Category: IoT, OT, & SCADA Security

Tales From the Road: When it comes to your SCADA Network: Segment. Segment. Segment.

By: Bethany Kozal 06.13.23

How DirectDefense uncovered weaknesses in a municipality’s SCADA systems and a need for SCADA network segmentation A large municipality enlisted the services of DirectDefense to perform a Critical Infrastructure Assessment of the SCADA network controlling their water and electric services. During the SCADA assessments, our team identified several weaknesses that demonstrated the need for SCADA… Read more »

Is This Thing On? Privacy and Your Smartphone Sensors

By: Phil Brass 03.08.23

Smartphone Snooping Without Microphone Access Can your smartphone sensors still enable apps to eavesdrop on your conversations even after the app has been denied microphone access? It does seem possible. We dug into this question based on two research papers, “AccEar: Accelerometer Acoustic Eavesdropping with Unconstrained Vocabulary”, and “Side Eye: Characterizing the Limits of POV… Read more »

Cryptography Use Cases: The Prevalence of False Positives and Severities

By: Hudson Bloom 01.16.23

What We Can Learn From an Examination of the Misapplication of Cryptography In this post, I present my thoughts and learnings from a research paper focused on cryptography use cases demonstrating misapplication. The authors undertook a study building on some previous work by other authors, going further to study the prevalence of false positives in… Read more »

What We Can Learn About Mobile Security from an Automated Android Application Testing Tool

By: Hudson Bloom 01.12.23

A Deep Dive into ThirdEye and What Researchers Found In this post, I present my thoughts and learnings from a research paper about ThirdEye, an automated Android application testing tool that was created by the paper’s authors. While this tool does not appear to have been released to the public at the time of publication,… Read more »

Tales From the Road: When the City Library Can Access the SCADA Network, It’s Time to Rebuild

By: Bethany Kozal 10.06.22

DirectDefense conducted cyber penetration tests for a municipality and found some significant gaps within the SCADA network.

Tales From the Road: BESS and SCADA Network Assessment — Is Your MQTT Traffic Secure?

By: Bethany Kozal 07.13.22

DirectDefense assessed the security of MQTT traffic – the transfer of data to a SCADA system, ultimately controlling critical infrastructure.

Tales From the Road: Got Critical Infrastructure?

By: Bethany Kozal 03.08.22

Avoid these three pitfalls that are inherent to most SCADA systems that manage critical infrastructure. A multinational corporation enlisted the services of DirectDefense to perform a security assessment of the organization’s newly-developed battery energy storage control (BESS) that would enable the company’s vendors and integrators to manage the voltage and power output for massive batteries.… Read more »

Tales From the Road: If Your SCADA Network Isn’t Segmented, It’s Not Secure

By: Bethany Kozal 07.26.21

Newsflash: Most networks utilized for Supervisory Control and Data Acquisition (SCADA) were not designed to be secure. Yes, you read that correctly. Kind of a scary thought, especially when your municipal water utility is reliant on this SCADA network to ensure the availability and safety of the drinking water supply! This is why the management… Read more »

Why Mobile Device Security Matters More Than Most Think

By: Nolen Johnson 07.19.21

Mobile devices are often one of the most overlooked assets from a security perspective. Many people are under the false assumption that mobile devices “can’t get viruses”, “aren’t important”, or that they can ignore mobile updates, when in fact, these devices often store more critical data than people realize, yet statistically are barely more secure… Read more »

Tales From the Road: A Wake-Up Call to the Food Production Industry

By: Bethany Kozal 07.01.21

Tighten Cybersecurity Controls Before the Next Ransomware Attack Comes to You Food production is highly regulated by the Federal Food & Drug Administration (FDA) and U.S. Department of Agriculture (USDA) to ensure food safety. However, the computer systems that are used to accomplish and maintain food safety processes don’t fall under the purview of those… Read more »

DirectDefense Blog