The attack used commodity ransomware that impacted only Microsoft Windows-based systems like HMI and historians. Controllers, PLC\u2019s or other level 1 equipment were not affected. It was also reported the attacker did not have remote control of operations. So even when the control layer was not affected the disabled HMI resulted in a \u2018loss of view\u2019. The operator then deliberately started a controlled shutdown of the facility. Due to pipeline transmission dependencies, this resulted in a production stop of the entire pipeline for two days.<\/p>\n
Were both the IT and OT networks infected?<\/strong><\/h2>\nAfter analysis by security researchers, it appears this incident was not specifically targeted at the ICS system. Nevertheless, it impacted a compression facility. The initial infection was via the IT network and due to a weak separation between the IT and OT networks, the ransomware also affected Windows-based ICS systems.<\/p>\n
This risk applies to many ICS networks as most systems rely on Windows-based systems and have connections with the business IT network. Also, when attackers target the IT network of a company the attached OT network can be affected as collateral damage.<\/p>\n
Tell me about this malicious ransomware and the ransom money that’s been paid?
\n<\/strong><\/h2>\nThe malware was identified as the \u2018Ryuk\u2019 ransomware, currently one of the most damaging pieces of ransomware. For reference, the attackers earned over $3.5 million USD in paid ransoms making it a lucrative business. The amount of operational damages is of course much more. The malware is designed to target enterprise environments, not individual systems. Therefore, it must be manually installed and operated by the attackers.<\/p>\n
How did these hackers operate?<\/strong><\/h2>\nThe initial attack was a phishing mail containing a malicious link. From there the attackers use various tools like PowerShell, Empire, and PSExec for internal reconnaissance, obtaining account privileges and distribution of the Ryuk malware on the network. Remote Desktop Protocol (RDP) is used for lateral movement to finally obtain access to a domain controller. From there batch scripts are executed to run on all domain joined systems that terminate services (like anti-virus), remove backups, and finally initiate the ransomware encryption.<\/p>\n
How do we protect our plants against this kind of cybersecurity attacks?<\/strong><\/h2>\nThese are the top 6 recommendations from our cybersecurity specialists:<\/p>\n
1. Keep employees trained and focussed to recognize phishing emails; question, if current policies like an annual half-hour video training, are enough.<\/p>\n
2. Strong IT and OT network separation is critical in reducing the risk of IT network compromises also affecting the OT networks;<\/p>\n
[list][item icon=”fa-check” ]Keep Windows domains separated and configure extremely strict firewalls between both networks.[\/item][\/list]<\/p>\n
[list][item icon=”fa-check” ]Implement enhanced IT\/OT network monitoring[\/item][\/list]<\/p>\n
3. As this type of malware is not installed and distributed automatically it will take the attackers some time on the network to prepare. Various steps as described earlier could have been detected by monitoring software.<\/p>\n
4. A fast incident response could have prevented the attack to do actual damage. An IT\/OT Security Operation Centre (SOC) would be a good example.<\/p>\n
5. Besides creating backups, also create a disaster recovery plan in case every system becomes unavailable at the same time. Test and train these plans in simulations or tabletop exercises.<\/p>\n
6. Keep anti-virus up-to-date and maintain patch levels of operating systems and all other applications.<\/p>\n
![\"\"](\"https:\/\/www.yokogawa.com\/eu\/blog\/app\/uploads\/sites\/10\/2022\/09\/Newsletter-promo-ransomware-300x157.jpg\")
<\/a><\/p>\n<\/h2>\nWould you like more information?<\/strong><\/h2>\nContact the cybersecurity specialists Mark Hellinghuizer en Mirsad Murtic of Yokogawa via IndustrialThreatAnalysis@nl.yokogawa.com<\/a> and sign up for our cybersecurity newsletter<\/a> to learn about cyber threats, vulnerabilities and proposed countermeasures for the Operational Technology domain.<\/p>\n","protected":false},"excerpt":{"rendered":"In February 2020, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) reported that ransomware impacted a U.S. pipeline operator. At one of the natural gas compression facilities of an undisclosed operator, both IT and ICS assets were affected by the […]<\/p>\n","protected":false},"author":1,"featured_media":12305,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_uag_custom_page_level_css":"","site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[2344],"tags":[],"coauthors":[2414],"class_list":["post-15136","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security-en","author-cap-astrid-muijs"],"acf":[],"yoast_head":"\n
