Dive Brief:

• The FBI and the Cybersecurity and Infrastructure Security Agency (CISA) on Tuesday warned of unsophisticated threat actors targeting industrial control systems and operational technology environments in key critical infrastructure sectors. 
• The guidance, co-authored by the U.S. Department of Energy and the Environmental Protection Agency, said the threat activity targeted critical infrastructure in the oil and gas industry and involved the energy and transportation sectors. 
• The agencies urged security leaders to use better cyber hygiene and protect assets exposed to the internet.

Dive Insight:

While it is not clear what specific incidents led to the advisory, the guidance is similar to prior warnings in recent years about threat actors targeting drinking and wastewater treatment providers and small power companies. 

The agencies advised three major security improvements: 

• Removing OT connections from the public internet, as exposed OT devices can easily be discovered through search engines that track open ports.
• Immediately changing default passwords with strong, unique passwords that are hard to guess.
• Securing remote access to OT networks, with users upgrading to a private IP network and adopting VPNs with strong passwords and phishing-resistant multifactor authentication.

“This advisory is really no different than what we have been saying for years: the basic state of cyber hygiene in OT environments is lacking, and building a good perimeter and defendable environments should be every asset owner's first priority,” Paul Shaver, Mandiant global practice lead for OT/ICS security, told Cybersecurity Dive.