Cyber Attack Hits Garmin - Aeroplanes Grounded!

A report on the cyber attack on Garmin in July 2020 by Awen software developer Seren Corbett:

On Thursday 23rd July, popular smartwatch and fitness tracker app maker Garmin announced they were “experiencing an outage” of many of its fitness tracker products and services as well as their customer services. While other sources claimed that it has also affected their aviation service flyGarmin, and Garmin’s production lines in Taiwan.

The services are now said to be recovering but the outage meant that fitness activities could not be synced, aeroplanes may have had to stay grounded and the Garmin production lines in Taiwan have had to shut down for 2 days over the weekend.

Garmin has stated that no activity data has been lost and no personal data has been stolen.

This 4 day outage has reportedly been caused by “WastedLocker” ransomware, which encrypts files on the affected systems rendering them inaccessible unless the ransom demand (in this case $10m) is fulfilled. “WastedLocker” is a ransomware created by a notorious Russian cyber-criminal group EvilCorp, which has been found responsible for many other high profile cyber attacks, including the Dridex attacks which caused more than $100 million to be stolen from banks across 40 countries. 

This attack has again proven that no company is too large to be unaffected by such a ransomware attack and that they can cause serious consequences for the companies targeted. Like software development, ransomware development is constantly evolving. While it may not be possible to protect the company from all cyber security threats, it is important to have policies in place to minimise the damage. 

Awen helps companies like Garmin, who provide an essential service within the supply chain of our critical infrastructure services such as aviation, to (1) ensure that their cyber security policies and procedures are always improving using our Profile software, and to (2) ensure that they have a full and proper picture of their assets and vulnerabilities in their Operational Technologies using our Dot software.

The Percy Hobart Fellowship 2020 + Awen = INNOVATION PARTNERSHIP

In July of this year Awen Collective welcomed a new member to its team, me! I’m Steve a serving member of the Royal Navy and I have been lucky enough to be placed with Awen for 12 weeks (July - September 2020) during a new and exciting programme in innovation training from PUBLIC, ‘The Percy Hobart Fellowship.’

Over the 12 week course I am working directly alongside Awen Collective, learning how a fast paced and exciting Tech Start-up operates and providing them an insight into the military mindset, in addition to this I am being provided access to taught material, mentoring and workshops combining to give a strong base in both the theoretical and practical side of innovation.

The journey so far has been an interesting one, and I could not have made to feel more a part of the family at Awen. They have firmly brought me onboard with their vision of creating a more cyber resilient world, an issue not just for the military and defence sector but for society at large. 

I’m looking forward to the rest of the journey with Awen and perhaps I will share more of my experiences with this dynamic organisation in the coming weeks.

Cyber resilience is NOT futile

What is cyber resilience? What does it even mean?

The coronavirus outbreak got every business executive thinking about the resilience of their operations and their business continuity planning, as we saw challenges coming from every direction: lockdown affecting the routes into offices, temporary closing of office spaces, the virus making staff members sick, schools being closed meaning that staff needed to look after children, clients and suppliers being affected, and investors focusing solely on their existing portfolio and not making new investments.

The disruptions caused to the operations of manufacturing and critical infrastructure have been significant. The resilience of businesses, and critical infrastructure in particular, has only become more important due to the pandemic.

We like to see resilience as essentially being able to deliver a service or fulfil a need, despite an event occurring or, as in the case of the pandemic, a significant change in ecosystem. Cyber resilience is specifically being able to deliver operations in the event of a cyber security related incident occurring.

How can my business achieve cyber resilience? How might I be able to build a cyber resilience strategy?

Cyber resilience differs from, but is obviously strongly related to, cyber security. 

Cyber security is essentially the policies, processes, procedures and technologies which are the armour for a person or organisation. 

Cyber resilience is more about: 

• knowing the environment that you’re in, 

• knowing the risks and threats, 

• knowing how you might be able to mitigate those risks and/or follow contingency plans

The Cyber Assessment Framework (CAF) addresses the cyber security needs of UK-based Critical National Infrastructure and many other businesses. Principle B5 within the CAF is entirely focused on resilient networks and systems. Principle B5 overarching questions ask you:

1. Are you prepared to restore the operation of your essential function following adverse impact?

2. Have you designed the network and information systems supporting your essential function to be resilient to cyber security incidents? Are systems appropriately segregated, and are resource limitations mitigated?