How do you prevent a ransomware incident? -<\/title>\n<meta name=\"description\" content=\"In February 2020, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) reported that ransomware impacted...\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.yokogawa.com\/eu\/blog\/renewables\/en\/ransomware-incident\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"How do you prevent a ransomware incident?\" \/>\n<meta property=\"og:description\" content=\"In February 2020, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) reported that ransomware impacted...\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.yokogawa.com\/eu\/blog\/renewables\/en\/ransomware-incident\/\" \/>\n<meta property=\"og:site_name\" content=\"Energy and Renewables\" \/>\n<meta property=\"article:published_time\" content=\"2020-06-17T00:41:23+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2022-09-13T09:00:03+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.yokogawa.com\/eu\/blog\/app\/uploads\/sites\/10\/2022\/09\/80433638_s.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"847\" \/>\n\t<meta property=\"og:image:height\" content=\"565\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Astrid Muijs\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.yokogawa.com\\\/eu\\\/blog\\\/renewables\\\/en\\\/ransomware-incident\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.yokogawa.com\\\/eu\\\/blog\\\/renewables\\\/en\\\/ransomware-incident\\\/\"},\"author\":{\"name\":\"Rudi Diedrich\",\"@id\":\"https:\\\/\\\/www.yokogawa.com\\\/eu\\\/blog\\\/renewables\\\/en\\\/#\\\/schema\\\/person\\\/0bf50cfccfc1b2310dcc4976d069d1e6\"},\"headline\":\"How do you prevent a ransomware incident?\",\"datePublished\":\"2020-06-17T00:41:23+00:00\",\"dateModified\":\"2022-09-13T09:00:03+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.yokogawa.com\\\/eu\\\/blog\\\/renewables\\\/en\\\/ransomware-incident\\\/\"},\"wordCount\":674,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/www.yokogawa.com\\\/eu\\\/blog\\\/renewables\\\/en\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.yokogawa.com\\\/eu\\\/blog\\\/renewables\\\/en\\\/ransomware-incident\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.yokogawa.com\\\/eu\\\/blog\\\/app\\\/uploads\\\/sites\\\/10\\\/2022\\\/09\\\/80433638_s.jpg\",\"articleSection\":[\"Security\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.yokogawa.com\\\/eu\\\/blog\\\/renewables\\\/en\\\/ransomware-incident\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.yokogawa.com\\\/eu\\\/blog\\\/renewables\\\/en\\\/ransomware-incident\\\/\",\"url\":\"https:\\\/\\\/www.yokogawa.com\\\/eu\\\/blog\\\/renewables\\\/en\\\/ransomware-incident\\\/\",\"name\":\"How do you prevent a ransomware incident? -\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.yokogawa.com\\\/eu\\\/blog\\\/renewables\\\/en\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.yokogawa.com\\\/eu\\\/blog\\\/renewables\\\/en\\\/ransomware-incident\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.yokogawa.com\\\/eu\\\/blog\\\/renewables\\\/en\\\/ransomware-incident\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.yokogawa.com\\\/eu\\\/blog\\\/app\\\/uploads\\\/sites\\\/10\\\/2022\\\/09\\\/80433638_s.jpg\",\"datePublished\":\"2020-06-17T00:41:23+00:00\",\"dateModified\":\"2022-09-13T09:00:03+00:00\",\"description\":\"In February 2020, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) reported that ransomware impacted...\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.yokogawa.com\\\/eu\\\/blog\\\/renewables\\\/en\\\/ransomware-incident\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.yokogawa.com\\\/eu\\\/blog\\\/renewables\\\/en\\\/ransomware-incident\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.yokogawa.com\\\/eu\\\/blog\\\/renewables\\\/en\\\/ransomware-incident\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.yokogawa.com\\\/eu\\\/blog\\\/app\\\/uploads\\\/sites\\\/10\\\/2022\\\/09\\\/80433638_s.jpg\",\"contentUrl\":\"https:\\\/\\\/www.yokogawa.com\\\/eu\\\/blog\\\/app\\\/uploads\\\/sites\\\/10\\\/2022\\\/09\\\/80433638_s.jpg\",\"width\":847,\"height\":565,\"caption\":\"Ransomware alert message on a laptop screen - man at work\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.yokogawa.com\\\/eu\\\/blog\\\/renewables\\\/en\\\/ransomware-incident\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.yokogawa.com\\\/eu\\\/blog\\\/renewables\\\/en\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"How do you prevent a ransomware incident?\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.yokogawa.com\\\/eu\\\/blog\\\/renewables\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/www.yokogawa.com\\\/eu\\\/blog\\\/renewables\\\/en\\\/\",\"name\":\"Energy and Renewables\",\"description\":\"Yokogawa\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.yokogawa.com\\\/eu\\\/blog\\\/renewables\\\/en\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.yokogawa.com\\\/eu\\\/blog\\\/renewables\\\/en\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.yokogawa.com\\\/eu\\\/blog\\\/renewables\\\/en\\\/#organization\",\"name\":\"Energy and Renewables\",\"url\":\"https:\\\/\\\/www.yokogawa.com\\\/eu\\\/blog\\\/renewables\\\/en\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.yokogawa.com\\\/eu\\\/blog\\\/renewables\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.yokogawa.com\\\/eu\\\/blog\\\/app\\\/uploads\\\/sites\\\/10\\\/2022\\\/09\\\/yokogawa-logo-e1651674418793.png\",\"contentUrl\":\"https:\\\/\\\/www.yokogawa.com\\\/eu\\\/blog\\\/app\\\/uploads\\\/sites\\\/10\\\/2022\\\/09\\\/yokogawa-logo-e1651674418793.png\",\"width\":302,\"height\":89,\"caption\":\"Energy and Renewables\"},\"image\":{\"@id\":\"https:\\\/\\\/www.yokogawa.com\\\/eu\\\/blog\\\/renewables\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.yokogawa.com\\\/eu\\\/blog\\\/renewables\\\/en\\\/#\\\/schema\\\/person\\\/0bf50cfccfc1b2310dcc4976d069d1e6\",\"name\":\"Rudi Diedrich\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/c53b1314dda41d50e4b677e713edff45c6b868a91ed744086276d97f3578adf5?s=96&d=mm&r=gddb1b3973f868c42d9493be05cd0ca11\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/c53b1314dda41d50e4b677e713edff45c6b868a91ed744086276d97f3578adf5?