Considerations for Critical Infrastructure Operators Working With Third-Party ICS Integrators
FBI and CISA published guidance urging critical infrastructure operators to limit third-party ICS integrator access, citing a 2025 breach of a U.S. automation firm.
The FBI and CISA released a fact sheet advising critical infrastructure operators to apply least privilege and risk assessments when working with third-party ICS integrators. It cites FBI technical analysis of a March-April 2025 intrusion in which foreign cyber actors compromised a U.S. industrial automation solutions company serving power utilities and transportation entities. The actors searched for terms like 'customers' and 'SCADA' and staged nine .zip files of roughly 800 files, including customer SCADA information, ICS device details, and schematics, for presumed exfiltration. The advisory warns such data could enable future disruptive attacks on operational environments and recommends assessing supply chain risk, data storage location, remote access, and geopolitical exposure.
- FBI/CISA fact sheet urges least privilege for third-party ICS integrator access
- March-April 2025 intrusion at U.S. industrial automation firm exfiltrated ~800 files
- Stolen data included customer SCADA information and ICS device schematics
- Risk assessments should cover supply chain, data location, remote access, geopolitics
From the original article
6 min read at cisa.govIntroduction The Federal Bureau of Investigation (FBI) and Cybersecurity and Infrastructure Security Agency (CISA)—hereafter referred to as the “authoring agencies”—have published this fact sheet to highlight considerations for critical infrastructure entities to reduce risk and minimize vulnerabilities when working with third-party industrial control system (ICS) integrators.
By CISA · cisa.gov
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.