Cybersecurity Under Pressure. Real Attacks, Real Lessons

Antonio González
  • 0.0 (0)
  • Technology
  • Weekly

Cybersecurity Under Pressure examines real incidents, technical research and security decisions across industrial systems, railways and connected vehicles. Antonio González connects attack mechanisms with engineering constraints, operational resilience and product-security evidence. Explore OT and ICS security, automotive and railway cybersecurity, software supply chains and the decisions behind secure operations.

  1. 1d ago ·  Bonus

    OT Maintenance Windows: Monitoring Temporary Access | CUP Focus

    Planned downtime concentrates contractors, temporary access, firmware changes and disabled alerts in the same period. This CUP Focus explains why maintenance windows require tighter monitoring and evidence, not relaxed controls. Format: CUP Focus, a self-contained section from the Cybersecurity Under Pressure archive. Related CUP episodes: Kinetic AI and Critical Infrastructure: Connecting Cyber and Physical RiskOT Remote Access: Closing the Path When the Work EndsOT Session Hijacking: Revoking Trusted Engineering AccessLegacy VPNs in OT: Remote Access and the Cost of Disruption

  2. 2d ago

    Oldsmar Revisited: Remote Access and the Limits of the Evidence

    Editorial context: The February 2021 Oldsmar incident was initially reported as an unauthorized remote-access attempt to alter water-treatment dosing. In 2023, the FBI said it could not confirm that a targeted cyber intrusion had initiated the incident. Treat the reported attack sequence discussed in this episode as an account with unresolved evidentiary limits, rather than a proven intrusion. Authorities reported no significant effect on treated water and no danger to the public. Revisit the Oldsmar case through the operational questions it raises for water utilities: who can reach an operator workstation, what authority a remote session carries, how process changes are detected, and what evidence supports a response decision. The practical focus is remote-access governance, independent process safeguards, operator visibility and incident evidence. Lessons derived from the reported scenario do not establish what actually caused the Oldsmar event. Sources and further reading:Original Pinellas County Sheriff report: https://www.pinellassheriff.gov/21-015-detectives-investigate-computer-software-intrusion-at-oldsmar-s-water-treatment-plantFBI investigation records: https://vault.fbi.gov/attempted-hacking-of-oldsmar-water-treatment-plant-on-february-5-2021WUSF, April 2023 follow-up: https://www.wusf.org/local-state/2023-04-13/official-hack-oldsmar-city-water-treatment-plant-2021CISA advisory AA21-042A: https://www.cisa.gov/news-events/cybersecurity-advisories/aa21-042a Cybersecurity Under Pressure. Real Attacks, Real Lessons.

  3. 3d ago ·  Bonus

    Industrial 5G Security: Protecting the Wireless Conduit | CUP Focus

    A wireless conduit cannot be protected like a copper port. This CUP Focus connects 5G device identity, subscriber credentials, edge routing and passive application monitoring without adding latency to deterministic industrial traffic. Format: CUP Focus, a self-contained section from the Cybersecurity Under Pressure archive. Related CUP episodes: Industrial 5G Jamming: Protecting Control When the Radio FailsIndustrial 5G Security: Designing for Lost ConnectivityWhen 40 Milliseconds Become an OT Incident | CUP Micro BriefFRMCS Security: Why a Mobile Network SLA Is Not a Safety Case

  4. 3d ago ·  Bonus

    Railway Diagnostic Security: Protecting Privileged Access | CUP Micro Brief

    A railway diagnostic platform may not execute the safety function, but it can expose topology, privileged sessions and a pivot path toward operational assets. This CUP Micro Brief explains why monitoring systems still belong inside the security boundary. Related CUP episodes: Frauscher FDS102: Securing Railway Diagnostic AccessLegacy Railway Security: Patching and Validation ConstraintsRailway OT Segmentation: Protecting the Certified CoreRailway Cybersecurity: Service Risk Beyond the SIL Boundary

  5. 4d ago

    How Volt Typhoon Weaponizes Active Directory

    Volt Typhoon turns trusted administration into a path toward critical infrastructure. This episode examines how stolen credentials, Active Directory compromise and living-off-the-land activity can undermine confidence in the systems operators depend on. We explore the identity boundary between enterprise IT and operational technology, the evidence defenders need to distinguish legitimate administration from an intrusion, and the recovery decisions that follow a suspected domain compromise. Sources and further reading:Joint CISA advisory AA24-038A: https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-038aJoint CISA advisory AA23-144A: https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-144a Cybersecurity Under Pressure. Real Attacks, Real Lessons.