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/c53b1314dda41d50e4b677e713edff45c6b868a91ed744086276d97f3578adf5?s=96&d=mm&r=g\",\"caption\":\"Rudi Diedrich\"},\"url\":\"https:\\\/\\\/www.yokogawa.com\\\/eu\\\/blog\\\/renewables\\\/en\\\/author\\\/admin\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"How do you prevent a ransomware incident? -","description":"In February 2020, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) reported that ransomware impacted...","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.yokogawa.com\/eu\/blog\/renewables\/en\/ransomware-incident\/","og_locale":"en_US","og_type":"article","og_title":"How do you prevent a ransomware incident?","og_description":"In February 2020, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) reported that ransomware impacted...","og_url":"https:\/\/www.yokogawa.com\/eu\/blog\/renewables\/en\/ransomware-incident\/","og_site_name":"Energy and Renewables","article_published_time":"2020-06-17T00:41:23+00:00","article_modified_time":"2022-09-13T09:00:03+00:00","og_image":[{"width":847,"height":565,"url":"https:\/\/www.yokogawa.com\/eu\/blog\/app\/uploads\/sites\/10\/2022\/09\/80433638_s.jpg","type":"image\/jpeg"}],"author":"Astrid Muijs","twitter_card":"summary_large_image","schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.yokogawa.com\/eu\/blog\/renewables\/en\/ransomware-incident\/#article","isPartOf":{"@id":"https:\/\/www.yokogawa.com\/eu\/blog\/renewables\/en\/ransomware-incident\/"},"author":{"name":"Rudi Diedrich","@id":"https:\/\/www.yokogawa.com\/eu\/blog\/renewables\/en\/#\/schema\/person\/0bf50cfccfc1b2310dcc4976d069d1e6"},"headline":"How do you prevent a ransomware incident?","datePublished":"2020-06-17T00:41:23+00:00","dateModified":"2022-09-13T09:00:03+00:00","mainEntityOfPage":{"@id":"https:\/\/www.yokogawa.com\/eu\/blog\/renewables\/en\/ransomware-incident\/"},"wordCount":674,"commentCount":0,"publisher":{"@id":"https:\/\/www.yokogawa.com\/eu\/blog\/renewables\/en\/#organization"},"image":{"@id":"https:\/\/www.yokogawa.com\/eu\/blog\/renewables\/en\/ransomware-incident\/#primaryimage"},"thumbnailUrl":"https:\/\/www.yokogawa.com\/eu\/blog\/app\/uploads\/sites\/10\/2022\/09\/80433638_s.jpg","articleSection":["Security"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.yokogawa.com\/eu\/blog\/renewables\/en\/ransomware-incident\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.yokogawa.com\/eu\/blog\/renewables\/en\/ransomware-incident\/","url":"https:\/\/www.yokogawa.com\/eu\/blog\/renewables\/en\/ransomware-incident\/","name":"How do you prevent a ransomware incident? -","isPartOf":{"@id":"https:\/\/www.yokogawa.com\/eu\/blog\/renewables\/en\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.yokogawa.com\/eu\/blog\/renewables\/en\/ransomware-incident\/#primaryimage"},"image":{"@id":"https:\/\/www.yokogawa.com\/eu\/blog\/renewables\/en\/ransomware-incident\/#primaryimage"},"thumbnailUrl":"https:\/\/www.yokogawa.com\/eu\/blog\/app\/uploads\/sites\/10\/2022\/09\/80433638_s.jpg","datePublished":"2020-06-17T00:41:23+00:00","dateModified":"2022-09-13T09:00:03+00:00","description":"In February 2020, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) reported that ransomware impacted...","breadcrumb":{"@id":"https:\/\/www.yokogawa.com\/eu\/blog\/renewables\/en\/ransomware-incident\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.yokogawa.com\/eu\/blog\/renewables\/en\/ransomware-incident\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.yokogawa.com\/eu\/blog\/renewables\/en\/ransomware-incident\/#primaryimage","url":"https:\/\/www.yokogawa.com\/eu\/blog\/app\/uploads\/sites\/10\/2022\/09\/80433638_s.jpg","contentUrl":"https:\/\/www.yokogawa.com\/eu\/blog\/app\/uploads\/sites\/10\/2022\/09\/80433638_s.jpg","width":847,"height":565,"caption":"Ransomware alert message on a laptop screen - man at work"},{"@type":"BreadcrumbList","@id":"https:\/\/www.yokogawa.com\/eu\/blog\/renewables\/en\/ransomware-incident\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.yokogawa.com\/eu\/blog\/renewables\/en\/"},{"@type":"ListItem","position":2,"name":"How do you prevent a ransomware incident?"}]},{"@type":"WebSite","@id":"https:\/\/www.yokogawa.com\/eu\/blog\/renewables\/en\/#website","url":"https:\/\/www.yokogawa.com\/eu\/blog\/renewables\/en\/","name":"Energy and Renewables","description":"Yokogawa","publisher":{"@id":"https:\/\/www.yokogawa.com\/eu\/blog\/renewables\/en\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.yokogawa.com\/eu\/blog\/renewables\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.yokogawa.com\/eu\/blog\/renewables\/en\/#organization","name":"Energy and Renewables","url":"https:\/\/www.yokogawa.com\/eu\/blog\/renewables\/en\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.yokogawa.com\/eu\/blog\/renewables\/en\/#\/schema\/logo\/image\/","url":"https:\/\/www.yokogawa.com\/eu\/blog\/app\/uploads\/sites\/10\/2022\/09\/yokogawa-logo-e1651674418793.png","contentUrl":"https:\/\/www.yokogawa.com\/eu\/blog\/app\/uploads\/sites\/10\/2022\/09\/yokogawa-logo-e1651674418793.png","width":302,"height":89,"caption":"Energy and Renewables"},"image":{"@id":"https:\/\/www.yokogawa.com\/eu\/blog\/renewables\/en\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/www.yokogawa.com\/eu\/blog\/renewables\/en\/#\/schema\/person\/0bf50cfccfc1b2310dcc4976d069d1e6","name":"Rudi Diedrich","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/c53b1314dda41d50e4b677e713edff45c6b868a91ed744086276d97f3578adf5?s=96&d=mm&r=gddb1b3973f868c42d9493be05cd0ca11","url":"https:\/\/secure.gravatar.com\/avatar\/c53b1314dda41d50e4b677e713edff45c6b868a91ed744086276d97f3578adf5?