Attack path mapping for a gas distribution company

We conducted a risk-led technical assessment using our Attack Path Mapping methodology. The findings from this engagement demonstrated what could be leveraged by an attacker with no access or with an arbitrary workstation within the on-premises environment, in pursuit of the following objectives:

• Obtain a level of access to the SCADA and ICS sites that would allow for disruption of service.
• Gain administrative access to the client’s AWS cloud environment from the residual on-premises estate.
• Disrupt the client’s business operations by impacting either the availability or integrity of critical services in the AWS cloud environment.

The client had taken steps to elevate its security posture, remediating several notable findings from a previous APM exercise. Still, we observed that basic IT security issues continued to diminish this overall improvement, and ultimately left the client exposed to risk.

Given the unsophisticated nature of the attack paths, it is reasonable to assume that a more advanced state actor, pursuant to financial or disruptive objectives, would achieve a similar result.

We identified three root causes that allowed us to traverse these attack paths:

• Shared IT infrastructure: Assets in AWS and the gas control environment were being administered from corporate endpoints. The compromise of these users often led to the subsequent compromise of cloud or gas control assets, weakening both cloud security and OT security.
• Weak passwords: Weak passwords were systemic across the business and materially weakened the client’s security posture. For example, 67% of all enabled Active Directory account passwords were successfully obtained in plaintext.
• Active Directory architecture: The sharing of the Active Directory forest root resulted in the integrity of one domain being dependent on the other. Compromise of the corporate environment immediately provided Reversec with the necessary privileges to target ICS assets.