Latest / Connectivity Without Chaos - The Podcast / The Cybersecurity Threat Hiding in Your Building

Transcript

The Cybersecurity Threat Hiding in Your Building · Connectivity Without Chaos - The Podcast

• 0:00
  SPEAKER_00: Okay, let's unpack this.
• 0:02
  SPEAKER_00: Usually when you think of a grocery store cyber attack, it's, well, it's a standard IT headache.
• 0:07
  SPEAKER_01: Right.
• 0:08
  SPEAKER_01: Like that recent Aholdel-Delhaize incident.
• 0:11
  SPEAKER_00: Exactly.
• 0:11
  SPEAKER_00: Where the stop-and-shop websites went down, but the physical stores just stayed open.
• 0:16
  SPEAKER_00: But our mission today,
• 0:18
  SPEAKER_00: pulling from a stack of recent incident reports,
• 0:20
  SPEAKER_00: is to look at a totally different kind of threat.
• 0:23
  SPEAKER_01: Yeah, a really chilling attack on actual physical infrastructure.
• 0:27
  SPEAKER_00: Right.
• 0:28
  SPEAKER_00: On the night of October 11th, Hackers didn't even touch a website.
• 0:32
  SPEAKER_00: They took over the refrigeration systems in over 700 French supermarkets.
• 0:37
  SPEAKER_01: And they forced them into a continuous defrost cycle.
• 0:41
  SPEAKER_00: Wait, so they basically just heated up the freezers?
• 0:43
  SPEAKER_01: Yeah, we're talking temperatures climbing to like 50 degrees Celsius inside those freezers.
• 0:48
  SPEAKER_00: Oh, wow.
• 0:49
  SPEAKER_00: That's hot.
• 0:51
  SPEAKER_01: Exactly.
• 0:52
  SPEAKER_01: It ruined all the meat,
• 0:53
  SPEAKER_01: melted frozen goods, and the overheated equipment literally started fires.
• 0:57
  SPEAKER_00: Seriously?
• 0:58
  SPEAKER_00: Fires.
• 0:59
  SPEAKER_01: Yeah, just two stores in the Alsace region reported something like 270,000 euros in losses.
• 1:06
  SPEAKER_00: My mind immediately goes to some,
• 1:07
  SPEAKER_00: I don't know,
• 1:08
  SPEAKER_00: Ocean's Eleven style cyber heist,
• 1:10
  SPEAKER_00: you know,
• 1:11
  SPEAKER_00: like nation state hackers dropping zero day exploits
• 1:15
  SPEAKER_00: or deploying incredibly complex malware.
• 1:18
  SPEAKER_01: Right.
• 1:18
  SPEAKER_01: It sounds like a movie.
• 1:20
  SPEAKER_01: But what's fascinating here is how incredibly boring the actual mechanism was.
• 1:24
  SPEAKER_00: Boring?
• 1:25
  SPEAKER_00: Really?
• 1:27
  SPEAKER_00: Looking at the postmortem, they didn't even send a phishing email or a ransom note.
• 1:31
  SPEAKER_01: No, absolutely zero custom malware was involved.
• 1:34
  SPEAKER_01: The attackers simply ran a scan and found these internet-connected temperature controllers.
• 1:39
  SPEAKER_00: Oh, okay.
• 1:40
  SPEAKER_01: Specifically,
• 1:41
  SPEAKER_01: they were older models made by Danfoss and Copeland,
• 1:44
  SPEAKER_01: and they were connected directly to the public internet,
• 1:47
  SPEAKER_01: running completely unsupported firmware.
• 1:50
  SPEAKER_00: But wait, why is a walk-in freezer on the public internet in the first place?
• 1:54
  SPEAKER_00: I mean, that just seems...
• 1:56
  SPEAKER_01: Crazy.
• 1:56
  SPEAKER_00: Crazy, yeah.
• 1:57
  SPEAKER_01: But it's purely for operational convenience.
• 1:59
  SPEAKER_01: Vendors and contractors want remote access.
• 2:02
  SPEAKER_00: Oh, right.
• 2:02
  SPEAKER_00: So they can adjust temperature thresholds without having to actually roll
• 2:05
  SPEAKER_00: a truck out to the physical store.
• 2:07
  SPEAKER_01: Exactly.
• 2:08
  SPEAKER_01: Which, you know,
• 2:09
  SPEAKER_01: makes sense on paper,
• 2:10
  SPEAKER_01: but it effectively moves your digital perimeter to a random box sitting behind
• 2:14
  SPEAKER_01: the dairy aisle.
• 2:15
  SPEAKER_00: Right.
• 2:15
  SPEAKER_01: And because this isn't just a grocery-specific technology, the threat is everywhere.
• 2:19
  SPEAKER_01: This is a massive operational technology crisis.
• 2:22
  SPEAKER_00: Because facilities teams are just constantly plugging things in, right?
• 2:26
  SPEAKER_01: Oh, all the time.
• 2:27
  SPEAKER_00: Badge readers, HVAC systems, medical infusion pumps.