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/c53b1314dda41d50e4b677e713edff45c6b868a91ed744086276d97f3578adf5?s=96&d=mm&r=g","caption":"Rudi Diedrich"},"url":"https:\/\/www.yokogawa.com\/eu\/blog\/renewables\/en\/author\/admin\/"}]}},"uagb_featured_image_src":{"full":["https:\/\/www.yokogawa.com\/eu\/blog\/app\/uploads\/sites\/10\/2022\/09\/80433638_s.jpg",847,565,false],"thumbnail":["https:\/\/www.yokogawa.com\/eu\/blog\/app\/uploads\/sites\/10\/2022\/09\/80433638_s-150x150.jpg",150,150,true],"medium":["https:\/\/www.yokogawa.com\/eu\/blog\/app\/uploads\/sites\/10\/2022\/09\/80433638_s-300x200.jpg",300,200,true],"medium_large":["https:\/\/www.yokogawa.com\/eu\/blog\/app\/uploads\/sites\/10\/2022\/09\/80433638_s-768x512.jpg",768,512,true],"large":["https:\/\/www.yokogawa.com\/eu\/blog\/app\/uploads\/sites\/10\/2022\/09\/80433638_s.jpg",847,565,false],"1536x1536":["https:\/\/www.yokogawa.com\/eu\/blog\/app\/uploads\/sites\/10\/2022\/09\/80433638_s.jpg",847,565,false],"2048x2048":["https:\/\/www.yokogawa.com\/eu\/blog\/app\/uploads\/sites\/10\/2022\/09\/80433638_s.jpg",847,565,false],"post-thumbnail":["https:\/\/www.yokogawa.com\/eu\/blog\/app\/uploads\/sites\/10\/2022\/09\/80433638_s-356x200.jpg",356,200,true]},"uagb_author_info":{"display_name":"Rudi Diedrich","author_link":"https:\/\/www.yokogawa.com\/eu\/blog\/renewables\/en\/author\/admin\/"},"uagb_comment_info":0,"uagb_excerpt":"In February 2020, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) reported that ransomware impacted a U.S. pipeline operator. At one of the natural gas compression facilities of an undisclosed operator, both IT and ICS assets were affected by the […]","_links":{"self":[{"href":"https:\/\/www.yokogawa.com\/eu\/blog\/renewables\/en\/wp-json\/wp\/v2\/posts\/15136","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.yokogawa.com\/eu\/blog\/renewables\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.yokogawa.com\/eu\/blog\/renewables\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.yokogawa.com\/eu\/blog\/renewables\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.yokogawa.com\/eu\/blog\/renewables\/en\/wp-json\/wp\/v2\/comments?post=15136"}],"version-history":[{"count":1,"href":"https:\/\/www.yokogawa.com\/eu\/blog\/renewables\/en\/wp-json\/wp\/v2\/posts\/15136\/revisions"}],"predecessor-version":[{"id":15137,"href":"https:\/\/www.yokogawa.com\/eu\/blog\/renewables\/en\/wp-json\/wp\/v2\/posts\/15136\/revisions\/15137"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.yokogawa.com\/eu\/blog\/renewables\/en\/wp-json\/wp\/v2\/media\/12305"}],"wp:attachment":[{"href":"https:\/\/www.yokogawa.com\/eu\/blog\/renewables\/en\/wp-json\/wp\/v2\/media?parent=15136"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.yokogawa.com\/eu\/blog\/renewables\/en\/wp-json\/wp\/v2\/categories?post=15136"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.yokogawa.com\/eu\/blog\/renewables\/en\/wp-json\/wp\/v2\/tags?post=15136"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.yokogawa.com\/eu\/blog\/renewables\/en\/wp-json\/wp\/v2\/coauthors?post=15136"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
\n<\/strong><\/h2>\n
The malware was identified as the \u2018Ryuk\u2019 ransomware, currently one of the most damaging pieces of ransomware. For reference, the attackers earned over $3.5 million USD in paid ransoms making it a lucrative business. The amount of operational damages is of course much more. The malware is designed to target enterprise environments, not individual systems. Therefore, it must be manually installed and operated by the attackers.<\/p>\n
How did these hackers operate?<\/strong><\/h2>\nThe initial attack was a phishing mail containing a malicious link. From there the attackers use various tools like PowerShell, Empire, and PSExec for internal reconnaissance, obtaining account privileges and distribution of the Ryuk malware on the network. Remote Desktop Protocol (RDP) is used for lateral movement to finally obtain access to a domain controller. From there batch scripts are executed to run on all domain joined systems that terminate services (like anti-virus), remove backups, and finally initiate the ransomware encryption.<\/p>\n
How do we protect our plants against this kind of cybersecurity attacks?<\/strong><\/h2>\nThese are the top 6 recommendations from our cybersecurity specialists:<\/p>\n
1. Keep employees trained and focussed to recognize phishing emails; question, if current policies like an annual half-hour video training, are enough.<\/p>\n
2. Strong IT and OT network separation is critical in reducing the risk of IT network compromises also affecting the OT networks;<\/p>\n
[list][item icon=”fa-check” ]Keep Windows domains separated and configure extremely strict firewalls between both networks.[\/item][\/list]<\/p>\n
[list][item icon=”fa-check” ]Implement enhanced IT\/OT network monitoring[\/item][\/list]<\/p>\n
3. As this type of malware is not installed and distributed automatically it will take the attackers some time on the network to prepare. Various steps as described earlier could have been detected by monitoring software.<\/p>\n
