/from the SCADA operators workstation. The attacker is then able to remotely interact with the SCADA workstation and locally accessible networks including the corporate and control system networks. When the attacker decides to execute their attack, commands are sent to the malware package for either immediate execution, or scheduled for a future date.
Once triggered by the attackers, the malware sends SCADA/ICS control commands to the SCADA devices in the field to shut power off. To the SCADA field devices, these commands appear legitimate, conform to the necessary specification, e.g. IEC 61850, and are received from an authorized system.
The SCADA devices in the field, acting upon what appear to be valid and authorized control commands, execute the commands sent by the malware and cause a power outage event.
What does this mean and what can we do?
Restricting network access: The SCADA operator workstation could access the Internet, and was not prevented from connecting to untrusted systems, e.g. the anonymous Tor network. The same machine may have been able to open e-mails as well, which allowed the malware to execute, establish command & control connectivity and receive commands and updates from the attackers’ staging servers.
Application whitelisting: The e-mail phishing attack allowed execution of untrusted (attackers’) code on the compromised workstation.
Anti-malware defenses: The malware was not detected by host anti-virus software, which is likely due to signature-based method of most anti-virus software today.
File integrity monitoring: The endpoint protection software also did not detect that the malware made modifications to the Windows Notepad application to inject a malicious backdoor.
System patching and updates: The malware contained a module designed to exploit a denial-of-service vulnerability in Siemens SIPROTEC devices that was discovered in 2015. If executed, a network intrusion detection and/or prevention system (IDS/IPS) configured with the corresponding signature would have triggered an alarm and potentially prevented a subset of the attack.
Network intrusion detection and prevention: The malware was not detected by network-based intrusion detection systems as it performed a network system and port scan across the control system network.
It is easy to play the armchair critic, and second guess the security implementation of Ukrainian power plants. Nonetheless, it is a reality that even when good security controls are fully implemented, in any environment, controls can fail or be disabled temporarily when operational demands take precedence. This incident serves as an example of why a defense-in-depth strategy, with overlapping and complimentary layers of security, is critical to ensuring that the organization is more secure and better prepared in the event of an attack. Such an approach requires blending preventative controls, which could interrupt steps (1) and (2) of the kill chain, with detective controls, which might have identified the intrusion during steps (3) thorough (8). When combined with a strong incident response capability, this blend of preventative and detective controls can enable you to minimize the likelihood of an intrusion, identify active intrusions, and respond to security events in a coordinated and impactful manner.
Hailing from a wastewater utility industry where malware penetration of our ICS (and more specifically SCADA) is a constant concern, this was a well-written article highlighting the risks posed and versatility of the attach vector demonstrated by this example. Great recommendations for utility-cybersecurity best practices!
Thanks Clay. We now have some evidence to show how easy it’s becoming for malicious actors to attack ICS systems. The age-old mentality of “security through obscurity” or believing SCADA networks are secure because it’s a “closed” system will no longer be a suitable defense in not applying proper security controls.In honor of Dolly Parton's 48th album as a solo artist — "Run, Rose, Run," which drops on March 4, 2022 — Wonderwall.com is taking a look back at the iconic musician's most delightfully over-the-top fashion moments from over the years, starting with this incredible getup… The country music superstar looked pretty in pink in a Western-inspired studded top with bell sleeves and matching pants while performing early in her career.
Dolly Parton donned a sequin-embellished set — a long-sleeve top featuring built-in butterfly wings with matching pedal pushers — at a 2019 event at Dollywood, her theme park.
Dolly Parton played with patterns and textures during a 2014 performance on the "Today" show. 
Bloomers couture?! Dolly Parton wore a lacy white long-sleeve jumpsuit with pedal-pusher pants during a 1993 visit to the Planet Hollywood in New York City.
Dolly Parton channeled "Charlotte's Web" in a long-sleeve jumpsuit featuring a spiderweb pattern comprised of sequins and rhinestones (check out the black rhinestone spider on her knee!) that she wore with a bejeweled mesh vest during a concert early in her career.
This is how Dolly Parton does jeans and a T-shirt! While opening her Trinkets and Treasures store in Nashville in 2010, the "Dumb Blonde" singer sported a long-sleeve yellow top emblazoned with the name of one of her earliest hits spelled out in rhinestones. She completed her look with denim pedal pushers with suede stripes down the sides and a suede rhinestone-covered belt with beaded fringe.
It was another wild suit for Dolly Parton at a 2005 signing event for her "Those Were the Days" album at a Best Buy store in New York City. She wore a fitted champagne-hued jacket with a fringed hemline with sequin-encrusted pants that were netted (and covered in fringe, of course!) below the knee.
Dolly Parton rocked an ensemble straight out of the '70s — a sheer rhinestone-embellished fringed poncho with a high neckline over a pink jumpsuit — at a 1978 concert in Oakland, California.
During the "9 to 5" 25th anniversary DVD launch party in Los Angeles in 2006, Dolly Parton sported a pinstripe vest and matching capri pants with a white button-down shirt and a blingy belt featuring crystal hearts.
During a 2010 visit to the "Late Show with David Letterman" studios in New York City, Dolly Parton paired a white jacket featuring lilac filigree with a black top and black leather pedal pushers with white stripes down the sides.
Dolly Parton rocked a blue leather cold-shoulder dress with a bedazzled peplum waist during a 1993 performance on "The Tonight Show with Jay Leno."
During a 2015 screening of the NBC made-for-TV movie based on her childhood, "Dolly Parton's Coat of Many Colors," in Los Angeles, Dolly Parton rocked a patchwork long-sleeve button-down dress of many colors.
Dolly Parton rocked a sequin-encrusted vest with a matching miniskirt and a white button-down shirt while honoring Reba McEntire at the 2006 "CMT Giants" event in Hollywood.
Dolly Parton donned one of her most unforgettable looks of all time — a fiery red gown with ruffled tulle shoulders that gave way to a lengthy train — for her Golden Globe-nominated turn in the 1982 musical "The Best Little Whorehouse In Texas."
The holidays are in full swing, complete with twinkling lights on homes and full parking lots at Woodfield. While the season bring plenty of time to honor traditions and have some fun, it is also prime time for your dog to get in a bit of mischief that could prove to...
You’ve heard it plenty of times before – old dogs can’t learn new tricks. This expression is used, of course, to talk about humans who just can’t seem to change or learn new life skills. However, the expression is also rooted in the belief that as dogs age, they just...the 1940 federal census record for my dad's family is 100% accurate for the entire family - names spelled correctly, ages correctly listed - for 2 parents and their 4 children. But the census also lists a 5th sibling, said to have been born in 1936, and so listed as being 4 years old at the time of the census. I have not provided you with names because I know you don't publish personal info, but the census also provides the 4 year old's name. My dad and all his living siblings say no such 5th sibling ever existed and say they know nothing about him. I have briefly searched for IA (where they lived) birth certificates and found nothing. No cousins by the listed name apparently existed. The father of the household worked on the railroad so if a 5th child did exist, he could have been born outside of IA.
Can you offer any insights, or suggestions of sources I could check?
Are errors like this - adding an entire person, not just a typo or spelling mistake - in census data common?
Have you looked at the census page image to verify it was indexed correctly? This is the most frequent issue.
Are there any notes in the margin beside this entry, that point to another page or another family? Indexers almost always ignore these, leading to annoying household mashups or random individuals not attached to the correct household.
Is the household's informant marked (specific to 1940 US census)? If it was a parent, they should know who they are giving information on, although errors can be introduced by the enumerator or later copyists.
Is all the information for the individual consistent with the