Face to face meetings. That's critical to build twists, and we got them.
We were like the most critical value of an ISAAC that is twisted.
Welcome everyone to the Industrial Security Podcast. My name is Nate Nelson. I'm
here with Andrew Ginter, the vice president of Industrial Security at Waterfall Security Solutions,
who's going to introduce the subjects and guest of our show today. Andrew,
how are you. I'm very well, Thank you, Nate. Our
guest today is Aurelio Blanchier. He is the Secretary General of the ee ISAK,
which is the European Energy Information Sharing and Analysis Center, and he's going
to be talking about the good work that they're doing at the ISAC at the
center and about more generally what is an ISAC and how does it work.
Then here is your conversation with Aurelia. Hello, radio, and welcome to
the podcast. Before we get started, can you give us a few words
of introduction. Please tell us a bit about yourself and about the good work
that you're doing at the European Energy ISAAC. Hi, Andrew, thank you
for the invitation. Then it's a pleasure to share with you the ISAAC.
So I'm the secretary General of the Energy the European Energy ISAAC which calls for
Information Sharing and Analysis Center, and previously I was the first president selected from
the members community in twenty fifteen when the association was launched, and I shared
the association between fifteen and eighteen. And previously I was director and board advisor
an European energy utility. In this case and particularly in Portugal DP, where
I was responsible for the ICs and cybersecurity strategy and implementation. So I work
with the topic of the ICs for almost forty years, and cybersecurity since the
very beginning, where the cybersecurity was not a non world around the community.
So about the role that I'm performing. What I do is of course shure
the presentation of the ISAAC to the community, namely to aspiring members. Of
course, we have lots of work with the meetings and contacts with the CEA
levels, partners and stakeholders, namely European associations including the European Commission. And
of course I also attend and I'm speaker at the events and conferences on namely
on energy, digitalization and on cybersecurity. You know one sentences everywhere where information
sharing can play or plays a relevant role in Europe, and I would say
even worldwide. So in broad in broad terms, if you want to know
more about information sharing and how we can how it can work on be a
more cybersecurity world, namely on the energy sector, we are ready to step
forward. We're talking about the European Energy i SACK Information Sharing and Analysis Center.
You know, I've been part of other iacs and the model that I
have in mind for an IACK is sort of a weekly phone call where managers
of security operation centers are on the call or you know, senior people from
security operation centers. They exchange actionable intelligence. The exchange IP addresses that they've
noticed are attacking them. They exchange file checksums from you know, suspicious attachments
that they've received. They gather all this information, they feed it back into
their intrusion detection systems and their security information and event management systems. You know,
this is the you know, is this what the the the European Energy
i SACK does or are you doing something else? We do something else,
starting by the field of information. So what we intend to do and what
we are doing and promoting inside our community is to feed an information sharing portal.
And the idea is to ensure that each member can in a real time
basis share their own incidents, namely the ones related with malware. So we
have an European platform for malware information sharing, and the idea is to have
the feed that this platform embedded in our members internal processes, including a synchronization
between the member's platform if they have a private sharing platform and this European platform.
This way we are able to have in an almost real time basis,
a full information data set that allows us to have a broad vision about incidents
within our members community and broadly in the European level. So the first thing
that we do is to collect this information. To make this information actionable,
we perform a second task. What we do is to vote this information to
assure that it's trusted all information and it's not a false positive information. And
this is the first challenge. On second challenge we have. The first one
is to feed the information. Second is to have a right balance between the
voting process and the timely information that is made available in platforms. If we
take if we take too much time to vote, the information lacks timeliness and
if we want it to be very timely, maybe it can be not voted
information. So this is the second task that we perform and less but not
least, what we do is to use this information in order to produce thirty
intelligence report that the reports that are made available inside the community, and that
corresponds to an analysis that helped the members to take more supported the actionable information,
which means that each member can use the information that is fitting in the
platform on his bealf and the information is updated. And also the reports that
came from the treatment of the raw information that is stored in the in the
in the platform. So I think it's from my perspective, the three main
levels that the ISAAC and the community works. So Nate real quick. What
I heard there was that the ISAC does have a function that is focused on
actionable intelligence. It's different from the ISAC that I described, you know,
my previous experience in a different ISAC in that it's more it sounds like automatic.