4. A fast incident response could have prevented the attack to do actual damage. An IT\/OT Security Operation Centre (SOC) would be a good example.<\/p>\n
5. Besides creating backups, also create a disaster recovery plan in case every system becomes unavailable at the same time. Test and train these plans in simulations or tabletop exercises.<\/p>\n
6. Keep anti-virus up-to-date and maintain patch levels of operating systems and all other applications.<\/p>\n
<\/a><\/p>\n<\/h2>\nWould you like more information?<\/strong><\/h2>\nContact the cybersecurity specialists Mark Hellinghuizer en Mirsad Murtic of Yokogawa via IndustrialThreatAnalysis@nl.yokogawa.com<\/a> and sign up for our cybersecurity newsletter<\/a> to learn about cyber threats, vulnerabilities and proposed countermeasures for the Operational Technology domain.<\/p>\n","protected":false},"excerpt":{"rendered":"In February 2020, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) reported that ransomware impacted a U.S. pipeline operator. At one of the natural gas compression facilities of an undisclosed operator, both IT and ICS assets were affected by the […]<\/p>\n","protected":false},"author":1,"featured_media":12305,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_uag_custom_page_level_css":"","site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[2344],"tags":[],"coauthors":[2414],"class_list":["post-15136","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security-en","author-cap-astrid-muijs"],"acf":[],"yoast_head":"\n
How do you prevent a ransomware incident? -<\/title>\n<meta name=\"description\" content=\"In February 2020, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) reported that ransomware impacted...\" \/>\n<meta name=\"robots\" content=\"index, follow, max-snippet:-1, max-image-preview:large, max-video-preview:-1\" \/>\n<link rel=\"canonical\" href=\"https:\/\/www.yokogawa.com\/eu\/blog\/renewables\/en\/ransomware-incident\/\" \/>\n<meta property=\"og:locale\" content=\"en_US\" \/>\n<meta property=\"og:type\" content=\"article\" \/>\n<meta property=\"og:title\" content=\"How do you prevent a ransomware incident?\" \/>\n<meta property=\"og:description\" content=\"In February 2020, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) reported that ransomware impacted...\" \/>\n<meta property=\"og:url\" content=\"https:\/\/www.yokogawa.com\/eu\/blog\/renewables\/en\/ransomware-incident\/\" \/>\n<meta property=\"og:site_name\" content=\"Energy and Renewables\" \/>\n<meta property=\"article:published_time\" content=\"2020-06-17T00:41:23+00:00\" \/>\n<meta property=\"article:modified_time\" content=\"2022-09-13T09:00:03+00:00\" \/>\n<meta property=\"og:image\" content=\"https:\/\/www.yokogawa.com\/eu\/blog\/app\/uploads\/sites\/10\/2022\/09\/80433638_s.jpg\" \/>\n\t<meta property=\"og:image:width\" content=\"847\" \/>\n\t<meta property=\"og:image:height\" content=\"565\" \/>\n\t<meta property=\"og:image:type\" content=\"image\/jpeg\" \/>\n<meta name=\"author\" content=\"Astrid Muijs\" \/>\n<meta name=\"twitter:card\" content=\"summary_large_image\" \/>\n<script type=\"application\/ld+json\" class=\"yoast-schema-graph\">{\"@context\":\"https:\\\/\\\/schema.org\",\"@graph\":[{\"@type\":\"Article\",\"@id\":\"https:\\\/\\\/www.yokogawa.com\\\/eu\\\/blog\\\/renewables\\\/en\\\/ransomware-incident\\\/#article\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.yokogawa.com\\\/eu\\\/blog\\\/renewables\\\/en\\\/ransomware-incident\\\/\"},\"author\":{\"name\":\"Rudi Diedrich\",\"@id\":\"https:\\\/\\\/www.yokogawa.com\\\/eu\\\/blog\\\/renewables\\\/en\\\/#\\\/schema\\\/person\\\/0bf50cfccfc1b2310dcc4976d069d1e6\"},\"headline\":\"How do you prevent a ransomware incident?\",\"datePublished\":\"2020-06-17T00:41:23+00:00\",\"dateModified\":\"2022-09-13T09:00:03+00:00\",\"mainEntityOfPage\":{\"@id\":\"https:\\\/\\\/www.yokogawa.com\\\/eu\\\/blog\\\/renewables\\\/en\\\/ransomware-incident\\\/\"},\"wordCount\":674,\"commentCount\":0,\"publisher\":{\"@id\":\"https:\\\/\\\/www.yokogawa.com\\\/eu\\\/blog\\\/renewables\\\/en\\\/#organization\"},\"image\":{\"@id\":\"https:\\\/\\\/www.yokogawa.com\\\/eu\\\/blog\\\/renewables\\\/en\\\/ransomware-incident\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.yokogawa.com\\\/eu\\\/blog\\\/app\\\/uploads\\\/sites\\\/10\\\/2022\\\/09\\\/80433638_s.jpg\",\"articleSection\":[\"Security\"],\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"CommentAction\",\"name\":\"Comment\",\"target\":[\"https:\\\/\\\/www.yokogawa.com\\\/eu\\\/blog\\\/renewables\\\/en\\\/ransomware-incident\\\/#respond\"]}]},{\"@type\":\"WebPage\",\"@id\":\"https:\\\/\\\/www.yokogawa.com\\\/eu\\\/blog\\\/renewables\\\/en\\\/ransomware-incident\\\/\",\"url\":\"https:\\\/\\\/www.yokogawa.com\\\/eu\\\/blog\\\/renewables\\\/en\\\/ransomware-incident\\\/\",\"name\":\"How do you prevent a ransomware incident? -\",\"isPartOf\":{\"@id\":\"https:\\\/\\\/www.yokogawa.com\\\/eu\\\/blog\\\/renewables\\\/en\\\/#website\"},\"primaryImageOfPage\":{\"@id\":\"https:\\\/\\\/www.yokogawa.com\\\/eu\\\/blog\\\/renewables\\\/en\\\/ransomware-incident\\\/#primaryimage\"},\"image\":{\"@id\":\"https:\\\/\\\/www.yokogawa.com\\\/eu\\\/blog\\\/renewables\\\/en\\\/ransomware-incident\\\/#primaryimage\"},\"thumbnailUrl\":\"https:\\\/\\\/www.yokogawa.com\\\/eu\\\/blog\\\/app\\\/uploads\\\/sites\\\/10\\\/2022\\\/09\\\/80433638_s.jpg\",\"datePublished\":\"2020-06-17T00:41:23+00:00\",\"dateModified\":\"2022-09-13T09:00:03+00:00\",\"description\":\"In February 2020, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) reported that ransomware impacted...