Defending Critical Infrastructure in Hot War with Tim Conway | 28

In this special episode of Cyber Leaders, Ciaran and James are joined once again by Tim Conway, Technical Director of Industrial Control Systems Security at SANS, to discuss the ongoing conflict in Iran. As three of the world’s most potent cyber actors clash militarily, Tim shares his expert insight on the cyber dimensions of the conflict, the real-world risks for cyber defenders, and how best to protect critical infrastructure in an increasingly volatile geopolitical landscape.

Highlights:

Iran war: where things stand

Overview of the conflict so far and the key events shaping it

• Why did US and Israel attack Iran and how long could the war last?
• Mapping the damage: Iranian strikes on the GCC
• What we know about the US and Iran's ceasefire deal

State-backed cyber activity

• Demystifying Iranian Cyber Operations in the U.S.-Iran Conflict | Iran Conflict Heightens Cyber Threats to U.S. Energy Infrastructure

Non-state and proxy cyber activity

• Iran-backed hackers breach FBI director Kash Patel's emails
• Iran-Linked Hackers Are Sabotaging US Energy and Water Infrastructure
• Justice Department Disrupts Iranian Cyber Enabled Psychological Operations

Cyber operations targeting infrastructure and industry

• Stryker investigating cyberattack that caused widespread outage | Stryker Says Malicious File Found During Probe Into Iran-Linked Attack
• DOJ confirms seizure of domains linked to Iran-backed threat actor
• EU warns of prolonged energy shock, forced cuts if Iran war continues

Information and surveillance tactics

• How phone apps become tools of war
• Israel Spent Years Hacking Tehran Traffic Cameras to Track Khamenei Before Strike: Report

US cyber policy this year and the domestic impact

US cyber posture and its domestic impact

• The Caracas operation suggests cyber was part of the plan – just not the whole operation
• US captures Nicolas Maduro after strikes on Venezuelan capital Caracas
• Gas Prices Are Americans’ Top Iran War Concern
• Iranian-Affiliated Cyber Actors Exploit Programmable Logic Controllers Across US Critical Infrastructure

Iran’s historical cyber activity

Longstanding disruptive and destructive cyber operations

• Following the developing Iranian cyberthreat | .Iranian hackers target Bank of America, JPMorgan, Citi
• Compromise of Saudi Aramco and RasGas | Cyber Attacks in the Spin Cycle: Saudi Aramco and Shamoon
• Adelson: Iran talks need bomb demo | When Iranian Hackers Hit Sheldon Adelson's Las Vegas Casinos
• Homeland Justice operations against Albania (2022) | Albania weighed invoking NATO’s Article 5 over Iranian cyberattack

Cyber warfare and escalation in context

How cyberattacks have evolved into tools of conflict over the past two decades

• The Attack on Colonial Pipeline: What We’ve Learned & What We’ve Done Over the Past Two Years
• Clinton warns against 'cyber attacks' | White Paper: Clinton Administration's Policy; Critical Infrastructure Protection
• 2007 cyber attacks on Estonia | Georgia-Russia conflict (2008)
• Active Engagement, Modern Defence | NATO
• An Unprecedented Look at Stuxnet, the World's First Digital Weapon
• Cyber War and Ukraine | Russia's war on Ukraine: Timeline of cyber-attacks
• CyberAv3ngers: The Iranian Saboteurs Hacking Water and Gas Systems Worldwide | Iranian hacker group CyberAv3ngers allegedly breach Municipal Water Authority of Aliquippa 

Additional resources:

• CIS Critical Security Controls
• The Five ICS Cybersecurity Critical Controls  

Subscribe & Follow:

• Subscribe to the podcast on Apple Podcasts, Spotify, or your favorite podcast platform.
• Follow us on X, Facebook, and LinkedIn for updates.

Contact:

• Have questions or comments? Email us at cyberleadersnetwork@sans.org