKE announces strategic business alliance with Mirai Works
Exclusive for Smart Subscribers: Unlock Lionsgate Play for free starting July 18
TikTok enhances safety, transparency for Filipino community with new initiatives