Instead of a call once a week where the information's exchanged verbally or you
know, pasted into teams, the UH, the information is made available in
a real time portal. There's a validation step that goes on. People have
access to the the the intel as soon as somebody enters it and it's validated
and there's there's reporting that goes on so that you know that that sounds useful,
So that makes sense. I mean, I've I've had a look at
your website. You have a risk management white paper there that that anyone can
download. You know it you're focused on events that shut down operations in Europe,
and you know, I'm reminded that at the time we're recording this,
just just a week ago, there was an announcement of an event in Denmark
where you know, firewalls on critical infrastructures, including I understand electric utilities were
breached by an accused nation state adversary. Where does can you can you talk
about the Denmark event? Where does that fit in sort of your scale of
attacks on the power grid? Well, that's a very very good question.
I think both types of incidents are, by different reasons, very very relevant.
Of course, when you have a huge impact on people or in the
or on the economy, this is an incident well immediately vidical and consequences and
it can be a power outage, but it can be it can you can
have an acting situation like you about in Denmark, and we had also when
in Portugal in twenty twenty two that didn't have any impact on the on power.
Nevertheless, it means that the companies faced vulnerability and this vulnerability was exploited.
If it didn't have any consequence, it could have too many reasons because
the company were able to defend itself and control the incident and have an effective
response. Or maybe even the attacker was not intending to make armful but was
just testing. And it also happens quite often it in any of those situations,
and association like the ISAAC plays a critical role if you are if you
have not an attack like we had in Ukraine a couple of years ago,
it will be more than useful to have a community that is able to support
you and help you in the incident's response and the shedding with you what the
different kinds of best practice that you can perform to overcome the incident. The
latest numbers and the twenty twenty three Threat Report on OT cyber incidents show that
the threat environment has changed fundamentally. At the beginning of this decade, OT
cyber attacks with physical consequences have changed from a theoretical problem to a very real
problem. More than doubling every year. The new report is focused on deliberate
cyber attacks in the public record. These are attacks that cause physical consequences and
process industries and discrete manufacturing. Most of these attacks are ransomware, though the
fraction of activist attacks is growing, and the report's appendix includes a complete list
of all cyber attacks since Stuxnet that meet these criteria. To see how today's
OT cyber threat environment has changed, I invite you to download the report,
a joint effort between Waterfall Security and the ICs drive OT Incident Repository. You
can download the report at Waterfall dash security dot com, Slash twenty twenty three
dash Threat dash Report, or just go to the resources menu at the Waterfall
Security site and click on white papers and ebooks. So this Danish incident that
you guys are referring to for listeners who aren't fully caught up it began.
It occurred in the spring of last year, starting with firewall vendor called Zyxel
I don't know if it's Zekesler Zigxel zyx e L, which in late April
of twenty twenty two revealed a pretty serious command injection vulnerability. It was given
a nine point eight out of ten CBSS score for those of you who follow
along with that, and shortly thereafter, attackers utilized this vulnerability in their firewalls
to attack the Danish energy sector pretty broadly. Because the firewalls were the thing
separating the Internet from control systems protecting safety critical equipment. It became a very
serious incident. I believe, according to what I'm looking at now, eleven
energy companies were compromised pretty much immediately. Five more were attacked but managed to
stop the attackers. It took the as the sector described it, entire night
to remedy the issue, but they did successfully protect all of the systems until
eleven days later when more attackers came back. This time, instead of the
publicly revealed vulnerability, there were two zero day vulnerabilities of the same severity affecting
the same devices. The attackers seemed to have thrown the book at the energy
companies this time, and a couple of pains back to attacker controlled servers revealed
that they might have had to do with the Russian groups Sandworm. So I
believe at the end of the day all of the utilities and related companies were
safe, but it did sort of very obviously demonstrate the threat here. That's
right. I mean I was in Denmark when the story broke, at an
event doing a book signing and had opportunity, you know, at the event,
the organization sector the sector ASSERT that reported the incident, you know,
gave a presentation. I had a chance to sit down with the technical lead
from the CERT afterwards, and so yeah, you know, all of that's
true. A fine detail in my understanding. The firewalls were not between the
Internet and the OT systems. The firewalls were the Internet facing firewalls for the
business. They were the you know, the firewall that protected the IT network.
And so the sector assert is a little bit unusual. They have technology
that is getting a copy of all the packets that are being exchanged and inspecting
them for a tax signatures at the Internet interface of these critical infrastructure utilities.
Their members, not at the IT OT firewall where most people think that you
would be you know, monitoring for attacks. They're monitoring for attacks on the
entire organization and they found these, you know, these attacks. It was
one of one of their people that identified the the initial intrusion and they said,
you know, really their role is to uh detect and alarm, detect
and inform. So they called the affected uh organizations, said you're under attack.
