United States CISA has issued a cyber threat warning to all web connected UPS devices as they were on the verge of being cyber attacked. The alert was issued on a joint note by the Department of Energy and FBI and urges all critical facilities to review the security of their power back up solutions to the core.
UPS Devices are emergency power backup solutions that offer electric power help in the time of emergency to hospitals, industries, data centers and utilities. Their main purpose is to keep the operations consistently going in the event of a power disaster aka blackout.
However, in some countries like UK, certain UPS device making companies are offering them connected to the internet. For remotely maintaining them and operating them if/when the need arises.
Such devices are now on the verge of being targeted by cyber attacks, says Cybersecurity and Infrastructure Security Agency (CISA) of America, especially those that are being operated with the default username and passwords.
Therefore, system administrators are being advised to put the connected UPS devices behind a virtual private network (VPN) and use them with a multifactor authentication in place. Changing default passwords to something stronger and comprising 12- 18 characters is being encouraged to block unauthorized access to these power backup systems.
Note– All internet connected devices must and should be placed behind a VPN and enabled with a multi-factor authentication. Their default passwords offered by the manufacturer should be changed to something tricky, say experts.