\",\"breadcrumb\":{\"@id\":\"https:\\\/\\\/www.yokogawa.com\\\/eu\\\/blog\\\/renewables\\\/en\\\/ransomware-incident\\\/#breadcrumb\"},\"inLanguage\":\"en-US\",\"potentialAction\":[{\"@type\":\"ReadAction\",\"target\":[\"https:\\\/\\\/www.yokogawa.com\\\/eu\\\/blog\\\/renewables\\\/en\\\/ransomware-incident\\\/\"]}]},{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.yokogawa.com\\\/eu\\\/blog\\\/renewables\\\/en\\\/ransomware-incident\\\/#primaryimage\",\"url\":\"https:\\\/\\\/www.yokogawa.com\\\/eu\\\/blog\\\/app\\\/uploads\\\/sites\\\/10\\\/2022\\\/09\\\/80433638_s.jpg\",\"contentUrl\":\"https:\\\/\\\/www.yokogawa.com\\\/eu\\\/blog\\\/app\\\/uploads\\\/sites\\\/10\\\/2022\\\/09\\\/80433638_s.jpg\",\"width\":847,\"height\":565,\"caption\":\"Ransomware alert message on a laptop screen - man at work\"},{\"@type\":\"BreadcrumbList\",\"@id\":\"https:\\\/\\\/www.yokogawa.com\\\/eu\\\/blog\\\/renewables\\\/en\\\/ransomware-incident\\\/#breadcrumb\",\"itemListElement\":[{\"@type\":\"ListItem\",\"position\":1,\"name\":\"Home\",\"item\":\"https:\\\/\\\/www.yokogawa.com\\\/eu\\\/blog\\\/renewables\\\/en\\\/\"},{\"@type\":\"ListItem\",\"position\":2,\"name\":\"How do you prevent a ransomware incident?\"}]},{\"@type\":\"WebSite\",\"@id\":\"https:\\\/\\\/www.yokogawa.com\\\/eu\\\/blog\\\/renewables\\\/en\\\/#website\",\"url\":\"https:\\\/\\\/www.yokogawa.com\\\/eu\\\/blog\\\/renewables\\\/en\\\/\",\"name\":\"Energy and Renewables\",\"description\":\"Yokogawa\",\"publisher\":{\"@id\":\"https:\\\/\\\/www.yokogawa.com\\\/eu\\\/blog\\\/renewables\\\/en\\\/#organization\"},\"potentialAction\":[{\"@type\":\"SearchAction\",\"target\":{\"@type\":\"EntryPoint\",\"urlTemplate\":\"https:\\\/\\\/www.yokogawa.com\\\/eu\\\/blog\\\/renewables\\\/en\\\/?s={search_term_string}\"},\"query-input\":{\"@type\":\"PropertyValueSpecification\",\"valueRequired\":true,\"valueName\":\"search_term_string\"}}],\"inLanguage\":\"en-US\"},{\"@type\":\"Organization\",\"@id\":\"https:\\\/\\\/www.yokogawa.com\\\/eu\\\/blog\\\/renewables\\\/en\\\/#organization\",\"name\":\"Energy and Renewables\",\"url\":\"https:\\\/\\\/www.yokogawa.com\\\/eu\\\/blog\\\/renewables\\\/en\\\/\",\"logo\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/www.yokogawa.com\\\/eu\\\/blog\\\/renewables\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\",\"url\":\"https:\\\/\\\/www.yokogawa.com\\\/eu\\\/blog\\\/app\\\/uploads\\\/sites\\\/10\\\/2022\\\/09\\\/yokogawa-logo-e1651674418793.png\",\"contentUrl\":\"https:\\\/\\\/www.yokogawa.com\\\/eu\\\/blog\\\/app\\\/uploads\\\/sites\\\/10\\\/2022\\\/09\\\/yokogawa-logo-e1651674418793.png\",\"width\":302,\"height\":89,\"caption\":\"Energy and Renewables\"},\"image\":{\"@id\":\"https:\\\/\\\/www.yokogawa.com\\\/eu\\\/blog\\\/renewables\\\/en\\\/#\\\/schema\\\/logo\\\/image\\\/\"}},{\"@type\":\"Person\",\"@id\":\"https:\\\/\\\/www.yokogawa.com\\\/eu\\\/blog\\\/renewables\\\/en\\\/#\\\/schema\\\/person\\\/0bf50cfccfc1b2310dcc4976d069d1e6\",\"name\":\"Rudi Diedrich\",\"image\":{\"@type\":\"ImageObject\",\"inLanguage\":\"en-US\",\"@id\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/c53b1314dda41d50e4b677e713edff45c6b868a91ed744086276d97f3578adf5?s=96&d=mm&r=gddb1b3973f868c42d9493be05cd0ca11\",\"url\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/c53b1314dda41d50e4b677e713edff45c6b868a91ed744086276d97f3578adf5?s=96&d=mm&r=g\",\"contentUrl\":\"https:\\\/\\\/secure.gravatar.com\\\/avatar\\\/c53b1314dda41d50e4b677e713edff45c6b868a91ed744086276d97f3578adf5?s=96&d=mm&r=g\",\"caption\":\"Rudi Diedrich\"},\"url\":\"https:\\\/\\\/www.yokogawa.com\\\/eu\\\/blog\\\/renewables\\\/en\\\/author\\\/admin\\\/\"}]}<\/script>\n<!-- \/ Yoast SEO Premium plugin. -->","yoast_head_json":{"title":"How do you prevent a ransomware incident? -","description":"In February 2020, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) reported that ransomware impacted...","robots":{"index":"index","follow":"follow","max-snippet":"max-snippet:-1","max-image-preview":"max-image-preview:large","max-video-preview":"max-video-preview:-1"},"canonical":"https:\/\/www.yokogawa.com\/eu\/blog\/renewables\/en\/ransomware-incident\/","og_locale":"en_US","og_type":"article","og_title":"How do you prevent a ransomware incident?","og_description":"In February 2020, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) reported that ransomware impacted...","og_url":"https:\/\/www.yokogawa.com\/eu\/blog\/renewables\/en\/ransomware-incident\/","og_site_name":"Energy and Renewables","article_published_time":"2020-06-17T00:41:23+00:00","article_modified_time":"2022-09-13T09:00:03+00:00","og_image":[{"width":847,"height":565,"url":"https:\/\/www.yokogawa.com\/eu\/blog\/app\/uploads\/sites\/10\/2022\/09\/80433638_s.jpg","type":"image\/jpeg"}],"author":"Astrid Muijs","twitter_card":"summary_large_image","schema":{"@context":"https:\/\/schema.org","@graph":[{"@type":"Article","@id":"https:\/\/www.yokogawa.com\/eu\/blog\/renewables\/en\/ransomware-incident\/#article","isPartOf":{"@id":"https:\/\/www.yokogawa.com\/eu\/blog\/renewables\/en\/ransomware-incident\/"},"author":{"name":"Rudi Diedrich","@id":"https:\/\/www.yokogawa.com\/eu\/blog\/renewables\/en\/#\/schema\/person\/0bf50cfccfc1b2310dcc4976d069d1e6"},"headline":"How do you prevent a ransomware