Here's the details. And a great many of them were small, and
you know, I didn't really know how to deal with the intrusion. And
so in spite of the sector as certain not primarily you know, being an
incident response organization, not really having a flyaway team, they said, look,
this is Denmark. They got into a car, they drove out to
these facilities and you know, help, you know, walk them through the
process of turning off the firewall and updating the firmware and activating internal incident response
to see if anything had been stolen or sabotaged or anything. So they were
involved in the in the incident response as well, even though that officially isn't
what they do. So good on them. Yeah, that is a pretty
crucial correction that you made to me. Although the report, the language of
the report is a little bit broad. They say, we've experienced that ZEISSIL
has used to a large extent to protect the critical infrastructure, and we know
that many OT environments that wait here we go. The attack groups had a
publicly known vulnerability that they could use to penetrate the industrial control systems, and
the primary defense against that happening was precisely the equipment that was vulnerable. So
maybe they use the firewalls to get into the IT networks and then the ITOT
defenses are sort of taken as a given. Do you have any detail about
exactly like how their network was mapped out or not so much? No,
I don't. I missed that in the report. You know, I'm going
off my memory of the conversation with the folks at Sector. They've promised to
come on a future episode, so let's let's get them on and we can
dig into the details with them instead of relying on my fallible memory here.
It also occurs to me as we're talking about this, you know, this
was a critical vulnerability in what appears to be a relatively popular firewall product that
might be found anywhere else in the world. I know that there was a
gap between the twenty fifth when the vulnerability was revealed. We're not talking about
the zero days here, that's another matter, and then May eleventh, when
the attack occurred. Is it just that everybody would have patched in that time
that I haven't heard some stories from other countries, Andrew, do you know
if this initial vulnerability was exploited elsewhere. I don't know that, you know.
I asked Aurelio that and he basically said, you know, he if
he had information, he couldn't share it with me. They have strict rules
about non disclosure. And but you know, to me, it's it's a
it's an interesting question. I would like if someone you know, digs up
an answer. I'd very much like to know, because what we have here
is excuse me, a Danish organization, the sector Assert, reporting an attack
on Danish critical infrastructure using this firewall as an attack vector. As you point
out, the firewalls used very widely. Did anyone else get hit and they're
just shut up about it? That would be useful to know. If nobody
else got hit and the bad guys used this firewalls as a vector to attack
Danish critical infrastructure, what does that mean? I don't know. I'd very
much like to know. Or alternatively, others were hit, and as we
know that there is some evidence here that there's a state sponsored actor involved,
maybe they just didn't know. Yeah, So, like I said, I
would like to know. I hope that, you know, more information comes
to light over time. I'm going to change topics in a moment. But
before I leave your information sharing system, you know, I know that the
information in there is confidential, but is there anything that you can tell us
sort of in terms of the volume or the quality of information that you have
in there that you're tracking, Just to have a small idea. When I
look to the information gatherin in our sharing platform from generally to July, and
I didn't upidate it with the figures from October, but we have something like
sixty thousand events corresponding to five millions of attributes and two point five millions of
correlations among those the cybersecurity events and the attributes. If we look to our
the organizations that feeded the platform and we make an average, each organization in
average feeded something around one other than fifty events in the platform. This means
that if an organization is not part of a community with an active and very
proactive information sharing attitudes, the organization is able to deal with one, not
fifty incidents, but it's only able to take decisions and to make action based
on the information delivered by one and fifty security incidents. If you broaden your
interest, you are able to take the same action based on sixty thousand on
the information of sixty thousand events, which means that the scale is much much
higher. And if you go up in your information scale, for sure the
ability to take a better decision will be much much higher. And changing gears
a bit. I understand that, yes, you folks are for becaused a
lot on incidents and information sharing. That's what you know, Isaac means.
But you're also talking to governments, You're talking to the Commission. You know
this too is the big news from the Commission that all of the governments are
acting on. Can you talk about this too? What what does it mean
to your members? And you know is there I don't know advice that your
members are giving the member states. What's happening with this too in the organization?
Well the NIS too as well as the very very new network calls for
cybersecurity that was the closed for comments lest Friday midnight last Friday means for thesociationion
two things. All the regulation that comes from the Commission is always concerned and
an opportunity to have a voice on the on the of the less legislation whatever
it is focused on the NIS tool. What this means is that looking to
the energy sector in Europe and looking for to the NIS. The NAS tool
broadens the accountability of the companies that were already covered by the NIS and brings
to the compliancy requirements a new group of companies that were outside the NIS.
