Wars and Rumors of Wars - What are the implications for Domestic Critical Infrastructure?

No ratings

Presented at BSidesLV 2024 by

Beau Woods

Karl Holmqvist

Multiple US agencies (and Canada too) have confirmed that Volt Typhoon has compromised the IT environments of multiple critical infrastructure organizations—primarily in Communications, Energy, Transportation Systems, and Water and Wastewater Systems Sectors—in the continental and non-continental United States and its territories, including Guam. Volt Typhoon’s choice of targets and pattern of behavior is not consistent with traditional cyber espionage or intelligence gathering operations, and the U.S. authoring agencies assess with high confidence that Volt Typhoon actors are pre-positioning themselves on IT networks to enable lateral movement to OT assets to disrupt functions. The U.S. authoring agencies are concerned about the potential for these actors to use their network access for disruptive effects in the event of potential geopolitical tensions and/or military conflicts. What are the implications of these pre-positioning attacks, and how should critical infrastructures and members of the general public respond to these types of threats.