incident?","datePublished":"2020-06-17T00:41:23+00:00","dateModified":"2022-09-13T09:00:03+00:00","mainEntityOfPage":{"@id":"https:\/\/www.yokogawa.com\/eu\/blog\/renewables\/en\/ransomware-incident\/"},"wordCount":674,"commentCount":0,"publisher":{"@id":"https:\/\/www.yokogawa.com\/eu\/blog\/renewables\/en\/#organization"},"image":{"@id":"https:\/\/www.yokogawa.com\/eu\/blog\/renewables\/en\/ransomware-incident\/#primaryimage"},"thumbnailUrl":"https:\/\/www.yokogawa.com\/eu\/blog\/app\/uploads\/sites\/10\/2022\/09\/80433638_s.jpg","articleSection":["Security"],"inLanguage":"en-US","potentialAction":[{"@type":"CommentAction","name":"Comment","target":["https:\/\/www.yokogawa.com\/eu\/blog\/renewables\/en\/ransomware-incident\/#respond"]}]},{"@type":"WebPage","@id":"https:\/\/www.yokogawa.com\/eu\/blog\/renewables\/en\/ransomware-incident\/","url":"https:\/\/www.yokogawa.com\/eu\/blog\/renewables\/en\/ransomware-incident\/","name":"How do you prevent a ransomware incident? -","isPartOf":{"@id":"https:\/\/www.yokogawa.com\/eu\/blog\/renewables\/en\/#website"},"primaryImageOfPage":{"@id":"https:\/\/www.yokogawa.com\/eu\/blog\/renewables\/en\/ransomware-incident\/#primaryimage"},"image":{"@id":"https:\/\/www.yokogawa.com\/eu\/blog\/renewables\/en\/ransomware-incident\/#primaryimage"},"thumbnailUrl":"https:\/\/www.yokogawa.com\/eu\/blog\/app\/uploads\/sites\/10\/2022\/09\/80433638_s.jpg","datePublished":"2020-06-17T00:41:23+00:00","dateModified":"2022-09-13T09:00:03+00:00","description":"In February 2020, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) reported that ransomware impacted...","breadcrumb":{"@id":"https:\/\/www.yokogawa.com\/eu\/blog\/renewables\/en\/ransomware-incident\/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https:\/\/www.yokogawa.com\/eu\/blog\/renewables\/en\/ransomware-incident\/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.yokogawa.com\/eu\/blog\/renewables\/en\/ransomware-incident\/#primaryimage","url":"https:\/\/www.yokogawa.com\/eu\/blog\/app\/uploads\/sites\/10\/2022\/09\/80433638_s.jpg","contentUrl":"https:\/\/www.yokogawa.com\/eu\/blog\/app\/uploads\/sites\/10\/2022\/09\/80433638_s.jpg","width":847,"height":565,"caption":"Ransomware alert message on a laptop screen - man at work"},{"@type":"BreadcrumbList","@id":"https:\/\/www.yokogawa.com\/eu\/blog\/renewables\/en\/ransomware-incident\/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https:\/\/www.yokogawa.com\/eu\/blog\/renewables\/en\/"},{"@type":"ListItem","position":2,"name":"How do you prevent a ransomware incident?"}]},{"@type":"WebSite","@id":"https:\/\/www.yokogawa.com\/eu\/blog\/renewables\/en\/#website","url":"https:\/\/www.yokogawa.com\/eu\/blog\/renewables\/en\/","name":"Energy and Renewables","description":"Yokogawa","publisher":{"@id":"https:\/\/www.yokogawa.com\/eu\/blog\/renewables\/en\/#organization"},"potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https:\/\/www.yokogawa.com\/eu\/blog\/renewables\/en\/?s={search_term_string}"},"query-input":{"@type":"PropertyValueSpecification","valueRequired":true,"valueName":"search_term_string"}}],"inLanguage":"en-US"},{"@type":"Organization","@id":"https:\/\/www.yokogawa.com\/eu\/blog\/renewables\/en\/#organization","name":"Energy and Renewables","url":"https:\/\/www.yokogawa.com\/eu\/blog\/renewables\/en\/","logo":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/www.yokogawa.com\/eu\/blog\/renewables\/en\/#\/schema\/logo\/image\/","url":"https:\/\/www.yokogawa.com\/eu\/blog\/app\/uploads\/sites\/10\/2022\/09\/yokogawa-logo-e1651674418793.png","contentUrl":"https:\/\/www.yokogawa.com\/eu\/blog\/app\/uploads\/sites\/10\/2022\/09\/yokogawa-logo-e1651674418793.png","width":302,"height":89,"caption":"Energy and Renewables"},"image":{"@id":"https:\/\/www.yokogawa.com\/eu\/blog\/renewables\/en\/#\/schema\/logo\/image\/"}},{"@type":"Person","@id":"https:\/\/www.yokogawa.com\/eu\/blog\/renewables\/en\/#\/schema\/person\/0bf50cfccfc1b2310dcc4976d069d1e6","name":"Rudi Diedrich","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https:\/\/secure.gravatar.com\/avatar\/c53b1314dda41d50e4b677e713edff45c6b868a91ed744086276d97f3578adf5?s=96&d=mm&r=gddb1b3973f868c42d9493be05cd0ca11","url":"https:\/\/secure.gravatar.com\/avatar\/c53b1314dda41d50e4b677e713edff45c6b868a91ed744086276d97f3578adf5?s=96&d=mm&r=g","contentUrl":"https:\/\/secure.gravatar.com\/avatar\/c53b1314dda41d50e4b677e713edff45c6b868a91ed744086276d97f3578adf5?s=96&d=mm&r=g","caption":"Rudi Diedrich"},"url":"https:\/\/www.yokogawa.com\/eu\/blog\/renewables\/en\/author\/admin\/"}]}},"uagb_featured_image_src":{"full":["https:\/\/www.yokogawa.com\/eu\/blog\/app\/uploads\/sites\/10\/2022\/09\/80433638_s.jpg",847,565,false],"thumbnail":["https:\/\/www.yokogawa.com\/eu\/blog\/app\/uploads\/sites\/10\/2022\/09\/80433638_s-150x150.jpg",150,150,true],"medium":["https:\/\/www.yokogawa.com\/eu\/blog\/app\/uploads\/sites\/10\/2022\/09\/80433638_s-300x200.jpg",300,200,true],"medium_large":["https:\/\/www.yokogawa.com\/eu\/blog\/app\/uploads\/sites\/10\/2022\/09\/80433638_s-768x512.jpg",768,512,true],"large":["https:\/\/www.yokogawa.com\/eu\/blog\/app\/uploads\/sites\/10\/2022\/09\/80433638_s.jpg",847,565,false],"1536x1536":["https:\/\/www.yokogawa.com\/eu\/blog\/app\/uploads\/sites\/10\/2022\/09\/80433638_s.jpg",847,565,false],"2048x2048":["https:\/\/www.yokogawa.com\/eu\/blog\/app\/uploads\/sites\/10\/2022\/09\/80433638_s.jpg",847,565,false],"post-thumbnail":["https:\/\/www.yokogawa.com\/eu\/blog\/app\/uploads\/sites\/10\/2022\/09\/80433638_s-356x200.jpg",356,200,true]},"uagb_author_info":{"display_name":"Rudi Diedrich","author_link":"https:\/\/www.yokogawa.com\/eu\/blog\/renewables\/en\/author\/admin\/"},"uagb_comment_info":0,"uagb_excerpt":"In