• 2:31
  SPEAKER_00: And they do it completely under IT's radar.
• 2:33
  SPEAKER_01: It's basically the equivalent of having ghost employees in your office.
• 2:37
  SPEAKER_00: Ghost employees?
• 2:38
  SPEAKER_00: Yeah, like these IoT devices have a badge.
• 2:41
  SPEAKER_00: They have 24-7 access to the building.
• 2:43
  SPEAKER_00: But human resources, or in this case IT, doesn't even know they work there.
• 2:48
  SPEAKER_00: Nobody is managing them.
• 2:49
  SPEAKER_01: That is a perfect analogy.
• 2:51
  SPEAKER_01: And because IT is blind to them,
• 2:53
  SPEAKER_01: nobody is tracking their life cycles or, you know, updating their software.
• 2:56
  SPEAKER_01: They just sit there gathering dust and vulnerabilities.
• 2:59
  SPEAKER_00: So if the threat is unmonitored devices, the fix has to start with visibility, right?
• 3:04
  SPEAKER_00: Like strict life cycle management?
• 3:07
  SPEAKER_01: Absolutely.
• 3:08
  SPEAKER_01: You need a comprehensive physical device inventory.
• 3:11
  SPEAKER_01: And you actually have to enforce end-of-life hardware policies.
• 3:15
  SPEAKER_00: Meaning if a controller can't be patched anymore, it has to be replaced, not just forgotten.
• 3:20
  SPEAKER_01: Exactly.
• 3:21
  SPEAKER_01: And for the active ones, pulling them off the public internet stops that outside-in attack.
• 3:27
  SPEAKER_00: But what if a hacker breaches the network another way?
• 3:29
  SPEAKER_00: I mean, those controllers are still sitting ducks internally, aren't they?
• 3:33
  SPEAKER_01: They are, which is why you have to isolate them using network segmentation.
• 3:37
  SPEAKER_01: By putting these operational devices on a dedicated VLAN,
• 3:41
  SPEAKER_01: you're logically walling off the network at the switch level.
• 3:45
  SPEAKER_00: Okay, so even if an attacker compromises, say, the hallway thermostat, they just hit a dead end.
• 3:50
  SPEAKER_01: Right.
• 3:51
  SPEAKER_01: The routing tables physically won't let those packets cross over to the subnet
• 3:54
  SPEAKER_01: where your point of sale systems or data servers live.
• 3:57
  SPEAKER_00: Here's where it gets really interesting, though.
• 4:00
  SPEAKER_00: Because doing that manually across a whole enterprise is nearly impossible.
• 4:03
  SPEAKER_01: Oh, it's a complete nightmare.
• 4:05
  SPEAKER_00: You have to automate that mapping.
• 4:06
  SPEAKER_00: And that's the exact gap Provision Networks targets.
• 4:09
  SPEAKER_01: Yeah, exactly.
• 4:10
  SPEAKER_00: Instead of hunting down every single thermostat by hand,
• 4:13
  SPEAKER_00: they actively map out those blind spots for you.
• 4:15
  SPEAKER_00: They build the device inventory and they execute that essential network segmentation.
• 4:20
  SPEAKER_00: So one weak link doesn't bring down the whole ship.
• 4:23
  SPEAKER_01: It's crucial.
• 4:24
  SPEAKER_01: And it really raises an important question about how we prioritize our defenses.
• 4:28
  SPEAKER_00: How so?
• 4:28
  SPEAKER_01: Well, we spend so much time worrying about AI-driven threats
• 4:32
  SPEAKER_01: or complex nation-state phishing schemes.
• 4:35
  SPEAKER_01: But the vulnerabilities that cost you millions are usually
• 4:38
  SPEAKER_01: the ones you stopped looking at years ago.
• 4:40
  SPEAKER_00: The forgotten boxes humming quietly on the wall.
• 4:43
  SPEAKER_01: Exactly.
• 4:44
  SPEAKER_01: The most expensive security risks rarely look like Ocean's Eleven.
• 4:48
  SPEAKER_01: They look like an unpatched thermostat.
• 4:51
  SPEAKER_00: So, what does this all mean for you?
• 4:54
  SPEAKER_00: We'll leave you with this final thought to mull over.
• 4:57
  SPEAKER_00: If a walk-in freezer can take down a multi-million dollar retail operation
• 5:01
  SPEAKER_00: and start literal fires,
• 5:03
  SPEAKER_00: what invisible internet connected devices are quietly sitting in your own office
• 5:07
  SPEAKER_00: or home right now running outdated software that absolutely no one is watching?