It’s this time of the year again, time to look back to move forward. So, Cornelia, Fabio and I sat down and tackled these questions: How has the IT security domain been dealing with human risk? How is security awareness evolving as a discipline? What have we, as a team, accomplished so far? And most importantly, where do we want to go?
Dear Reader
The latest issue of our bi-monthly SWITCH Security Report is available. The main topics of the current report are:
Dear Reader
The latest issue of our bi-monthly SWITCH Security Report is available. The main topics of the current report are:
Dear Reader
The latest issue of our bi-monthly SWITCH Security Report is available. The main topics of the current report are:
Dear Reader
The latest issue of our bi-monthly SWITCH Security Report is available.
The main topics of the current report are:
Dear Reader
The latest issue of our bi-monthly SWITCH Security Report is available.
The main topics of the current report are:
Dear Reader
The latest issue of our bi-monthly SWITCH Security Report is available.
The main topics of the current report are:
The ‘Cybersecurity and cyber resilience in the Swiss electricity supply’ report by the Swiss Federal Office of Energy concludes that the electricity industry needs to take action on cybersecurity.
There’s no doubt that the electricity supply is most likely the most important of all critical infrastructures in a modern, digitalised society. In the Swiss Confederation, the electricity supply network is heavily fragmented – there are around 600 power plants supplying homes and businesses in the network. Unlike other critical infrastructures, the electricity sector must be viewed as a complex overall system from the perspective of cybersecurity. In view of the threat situation, this gives rise to major challenges.
Inside-it.ch columnist Martin Leuthold of the Switch Foundation has analysed the report entitled ‘Cybersecurity and cyber resilience in the Swiss electricity supply’ and gives his thoughts on four proposals made by the Swiss Federal Office of Energy (SFOE).
Who are the key market players in Switzerland?
The report starts by using the term ‘boundary conditions’ to propose that the SFOE define mandatory requirements and/or a risk-based minimum standard for key market players. In terms of the criteria for defining ‘key market players’, reference is made to the practice in neighbouring countries, which makes sense. How these parameters should be defined in Switzerland, however, remains unanswered. Realistically, the focus should initially be on 20 to 30 leading energy firms. We recommend looking for ways in which the many small utility suppliers can also be included in parallel with the industry.
Continue reading “The electricity industry: the need for action on cybersecurity”Dear Reader
The latest issue of our bi-monthly SWITCH Security Report is available.
The main topics of the current report are:
In the world of operational technology, programmable logic controllers (PLCs) control physical elements such as a municipal water supply system, the room temperature in offices or a chocolate bar packaging machine. Twenty years ago, manufacturers promoted their PLCs as compliant with the IEC 61131 standard. Today, the standard is well established and supported by all major PLC suppliers. To program a PLC, five programming languages are defined:
| IEC 61131-3 language | Description |
|---|---|
| Ladder Diagram (LD) | Looks like a electrical diagram |
| Function Block Diagram (FBD) | Contains elements from boolean algebra / digital technology |
| Structured Text (ST) | Similar to Pascal or C |
| Instruction List (IL) | Has its roots in the assembler language |
| Sequential function chart | Graphical elements for programming e.g. batch programming |
An electrician will likely choose Ladder Diagram as programming language. Someone who is used to programming in a high-level language will most probably use Structured Text. Often it is a mixture: functions or libraries are written in ST, while the “glue logic” is written in Function Block Diagram.
Continue reading “Secure PLC Coding Practices”There are more than 2.6 million podcasts available on Spotify. For every possible topic you can find experts, famous people or entertainers talking about it. Among podcasts evolving around politics, sports, psychology, crime or history there are also some putting the topic of information security in the spotlight.
A lot of security, but no awareness
If you are working in security awareness there is not much in it for you though. Most podcasts on security cover the topic by inviting one phishing simulation provider. But as you know, there is so much more to it!
This is why Marcus Beyer (Security Awareness Officer at Swisscom) and I decided to start our own podcast on security awareness only: Security Awareness Insider (in German).
Continue reading “One more Podcast – Security Awareness Insider”Dear Reader!
A new issue of our bi-monthly SWITCH Security Report is available!
The topics covered in this report are:
The Security Report is available in both English and German.
»» Download the English report. »» Download the German report.
FluBot is a new Android malware first discovered in December 2020. During the first few months, FluBot has been active in Spain, Hungary and Poland. Since then, the development of the malware advanced quickly and the malware has set foot in almost all European countries.
On the 18th of June 2021 FluBot version 4.6 was spotted which added a configuration for Switzerland. As of today it is actively being spamertized through SMS.
FluBot is known by different names. The name “FluBot” is best known because this was the name given in the first public technical writing. Below the reference to the most well known aliases:
FluBot is distributed using smishing (a combination from the words SMS and phishing). The victim receives an SMS with a link to an URL which distributes the APK. The installation is straight forward using sideloading.
Dear Reader!
A new issue of our bi-monthly SWITCH Security Report is available!
The topics covered in this report are:
The Security Report is available in both English and German.
»» Download the English report. »» Download the German report.
Dear Reader!
A new issue of our bi-monthly SWITCH Security Report is available!
The topics covered in this report are:
The Security Report is available in both English and German.
»» Download the English report. »» Download the German report.
SWITCH Security-Blog 