One of the biggest shocks to the world of critical national infrastructure occurred last year: a ransomware attack on the Colonial Pipeline, the largest system of pipelines in the United States that transports refined oil products.
In order to prevent the malware from spreading from corporate IT systems to operational technology (OT) systems that control the flow and distribution of fuel through the company's pipelines, the attack forced the company to shut down its 5,500-mile network. This caused hundreds of filling stations to run out of gasoline and diesel, forced airlines to reevaluate their fueling arrangements, and caused a major refinery to shut down.
Colonial Pipeline was also dealing with the consequences of the refinery fluid catalytic cracking units Market when it paid the hackers, an affiliate of the Russia-linked DarkSide cybercrime group, a $4.4 million ransom.
This week, the Pipeline and Hazardous Materials Safety Administration (PHMSA) of the US Department of Transportation discovered management flaws at Colonial Pipeline. As a result, the company faces a potential civil penalty of $986,000 for failing to adequately plan and prepare for a manual restart and shutdown operation, which contributed to the national effects of the cyberattack.
What have we learned since the attack on the Colonial Pipeline? The attack on the Colonial Pipeline was more than just a wake-up call for important national infrastructure in the United States and around the world. It was a savage blow to the ribs that highlights the connection between operational technology systems that control industrial equipment and conventional corporate information technology systems caused by a cyberattack.
The Provincial Pipeline cyberattack uncovered the delicate underside of US basic foundation, which before long stood out enough to be noticed and prompted more tight principles on break warning. It became abundantly clear how a single, well-targeted cyberattack can wreak havoc and have devastating effects on business, the public, and the government.
One of the most well-known examples of how compromised credentials can be used to exploit infrastructure that was previously thought to be secure was the Colonial Pipeline attack.
Even though there have been signs of increased awareness, such as the White House and government agencies in the United States following the attack, many businesses will still use the hopeful but fatal defense: I won't experience it.
