Operational Technology Cybersecurity Coalition (Organization): news timeline & CVEs

Researchers warned attackers could 'defrost the food' months before French supermarkets got hit

Attackers compromised exposed Danfoss and Copeland refrigeration controllers, spoiling food at nearly 700 French supermarkets.

Unknown criminals compromised internet-exposed refrigeration controllers and raised temperatures as high as 50°C, spoiling food and sparking fires across nearly 700 French supermarkets. France’s ANSSI said Danfoss controllers were widely compromised and later added Copeland and Dixell systems. Claroty’s Team82 had warned in August of authentication-bypass and OS command-execution flaws in Danfoss AK-SM 800A and Copeland XWEB devices, after earlier CISA advisories. Coalition scanning still found 1,506 exposed Danfoss StoreView panels and 1,119 XWEB login pages, with many remaining online after the attacks.

The Register · SecurityOct 15, 19:23 UTC · 1d agoExploit / PoC in the wild 19 sources2· 1 read

OT Coalition Urges CISA to Mandate Federal OT Security

An OT security coalition urged CISA to mandate minimum operational technology controls for US federal civilian agencies.

The Operational Technology Cybersecurity Coalition published a report on October 6 urging CISA to issue a binding operational directive for operational technology used by federal civilian agencies. Agencies rely on OT in more than 8,000 GSA-managed facilities for HVAC, power, access control, water, and building automation. A September 30 GAO report found that only seven of 22 civilian agencies had fully met OMB requirements to inventory networked OT and IoT devices, which were due by September 2024. The proposed baseline covers asset inventory, segmentation, remote access, configuration management, incident preparedness, and verified recovery, while commentators said it does not require patching or firmware updates.

Infosecurity MagazineOct 7, 14:15 UTC · 9d agoPolicy & legal 3 sources3· 1 read

Cyber experts call on CISA to create mandatory federal OT rules

OT security experts urged CISA to issue a binding directive setting baseline rules for federal operational technology.

The Operational Technology Cybersecurity Coalition published a white paper asking CISA for a binding operational directive covering federal civilian operational technology. It cites recent cyberattacks on hundreds of water systems in at least 12 U.S. states, where devices were internet-exposed, used default or no passwords, and lacked segmentation. A GAO review found only 7 of 22 civilian agencies had fully inventoried networked OT and IoT by the September 2024 deadline, across more than 8,000 federal buildings.

The Recordupdated Oct 7, 14:15 UTC · 9d agofirst Oct 7, 14:03 UTC · 9d agoPolicy & legal 3 sources2· 1 read

Here’s how experts think CISA should tell agencies to protect OT

Experts urge CISA to issue a binding directive requiring federal agencies to secure operational technology.

A coalition of cyber firms and critical-infrastructure operators urged CISA to issue a binding operational directive on how federal civilian agencies should secure operational technology. It wants a named OT security owner, use of existing NSA and CISA guidance, and minimum practices aligned with CISA's 2022 cybersecurity performance goals. A recent GAO report found most federal civilian executive branch agencies have not met 2023 OMB requirements for networked IoT and OT. The paper cites this summer's water-utility attacks and says CISA lacks a full view of federal OT, including programmable logic controllers across about 8,000 GSA properties.

CyberScoopupdated Oct 7, 14:15 UTC · 9d agofirst Oct 6, 11:30 UTC · 10d agoPolicy & legal 3 sources2

Operational Technology Cybersecurity Coalition

Timeline4 articles

Appears with

Researchers warned attackers could 'defrost the food' months before French supermarkets got hit

OT Coalition Urges CISA to Mandate Federal OT Security

Cyber experts call on CISA to create mandatory federal OT rules

Here’s how experts think CISA should tell agencies to protect OT