And when we look at those companies, we see small companies. And this
is a very very big challenge not for the members of the association, but
namely for the non members of the association, because those companies and because they
are small energy companies, they are not so well prepared as the big players
are in this cybersecurity challenge. So until now they were outside the regulation.
Now they are inside, and they must be as compliants as the big ones,
of course with some nuances and with different impacts in terms of fault.
But nevertheless, this means that there is an opportunity to join forces instead of
fight alone in this world. And we recognize that that the NIS two from
this perspective makes sense because as we talked before, the European energy system is
an is an interconnected system, which means is as strong as it's a weakness
link, and it's easier to attack a couple of ten or twenty small energy
companies and bring problems to full energy systems. Then to try to attack a
big company that is well prepared and trained to better response, maybe is not
going to be as effective as she would like, but is for sure better
prepared. And so NAS two brings a new level level of responsibility for the
energy companies and a new challenge in challenge namely for the small companies that are
not so prepared. So for sure it will big time to start thinking collectively
and not individually. Other way they will be non compliant with NIS two looking
to the big companies and to do all companies covered by the NIS two.
And for the first time, NIS two recommends corporation as a pillar for cybersecurity.
So NIS to incentivize this European companies to corporate on cybersecurity and this goes
straight to the DNA an association like the ISAAC. We are sharing information in
order to be able to cooperate on actions and to be more effective on the
decisions. Each member can individually take another point and that NIS brings and it's
a challenge as well as an opportunity, is to make them responsible the managing
the managing of the companies for assuring the training to and to assuring the resources
for implementation to implement mitigation measures, which means that once once again, it's
an opportunity to share plans and strategies among companies in in order to have uh
AN align and the approach on those those challenges. So I would say that
those two points are the main news that the NIS is bringing to the table
and will be compulsory from next October twenty twenty four. So it's just a
word of background here for people who aren't necessarily tracking what's happening in the European
Union. This two is the new I don't know, I'm not even sure.
It's directive from the Union, from the Commission to everyone about cybersecurity of
critical infrastructure. It is not in and of itself a regulation, okay,
This two does not say these power companies have to do those things. This
too is a requirement. It orders the member states to pass regulations and it
says you have to take these factors into account when you decide which of your
uh You know, power providers and other critical infrastructures are critical. You have
to pass laws that have these kinds of characteristics. And you know it's called
miss too because ns happened a few years ago, was the same thing,
ordered the member states to pass laws, and so things are a little bit
different in every member state. And the new regulations, the newness too has
got broader strokes, you know, as Aurelio said, more smaller utilities are
coming into scope in the very broad brush of NISS too, and of course
in the the individual national regulations that will come about because of it. You
know. The other one, the Network Code for Cybersecurity. This is something
that's newer than than this to it's still being being created, but in my
understanding, it's analogous to North America KSIP zero one, two twelve. You
know, the NRKSIP family of standards has I don't know, fourteen standards in
it. Twelve is one of the things twelve talks about. They use very
technical terminology in twelve, but it's loosely interpreted as requiring encryption between control centers.
You know. The control centers are the places the systems that control large
chunks of the power grid, and when they talk to each other about how
much extra capacity they have, how much power is flowing through them, you
know, all this real time communication. SIP twelve roughly requires encryption. I'm
guessing the same thing is coming in the new law in Europe because increasingly the
European power grid is integrated. There are you know, there's electricity being sold
from one nation to the other. Every nation tends to have its own control
center, and of course now they're all increasingly talking to each other to facilitate
these international flows and exchanges and you know, purchasing and selling of power.
So it's uh, it's a complicated space. So this two is going to
change a lot. I mean, member states are passing their regulations right now
to comply with the with the directive. Is the EI SAC involved in you
know, creating or or I don't know, influencing this regulation. You talked
about the NAS tool, but as I said previously last week, the public
discussion on the network calls for cybersecurity was open for discussion and when we look
and it's also a very important piece for the cybersecurity wall in Europe. And
the Association also was able to comment and to deliver a position paper to the
Commission, and as well as it did do with the NIS tool, the
association is usually thin. Main concerns, if I may might say, when
we look to the lesislation and usually we start working within the working groups that
are responsible to write the lesislation. But when we look to the final documents,
what we look for is to check the consistency of the lesislation and the
consistency as at the document level. For instance, when we look at it
to the NCCS, we saw some inconsistency, some potentially inconsistency on the way
the document described a cyber incident or a cyber attack. And this is something
that cannot be misconfused. And so what we do in this city, in
this case is to comment and ask the Commission to make clear the concepts and
the terms that they are using on the legislation that usually is already complex enough
that used to me to be misconfused. The second one is about efficiency,
and about the efficiency means know what the doing is and the leverage on existing
work or existing technology. So the same way that the NIS tool was built
up from the NIS the NCCS and the one was published for public comments,
was within a moment where other pieces of legislation was already in place, and
we must assure that is not going to invent or reinvent the will and put
other rules besides the ones that are already in place or are going to be
in place and risk to impose double lens of action that will be useless and
inefficient. And the third, last, but not least, is the time
to action or what we try to see is and comment is if the time
to make it possible is suitable or not. And for instance, looking going
back to your first question, but the NIS two, one criticism that most
of the sector puts is that it will be very difficult, if not impossible,
to assure that companies are ready for NIS two in October of twenty twenty
four. If we think that most of those companies now covered as small,
they don't have resources, neither financial nor in people, don't have Mathew teams
in terms of cybersecurity, and even if they have the money, they are
going to face the shortage of skills that we are facing in Europe and the
worldwild when we talk about cybersecurity, which means that they are not talent enough
in Europe to ensure the resources we need to fulful the NS two requirements.