3. Do you hold accessible, secured and up-to-date backups of data and information needed to recover the operation of your essential function?

This is in addition to other parts of the CAF which prompt the framework adopter to produce resilience policies and processes which manage and mitigate the risk of adverse impact on the essential functions of your organisation.

Our Profile software assists you to work on all aspects of the CAF, but is particularly important when considering cyber resilience.

Our Dot software assists you directly with cyber resilience, as it gives a detailed understanding of the assets and vulnerabilities (and risk) of an operational technology environments - whether this is Industrial Control Systems (ICS), SCADA, Industrial IoT or Smart Buildings.

Output from both systems is actionable intelligence which can be used as part of cyber resilience strategies and business continuity plans.

Awen lets you know what you’re facing and simplifies processes. Let us do the heavy lifting.

Our best wishes to everyone in this current climate.
Keep healthy, keep safe, keep social.

Accenture Blue Tulip Awards Final - Starring Awen - 11th June 2020

We are proud to announce that the Finals of the Blue Tulip Awards 2020 will take place on June 11, and will be brought to you live by Accenture, Boom Chicago and RTL-Z…. and Awen will be pitching in the finals in the Security category!

LIVE RTL-Z winner announcement 

Please join the live winner ceremony starting June 11, 19:00 online at RTL Z, to find out who the 2020 winners of the Blue Tulip Awards are. In this 90-minute show, innovation experts and jury chairmen will share thoughts and insights on what impactful innovation means today. As for the eight Blue Tulip Awards themes, this year’s worthy winners will be revealed and celebrated. 

For all the latest updates on the Blue Tulip Awards 2020 Finals and the full program, keep an eye on the Blue Tulip Awards website [archive.org]. 

See you on the 11th of June?

Why should you care about the NIS Directive?

On our website we have a growing amount of information defining the Network and Information Systems Directive on Security, showing how the NIS Directive relates to what we do, and talking about the various sectors that it applies to - such as energy, water and transportation. In this blog post we go a little deeper, and discuss why you should care about the NIS D, and how might it improve your cyber security levels.

First of all, the NIS Directive is a European Union established directive of 2018, which is applied across the EU member states. As this was 2018, this means that the UK has also ratified the directive into law as the NIS Regulation. Different states have implemented it slightly differently, but the goal is the same, and that goal is to essentially reduce disruption to everyday life by making improvements to the cyber security of critical infrastructure operators of essential services (OES) and other critical digital service providers (DSPs) such as search engines and digital markets.

Non-compliance with the implementation of the directive comes with fairly hefty fines, however the primary actions of each nation state is to essentially help operators and service providers improve prior to enacting the full force of fees. Carrots are being offered before the sticks are “thwacked.”

As we mentioned above, different countries are implementing the directive in different ways. In the UK, the National Cyber Security Centre (NCSC) has developed the Cyber Assessment Framework (CAF) which is a framework of best practices within cyber security. It’s a general framework applicable to all kinds of sectors, but it was developed specifically with critical national infrastructure sectors in mind. The energy, water, transportation and a variety of other critical sectors are therefore recommended to work towards full compliance against the CAF, with the regulators in each sector assisting with initial checks, monitoring progression, suggesting recommendations and auditing - with the eventuality of fines in the cases of non-compliance to those recommendations.

However, it should be noted that there is a lot of marketing spiel from the cyber security community saying that compliance is not equal to cyber security. This is certainly true, but only because compliance is the minimum that we should be doing in order to reduce the very real threat of a cyber attack on critical infrastructure. Unfortunately it is the case that many organisations are not yet compliant with the CAF.

Why do Awen care?

Awen cares because compliance to the regulation, and especially using the CAF, leads to a safer society. Imagine, for a second, that the drinking water supply was contaminated because the filtration systems were switched off by a cyber attack. That filtration system was being monitored by an efficiency & predictive maintenance monitoring system directly connected to the filtration controllers. If that water company had followed the CAF as a baseline, then they would have been prompted to ensure that (for example) appropriate authentication was installed on the IT systems, that OT systems were patched, and that the onsite engineers had cyber awareness. Thereby reducing the cyber risk, and ultimately reducing the chance of the water supply of the community being polluted.