February 2020, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) reported that ransomware impacted a U.S. pipeline operator. At one of the natural gas compression facilities of an undisclosed operator, both IT and ICS assets were affected by the […]","_links":{"self":[{"href":"https:\/\/www.yokogawa.com\/eu\/blog\/renewables\/en\/wp-json\/wp\/v2\/posts\/15136","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.yokogawa.com\/eu\/blog\/renewables\/en\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.yokogawa.com\/eu\/blog\/renewables\/en\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.yokogawa.com\/eu\/blog\/renewables\/en\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/www.yokogawa.com\/eu\/blog\/renewables\/en\/wp-json\/wp\/v2\/comments?post=15136"}],"version-history":[{"count":1,"href":"https:\/\/www.yokogawa.com\/eu\/blog\/renewables\/en\/wp-json\/wp\/v2\/posts\/15136\/revisions"}],"predecessor-version":[{"id":15137,"href":"https:\/\/www.yokogawa.com\/eu\/blog\/renewables\/en\/wp-json\/wp\/v2\/posts\/15136\/revisions\/15137"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.yokogawa.com\/eu\/blog\/renewables\/en\/wp-json\/wp\/v2\/media\/12305"}],"wp:attachment":[{"href":"https:\/\/www.yokogawa.com\/eu\/blog\/renewables\/en\/wp-json\/wp\/v2\/media?parent=15136"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.yokogawa.com\/eu\/blog\/renewables\/en\/wp-json\/wp\/v2\/categories?post=15136"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.yokogawa.com\/eu\/blog\/renewables\/en\/wp-json\/wp\/v2\/tags?post=15136"},{"taxonomy":"author","embeddable":true,"href":"https:\/\/www.yokogawa.com\/eu\/blog\/renewables\/en\/wp-json\/wp\/v2\/coauthors?post=15136"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}
These are the top 6 recommendations from our cybersecurity specialists:<\/p>\n
1. Keep employees trained and focussed to recognize phishing emails; question, if current policies like an annual half-hour video training, are enough.<\/p>\n
2. Strong IT and OT network separation is critical in reducing the risk of IT network compromises also affecting the OT networks;<\/p>\n
[list][item icon=”fa-check” ]Keep Windows domains separated and configure extremely strict firewalls between both networks.[\/item][\/list]<\/p>\n
[list][item icon=”fa-check” ]Implement enhanced IT\/OT network monitoring[\/item][\/list]<\/p>\n
3. As this type of malware is not installed and distributed automatically it will take the attackers some time on the network to prepare. Various steps as described earlier could have been detected by monitoring software.<\/p>\n
4. A fast incident response could have prevented the attack to do actual damage. An IT\/OT Security Operation Centre (SOC) would be a good example.<\/p>\n
5. Besides creating backups, also create a disaster recovery plan in case every system becomes unavailable at the same time. Test and train these plans in simulations or tabletop exercises.<\/p>\n
6. Keep anti-virus up-to-date and maintain patch levels of operating systems and all other applications.<\/p>\n
Contact the cybersecurity specialists Mark Hellinghuizer en Mirsad Murtic of Yokogawa via IndustrialThreatAnalysis@nl.yokogawa.com<\/a> and sign up for our cybersecurity newsletter<\/a> to learn about cyber threats, vulnerabilities and proposed countermeasures for the Operational Technology domain.<\/p>\n","protected":false},"excerpt":{"rendered":" In February 2020, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) reported that ransomware impacted a U.S. pipeline operator. At one of the natural gas compression facilities of an undisclosed operator, both IT and ICS assets were affected by the […]<\/p>\n","protected":false},"author":1,"featured_media":12305,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"_uag_custom_page_level_css":"","site-sidebar-layout":"default","site-content-layout":"","ast-site-content-layout":"default","site-content-style":"default","site-sidebar-style":"default","ast-global-header-display":"","ast-banner-title-visibility":"","ast-main-header-display":"","ast-hfb-above-header-display":"","ast-hfb-below-header-display":"","ast-hfb-mobile-header-display":"","site-post-title":"","ast-breadcrumbs-content":"","ast-featured-img":"","footer-sml-layout":"","ast-disable-related-posts":"","theme-transparent-header-meta":"","adv-header-id-meta":"","stick-header-meta":"","header-above-stick-meta":"","header-main-stick-meta":"","header-below-stick-meta":"","astra-migrate-meta-layouts":"default","ast-page-background-enabled":"default","ast-page-background-meta":{"desktop":{"background-color":"var(--ast-global-color-4)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"ast-content-background-meta":{"desktop":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"tablet":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""},"mobile":{"background-color":"var(--ast-global-color-5)","background-image":"","background-repeat":"repeat","background-position":"center center","background-size":"auto","background-attachment":"scroll","background-type":"","background-media":"","overlay-type":"","overlay-color":"","overlay-opacity":"","overlay-gradient":""}},"footnotes":""},"categories":[2344],"tags":[],"coauthors":[2414],"class_list":["post-15136","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-security-en","author-cap-astrid-muijs"],"acf":[],"yoast_head":"\n<\/a><\/p>\n<\/h2>\n
Would you like more information?<\/strong><\/h2>\n