This document summarizes a cyber security conference presentation on air gaps and attacks against isolated networks. It defines an air gap as a type of network security that keeps a network separate from other local networks and the internet to provide protection, but limits access. The document then lists several historical attacks against isolated networks from 2000 onward using various methods like insiders, remote access, malware, and infected laptops. Charts show the majority of incidents in 2012 were due to human errors and system failures rather than malicious attacks. The presentation recommends investing in the right security tools, awareness, monitoring, incident response, and forensics to defend isolated networks.

1. ISA Ireland Section
Cyber Security Conference
8th May 2014

2. Who Am I?

4. What is an Air Gap?
In networks, an air gap is a type of
security where the network is secured
by keeping it separate from other local
networks and the Internet. While this
provides security, it also limits access
to the network by clients.

22. Attack Breakdown
Country
Type
Total
Critical Noncritical
Netherlands 0 2 2
China 5 2 7
Germany 1 4 5
Kazahkstan 0 1 1
Canada 0 1 1
USA 0 3 3
Australia 0 1 1
Moldova 0 1 1
Ukraine 0 2 2
UK 1 0 1
France 1 0 1
Palestine 2 1 3
Poland 0 1 1
Slovenia 0 1 1
Japan 0 1 1
Russia 0 43 43
Total 10 64 74

25. April 2000 – Insider & Hackers
Controlled Central Switchboard

26. April 2000 – Remote Access
Maroochy Water Services

27. June 2001 – External Hackers
California Independent System
Operator

28. January 2003 – Bypassed Firewall
Davis-Besse Plant via Contractor

29. October 2006 – Infected Laptop
Harrisburg PA Water Treatment

30. Aug 2007 – Unauthorised Software
Tehama Colusa Canal Authority

31. March 2009 – Disgruntled Employee
Pacific Energy Resources

32. October 2010 – Stuxnet

33. Since 2010 - Specialised Malware

34. Goodbye Air Gap

35. BadBIOS – From 2012

37. 2012 Annual Incidents Report

38. 13
76
8
5
6
0 10 20 30 40 50 60 70 80
Third Party Failure
System Failures
Malicious Actions
Human Errors
Natural Phenomena
% Incidents

39. 13
9
4
26
36
0 5 10 15 20 25 30 35 40
3rd Party Failure
System Failures
Malicious Actions
Human Errors
Natural Phenomena
Outage in Hours

40. “Cyber-attacks are
the 6th most
important cause of
outages in
telecommunication
infrastructures,
with an impact on
considerable
numbers of users
in this sector”

41. How To Defend

43. Invest in Right Tools

44. Awareness

45. Monitor & Respond

46. Incident Response & Forensics

47. @BrianHonan