This is the raison d’être for Awen. We exist to make society safer by reducing the cyber risks in critical national infrastructure and manufacturing. Our product Profile helps to ensure that organisations progressively improve their adherence to the Cyber Assessment Framework (CAF), leading to NIS Directive compliance. Our other product Dot, then goes one step further and begins to help organisations reduce the vulnerabilities on their operational technologies. Not through any fancy artificial intelligence system, but through actionable intelligence working in collaboration with engineering and business processes.

p.s. You can now buy Profile through our website using a credit or debit card, with options for monthly or annual agreements! To celebrate we’ve also applied a discount. Plus, don’t forget that if you are a healthcare organisation, or are manufacturing face masks, hand sanitiser, other PPE, ventilators, vaccines or treatment for COVID-19 then you can get Profile from us for no charge for the remainder of 2020.

Quick tips for personal & business cyber security wellbeing

Due to the coronavirus known as COVID-19; people are spending more time at home, and rightfully are using internet technologies to stay connected with each other, with the news and to be entertained. Businesses that are able to are also adapting their approaches to help employees to work from home.

Unfortunately, when there are new approaches, we often see new vulnerabilities and new cyber attacks targeting those vulnerabilities. We wanted to share with you some quick tips to ensure that you are protected as much as possible.

These tips apply whether you are using devices for personal or for business work.

Know what you have

What devices in your home are connected to the internet? We’re not just talking about desktops, laptops and mobile devices. Maybe you’ve put in your wifi password into your Smart TV or Smart Lightbulbs. Maybe you have a cable running from your router into a set-top box. Maybe you have an internet connected CCTV system, or thermostat. We are living in an increasingly digital world. It is recommended that you make a list of what digital devices are connected to your home network.

If you are technically savvy, you may wish to separate any IoT systems, such as smart lightbulbs and personal assistants like Alexa / Google Home devices on a separate wifi network to your desktops, laptops and mobile devices.

Keep your devices updated

Your internet connected devices should be able to fetch updates from the web. If you’re on Windows, Mac or Linux check for updates regularly. On your Android or Apple devices check for updates in the app/play store regularly. If you have an IoT system, find the manual and check for updates regularly.

Updates are not just for new features or improved ways of using the system. They often improve the cyber security of the system, as well as the cyber security around that system. There are recent examples of vulnerable smart lightbulbs being able to be used to explore other parts of a home network - an update to those lightbulbs would reduce the threat.

Keep your web browsers updated too - whether you use Firefox, Chrome, Safari, Brave or Edge - check for updates. Do it after you’ve read the rest of this post!

Backup important data

If you have important data stored on your computer, and this is particularly important for businesses, then you should backup that data. This could be on an external hard drive at home (which could be a “thumb drive” / “USB dongle”), or it could be “in the cloud” using a service such as Google Drive, Dropbox, Microsoft OneDrive or one provided by your Internet Service Provider.

Businesses may also have their own backup method, and should provide you with details on how to use. Try your best to keep personal and business backups separated.

Get Protected, Stay Protected

Ensure that you have antivirus installed and running on your desktop/laptop machines, and importantly, kept up-to-date. Some antivirus systems also come with services such as banking protection, tracking protection and a personal VPN. These all help in the fight against cyber attacks. With all of these systems it is incredibly important, and we are repeating ourselves here, to check for updates regularly.

There are two browser plug-ins that we recommend, which work on most contemporary browsers (Firefox, Chrome, etc.):

• HTTPS Everywhere - helps to ensure secure connection between you and the websites that you visit

• Privacy Badger - helps to ensure that you are not tracked while on the web

• UBlock Origin - a free and open-source, cross-platform browser extension for content-filtering, including ad-blocking.

• Ghostery - a free and open-source privacy and security-related browser extension and mobile browser application.

Our final note in this section, is to ensure that you have enabled the highest level of security on the websites that you login to. This is typically called “two-factor," “2FA” or “multi-factor” authentication. You’ll usually have to put in your mobile/cell phone number to receive a special code by text messages, or use Google Authenticator or Microsoft Authenticator apps on your phone.

Be Aware

The most important tip: Be aware! Be vigilant!