But this is a challenge, this is an opportunity for corporation and it's too
that we need to move forward, otherwise we will be as weak as the
weakness to link and it will not conceivable in European terms. Okay, So,
so sharing actionable intelligence, you know, working with government authorities to try
and influence legislations so that it, you know, doesn't mess things up too
badly with with inconsistencies and whatnot. I understand as well that the ISAAC hosts
face to face meetings. In those meetings, I mean, what do you
accomplish what what what do you do face to face that that doesn't happen through
your portaland through these uh these you know, letters of the center governments.
Okay, thank you for your question. It's a quite relevant one. We
can split the face to face meetings in two types. The first one is
face to face meetings with members, and face to face meetings with members are
mostly to share non disclosable information. There is no way to share non disclosive
information unless you make a face to face meeting because this information usually is even
not written. The second one is with non members, can be prospect members
or in intending members, and in this situation, the face to face meetings
is critical to build trusted This information sharing is only possible if you do it
in the trustable community. And the trustable community is more than a group of
people that you know by name and by affiliation, into an organizations people that
you need to know in the eyes and with you can identify yourself and at
a level that allows you to share and and at back uh useerful information to
yourself. And so I would say that face to face meetings for members are
critical to two to keep the trust and two share non disclosable information to non
to non members. The face to face meetings are critical because are the first
seed to build to build trust, and without them we were lack the most
critical value of an ISAAC with is that is trusted. Well, this has
been good. Thank you Aralia for joining us. Before we let you go,
can you sum up for us? You know what? What what should
we be taking away about working with an organization like the European Energy ISAAC.
Thank you for your question, Andrew, Well, I would say that there
are meant for main takeaways that I would like to share with you. The
first one is that active information sharing in the trusted community is a power,
very powerful pillar, if not the most powerful pillar in a successful cybersecurity strategy.
The second one is that capabilities are, by the end, the outcome
of knowledge and experience, and through an association like the ISAAC, when you
share knowledge and you share information, you are able to improve both both knowledge
and experience and get more capable to face the cybersecurity challenges. The third one
is that almost as a consequence, is that through cooperation we will for sure
rich further than we stay alone in this challenging cybersecurity world. And lest,
but not the least, what I can say is that if someone that is
listening and is working in the energy sector and is not yet member of the
European Energy ISAAC or even in an energy ISAAC in his own country, don't
wait more and join us. And this because it's more than ever time to
act together. So look to the our website, get in touch, and
will be more than pleased to get you on board. So I answered,
that was your interview with Aurelio Blanchie. Do you have anything to take out
our episode with today? Yeah? You know. Arelio pointed out sort of
three priorities for the IACK you know, active information sharing, sharing and developing
capabilities knowledge experience. He pointed out that cooperation makes us all stronger. And
you know NI two is requiring cooperation among critical infrastructures. And this two is
you know, is not saying you have to go join the energy I SAC,
but it's saying you need to cooperate. You know, we need to
be stronger, and here's an opportunity to do that. I mean, it's
it's a truism that our enemies cooperate. You know, nation states cooperate against
us with their allies. There's a dark web where criminals cooperate, where they
share information, they buy, serve, resist from one another. We need
to do the same. We are stronger together. They are stronger together.
We need to be stronger than they are. So it all makes sense to
me. Well, thanks to Aurelio for speaking with you, and Andrew,
thank you for speaking with me today. It's always a pleasure. Thank you.
Na. This has been the Industrial Security Podcast from Waterfall. Thanks to
everyone out there listening.