Suggestions
Freddy Macho
Chairman IoTSI Chile - Asesor de Directorio - Coordinador Regional CCI - Cyber Researcher - Consejero Comite Ciber - Global Ambassadors CyberTalks
Freddy Macho is a cybersecurity expert and leader in the field of Internet of Things (IoT) and Industrial Internet of Things (IIoT) security. He has been serving as the Chairman of the IoT Security Institute Chapter Chile (IoTSI) since March 2020.1 In this role, he leads an academic and industrial organization dedicated to providing educational frameworks and support services to help manage security within IoT ecosystems.1
Some key aspects of Freddy Macho's professional background include:
-
He is the founder and first president of the IoT Security Institute Chapter Chile.1
-
Macho currently holds the position of Chairman of the Board at the Centro de Investigación de Ciberseguridad IoT - IIoT (IoT-IIoT Cybersecurity Research Center) since April 2021.1
-
He serves as a Regional Coordinator for the CCI (Centro de Ciberseguridad Industrial-Industrial Cybersecurity Center) since September 2020, where he advises on industrial network monitoring, incident response, and threat intelligence.1
-
Macho is an Expert Researcher in Cybersecurity ICS – IoT – IIoT at the Global Foundation for Cyber Studies and Research since June 2020.1
-
He has extensive experience in cybersecurity strategy, risk management, and implementation of security frameworks across various industries.1
Freddy Macho's expertise spans across multiple areas of cybersecurity, including IoT/IIoT security, industrial cybersecurity, risk assessment, and compliance with various security standards and frameworks.1
Highlights
Best practices for event logging and threat detection - Cybersecurity and Infrastructure Security Agency / Federal Bureau of Investigation (FBI) / National Security Agency / Australian Signals Directorate / Australian Government / National Cyber Security Centre / JPCERT/CC / Cyber Security Agency of Singapore (CSA) / @Canadian Centre for Cyber Security
- #Enterprise-approved event logging policy
- Centralised log #collection and #correlation
- Secure storage and event log #integrity
- #Detection #strategy for relevant #threats
Event logging supports the continued delivery of operations and improves the security and #resilience of #critical #systems by enabling #network #visibility. This guidance makes recommendations that improve an organisation’s resilience in the current cyber threat environment, with regard for resourcing constraints. The guidance is of moderate technical complexity and assumes a basic understanding of #event logging.
An effective event logging solution aims to: • send alerts to the #network #defenders responsible for monitoring when cyber security events such as critical software configuration changes are made or new software solutions are deployed • identify cyber security events that may indicate a #cyber #security #incident, such as malicious actors employing living off the land (#LOTL) techniques or #lateral #movement post-compromise • support #incident #response by revealing the scope and extent of a compromise • monitor #account #compliance with organisational policies • reduce alert noise, saving on costs associated with storage and query time • enable network defenders to make agile and informed decisions based on prioritisation of #alerts and #analytics • ensure logs and the #logging #platforms are useable and performant for analysts.
Centro de Investigación de Ciberseguridad IoT - IIoT
Impact of FrostyGoop ICS Malware on Connected OT Systems - Dragos, Inc.
Key Findings
• #FrostyGoop is the ninth #industrial #control #system (#ICS) specific malware. It is the first ICS-specific #malware that uses #Modbus #TCP communications to achieve an impact on #operational #technology (#OT).
• In April 2024, Dragos, Inc. discovered multiple FrostyGoop binaries. FrostyGoop is ICS-specific malware written in Golang that directly interacts with industrial control systems (ICS) using Modbus TCP over port 502. It is compiled for #Windows #systems, and at the time of the #discovery, #antivirus vendors did not detect it as malicious.
• FrostyGoop can read and write to an ICS device holding registers containing inputs, outputs, and #configuration #data. It accepts optional command line execution arguments, uses separate configuration files to specify target #IP addresses and #Modbus #commands, and logs output to a console and/or a #JSON file.
• The Cyber Security Situation Center (CSSC), a part of the Security Service of #Ukraine (Служба безпеки України), shared details with Dragos relating to a cyber attack that targeted a municipal district energy company in Ukraine. During sub-#zero temperatures, the #attack disrupted the power supply to heating services to over 600 apartment buildings. The adversaries sent Modbus commands to #ENCO #controllers, causing inaccurate measurements and system malfunctions. Remediation took almost two days.
• The investigation revealed that the adversaries possibly gained access to the victim #network through an undetermined vulnerability in an externally facing router. The network #assets, including the #router, management servers, and district heating system #controllers, were not adequately segmented, facilitating the #attack
Centro de Investigación de Ciberseguridad IoT - IIoT