When you are visiting a website, especially one that handles your personal data or your financial data (such as debit/credit cards), make sure that it has a little lock symbol in the address bar (or has https at the beginning of the web address).

If you’ve not used a particular website, and even when you do have the lock symbol, ask yourself “do I trust this website?” You may also want to check on a site such as Trustpilot to ensure that other consumers have received a good service through that website.

When you receive emails, text messages or messenger messages, ask yourself “is this a legitimate message?” If your email service says it may be a scam, then it almost definitely is. If it seems dodgy, it probably is. If it doesn’t seem dodgy, it may still be dodgy. Ways to check would be to check the sender email address, hover over links to check destinations (try not to click on anything). Ideally, if you know it is from a website that you trust and the message has asked you to “click here to login” - don’t click it, but type in the web address that you know and trust (or search on google for it), and login that way. Therefore you will have more confidence that you haven’t accidentally given someone your login details.

Keep connected

Seriously, keep connected. This isn’t a personal & business cyber security tip, but an important one. Don’t be frightened by the cyber attacks that are out there, we must live on during the lockdowns, and being social is a core part of human nature. Most of the serious cyber attacks are targeted to particular businesses or parts of society which are vulnerable. Follow guidance on cyber security, do your best and back-up the important stuff in case you need to recover it… but keep connected with other people.

We recommend the following communication services, provided that you connect with them securely, and be vigilant!

• Signal

• Google Hangouts (or Hangouts Meet if you’re a business)

• Microsoft Teams

• Skype

Further Resources

We recommend two further resources on other websites that you should read:

• “Home working: preparing your organisation and staff” by the UK National Cyber Security Centre (NCSC)

• “What You Should Know About Online Tools During the COVID-19 Crisis” by the Electronic Frontier Foundation (EFF)

How are Awen helping during this rapidly changing time caused by COVID-19?

We are helping by writing posts like this, and doing what we can to ensure good cyber security wellbeing in the digitally-enabled communities.

We are giving our software Profile away for free (in 2020) to healthcare organisations, and to particular parts of the healthcare supply chain such as personal protective equipment (PPE), hand sanitiser, ventilator, COVID-19 test and COVID-19 vaccine/treatment manufacturers.

Our CEO, Daniel, is on the COVID-19 Tech Taskforce for Wales - which brings together organisations from across different sectors and industries to share resources on best practise of dealing with Coronavirus pandemic.

PROFILE: Free for Healthcare in 2020 due to COVID-19

Healthcare is a critical infrastructure, which has never been so clear due to the Novel Coronavirus labelled COVID-19.

Our critical yet vulnerable health services need all the help they can get right now.

This is why we've made the decision to offer our Profile software for free this year (2020) to all healthcare providers, and specific healthcare suppliers such as ventilator, face mask and hand sanitiser manufacturers.

Profile will help to these providers and suppliers work quickly towards lower levels of cyber risk. Freeing up time to work on more important things, and lowering the potential for disruption to society caused by cyber attacks.

We have already seen cyber attacks around the world targeted at those services providing critical services during the Coronavirus outbreak. For the sake of human health, we don’t want to see increased risks to humanity caused by cyber attacks.

—

If you are in healthcare or are a critical health sector supplier, please contact us by email or telephone for your free Profile accounts.

hello@awencollective.com

+44 29 2120 2936

NIS Directive Compliance made easier with Profile v1.2!

This is just a quick note to let you know that we’ve been hard at work making Profile bigger and better than ever before! Version 1.2 is now live! ✨🍾

Now NIS Directive compliance assessments and improvements have been made even easier, more collaborative and more efficient when preparing evidence to go to the regulators.

Profile now features the following…

✨	Improved design and layout to enhance user experience
✨	Export evidence files as a zip file as part of the report or action plan
✨	Export an improvement plan, detailing objectives, statuses, recommendations to achieve full compliance, and all evidence files, comments and assignments
✨	Begin a new audit pre-filled for even greater efficiency
✨	Export compliance statements to submit to your regulator, giving a breakdown of achievement across all sections, with current status and any comments

You can find out even more about Profile through our dedicated Profile page.

If you work in water, energy, transportation or any other critical infrastructure operator then contact us today to discuss how we can work together to make cyber security regulation compliance checking and improvement as quick and easy as possible, while retaining quality!