SecurityWeek has also conducted an analysis of the deals announced in the first half of the year. We have cataloged 234 cybersecurity M&A deals, with a surge observed in the first half of June. 11:11 Systems acquires Static1 Managed infrastructure solutions provider 11:11 Systems has acquired managed network and IT infrastructure development and services firm…

A zero trust strategy establishes rules and good practices to improve the security and resiliency of your IT infrastructure, but what can it do for operational technologies (OT)? It turns out, quite a bit – but there are limits. Last fall, my colleague Greg Young wrote a blog post IoT and Zero Trust are Incompatible?…

The nonprofit cybersecurity organization is scanning the web for exposed services that use the Modbus industrial communications protocol on TCP port 502, but Shadowserver’s Piotr Kijewski told SecurityWeek that they plan on introducing many other ICS and operational technology (OT) protocol scans in the near future. Shadowserver has been working with national cybersecurity agencies, law…

The attacks targeted 35,000 devices in 195 countries between January and November 2021, including devices housed by high-profile organizations. Roughly seven percent of the targets were ICS, with the engineering and building automation sectors being most impacted. Attacks were also aimed at military industrial enterprises and research laboratories. In many cases, the attackers targeted engineering…

The companies have released patches and mitigations to address these vulnerabilities. Siemens Siemens has released 5 new advisories covering 33 vulnerabilities. The company informed customers that an update for its SINEC network management system patches 15 flaws, including ones that can be exploited for arbitrary code execution. While some of them have been assigned a…

Siemens Siemens has released 21 new advisories and updated 25 previously published advisories. The new advisories cover 36 vulnerabilities, including five that have been assigned a critical severity rating. One of the critical flaws, with a CVSS score of 10, impacts the Desigo CC building management platform and the Cerberus danger management station (DMS). The…

Forescout Research Labs and JFrog Security Research found a total of 14 vulnerabilities in NicheStack, a TCP/IP stack used by many operational technology (OT) vendors. The flaws, a majority of which have been assigned critical and high severity ratings, can be exploited for remote code execution, denial of service (DoS) attacks, obtaining information, TCP spoofing,…

Vulnerabilities in CODESYS software could have serious implications considering that it’s used in the industrial control systems (ICS) made by several major companies. Last month, a cybersecurity firm warned that programmable logic controllers (PLCs) made by over a dozen manufacturers were exposed to attacks due to critical security bugs discovered in CODESYS software. CODESYS on…

One of the bills focusing on critical infrastructure is the Cybersecurity Vulnerability Remediation Act, which aims to authorize the DHS’s Cybersecurity and Infrastructure Security Agency (CISA) to assist owners and operators of critical infrastructure with mitigation strategies against serious vulnerabilities. The bill covers vulnerabilities in IT and OT systems, as well as security holes in…

The FBI and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) have issued a new joint advisory on a gas pipeline intrusion campaign allegedly conducted by Chinese state-sponsored hackers between 2011 and 2013. In addition, CISA has updated five advisories released between 2012 and 2017 to attribute malware and malicious activity to various nation states….