  6. 5d ago

    Industrial Router Security: When SMS Authentication Fails Open | CUP Micro Brief

    An industrial router disables SMS password checks after five failed attempts. This CUP Micro Brief examines the availability logic behind the fail-open design and why it becomes dangerous on a cellular attack surface. Related CUP episodes: Weidmüller Router Security: When Segmentation Becomes an Attack PathIndustrial Network Security: Designing for Operational ResilienceLegacy VPNs in OT: Remote Access and the Cost of DisruptionOT Remote Access: Closing the Path When the Work Ends

  7. 5d ago ·  Bonus

    SBOM and VEX: Proving Vulnerability Reachability | CUP Focus

    Component presence and practical exposure are different facts. This CUP Focus explains how static and dynamic reachability analysis support VEX decisions, reduce false positives and create defensible evidence when an actively exploited vulnerability appears. Format: CUP Focus, a self-contained section from the Cybersecurity Under Pressure archive. Related CUP episodes: Cyber Resilience Act: Evidence and the 24-Hour Reporting ClockSBOM and VEX: Turning Vulnerability Data into OT Risk DecisionsSBOM and VEX: Challenging Supplier Vulnerability ClaimsNIST IR 8536: Verifying the Software Supply Chain

  8. 6d ago

    A Trusted Engineering Workstation Can Still Deploy a Malicious Flow

    An unauthenticated flow editor can turn an industrial gateway into a code-execution platform. This episode examines the Siemens SIMATIC IoT2050 Advanced case and the operational choices around patching, access restrictions and containment. Siemens advisory SSA-834709 documents CVE-2026-58115 in affected devices running Industrial OS with Node-RED installed before V4.3.4.1. An unauthenticated attacker who can reach the vulnerable HTTP interface may create malicious flows and execute code with maximum privileges. Siemens recommends updating to V4.3.4.1 or later. Editorial clarificationThe factory and incident-response situations in the discussion are hypothetical. Compromise of this gateway does not by itself prove authority to write to a PLC or manipulate a physical process. That depends on reachable services, protocols, credentials and controller-side controls. Any dependence of HMI visibility or alarms on this gateway must also be established for the actual installation; it is not a product-wide finding in the Siemens advisory. The discussion overstates the difficulty of detection at approximately 16:48. Legitimate-looking HTTP traffic can make malicious intent difficult to distinguish, but detection is not inherently impossible. Flow-change records, access logs, approved-configuration comparisons and host or network monitoring may provide evidence, depending on deployment and coverage. Containment must follow the plant-specific response plan and process-safety assessment. Neither disconnecting every gateway nor keeping every connection alive is a universal rule. Preserve required safe control and trustworthy monitoring while restricting the attacker's access. These qualifications take precedence over broader language in the discussion. Chapters00:00 Introduction00:47 The Siemens Node-RED case07:24 The Technical Breakdown16:48 The Operational Decisions25:19 The Pressure Test32:56 The Key Takeaways35:34 Closing Cybersecurity Under Pressure. Real Attacks, Real Lessons.https://cybersecurityunderpressure.com/ Primary sourcesSiemens ProductCERT SSA-834709:https://cert-portal.siemens.com/productcert/html/ssa-834709.htmlNode-RED security guidance:https://nodered.org/docs/user-guide/runtime/securing-node-redNIST SP 800-82 Rev. 3:https://csrc.nist.gov/pubs/sp/800/82/r3/final

See All (144)

About

Cybersecurity Under Pressure examines real incidents, technical research and security decisions across industrial systems, railways and connected vehicles. Antonio González connects attack mechanisms with engineering constraints, operational resilience and product-security evidence. Explore OT and ICS security, automotive and railway cybersecurity, software supply chains and the decisions behind secure operations.

Information