The IT Nerd

Dragos Inc., the global leader in cybersecurity for operational technology (OT) environments, today announced it has appointed ​Ekta Singh-Bushell as Dragos’s first Chief Operating Officer. Transitioning from her role as chair of the Audit Committee on Dragos’s Board of Directors, Singh-Bushell brings extensive experience in leading business transformation through operational excellence to Dragos’s executive leadership team. As COO, Singh-Bushell will oversee go-to-market, customer experience, and people teams and collaborate across the company to help Dragos fulfill its strategic vision as it progresses in its next phase of growth.

Singh-Bushell brings diverse global management experience from some of the world’s leading companies, combined with expertise in high growth technology sectors including cybersecurity. Notably, she was the COO of the Executive Office at the Federal Reserve Bank of New York. During her more than 17 years at EY, she was in various leadership roles, including as senior managing partner leading transformative initiatives across industries impacted by digital, technology, data, and cyber advancements. Early in her tenure at EY, she served as Global Information Security Officer. Singh-Bushell’s extensive operating experience includes advising and collaborating with CEOs, CFOs, and boards, having served as a board member focused on audit and risk, technology and cyber, for companies including Cisco Systems, Huron Consulting Group, Lesaka Technologies, ChargePoint, Designer Brands, and Datatec.

Singh-Bushell is known for her practical global commercial business practices and insights, having worked with companies in more than 60 countries. Her contributions have been recognized by Cranfield University, which nominated her to the 2017 Female FTSE Board Index: 100 Women to Watch; and by Directors & Boards in their 2017 Year-End list. The Council of Urban Professionals (CUP) honored her with the Catalyst: Change Agent award in 2013. Her credentials include being a Certified Public Accountant (CPA) and certifications in cybersecurity (CISSP, CISA), governance (NACD.DC, CGEIT), and sustainability (FSA). Ekta holds a master’s degree in electrical engineering & computer science from the University of California, Berkeley, and a bachelor’s degree in engineering from the University of Poona, India.

Singh-Bushell’s appointment caps a year of major milestones for Dragos, including ​the acquisition of Network Perception, makers of NP-View, an award-winning network visualization platform for OT networks, and the formation of Dragos Public Sector LLC, a dedicated subsidiary, delivering OT cybersecurity solutions to address the unique needs of government including US federal agencies. This year Dragos also was named to the Deloitte Technology Fast 500 for the fourth consecutive year.

Dragos Inc. today announced the latest release of the Dragos Platform, the industry’s most effective OT network visibility and cybersecurity platform. The updates provide industrial and critical infrastructure organizations with even deeper and enriched visibility into all assets in their OT environments, streamlined workflows for threat detection and vulnerability management that allow for efficient and effective response, and powerful integration of Dragos WorldView intelligence and Neighborhood Keeper community intelligence on current and emerging threats. 

Industrial organizations worldwide are grappling with the rise of threat groups that scale attacks on widely-used technologies and common security weaknesses in OT environments, as well as a 50% year-over-year increase in reported ransomware attacks on these organizations. At the same time, they must balance the need for safety, quality, intellectual property protection, and financial and reputational safeguards with the competing priorities of uptime and availability of complex industrial infrastructure. IT cybersecurity approaches do not adequately protect these systems; threat and vulnerability methods not tailored to OT environments can disrupt essential processes and overburden security teams with irrelevant alerts.

The Dragos Platform provides comprehensive OT-native cybersecurity as a non-intrusive overlay to operations environments. Updates include new local collector and file ingestion capabilities that expand data collection options for increased flexibility; also included are new filtering capabilities that create powerful asset inventory views to answer key visibility questions for IT security and operations alike. The evolved integration of the Platform with Dragos’s Neighborhood Keeper and WorldView threat intelligence streamlines vulnerability management, threat detection, and response workflows to meet emerging threats like FrostyGoop and PIPEDREAM malware; Unitronics vulnerabilities; and VOLTZITE, CyberAveng3rs, and CHERNOVITE threat groups targeting OT environments.  

Enhancing Asset Inventory Capabilities

Sixty-one percent of industrial organizations struggle to effectively monitor their critical assets, limiting visibility into their risk. The latest updates to the Dragos Platform introduce advanced features that streamline and enhance asset inventory management:

• Expanded asset enrichment with project file and data import: The new file ingest feature allows for seamless import and enrichment of asset data from existing project files or other devices, simplifying the process of maintaining a comprehensive and up-to-date asset inventory.
• New lightweight collector for enhanced monitoring: A containerized traffic forwarding solution, this collector operates on edge switches and routers to provide data collection for space-constrained locations deep within OT environments. It captures and processes critical data, ensuring that even the most remote assets are monitored effectively with minimal impact on operations.
• Expanded environment support: Dragos sensors now support Hyper-V and ESXi environments, allowing for broader deployment across different OT infrastructures.

Advancing Vulnerability Management and Asset Operationalization

The Dragos Platform’s latest enhancements also focus on turning asset data into actionable insights, enabling more effective and targeted cybersecurity measures through Dragos’s corrected severity scoring with “now next never” prioritization, alternative mitigation.

• Advanced asset filtering features: The introduction of customizable filters allows users to efficiently manage and analyze asset data, facilitating the identification and prioritization of assets and their vulnerabilities. 
• Automated alerts with Neighborhood Keeper trusted insights – Context of newly discovered vulnerabilities or threat activity relevant to users’ environment can be pushed via Neighborhood Keeper to their Platform console from Dragos directly or from our Trusted Insight Partners, often before the vulnerabilities or threat activity are disclosed publicly. 
• Added intelligence context with pivots to WorldView OT analysis – In-Platform pivots to WorldView intelligence analysis & reporting on specific vulnerabilities providing deep intelligence analysis to enable risk management (additional license required).

Leading the Market in Threat Detection

As threats to OT environments continue to evolve, Dragos remains at the forefront of OT-specific threat detection:

• Over 1,000 new threat detections, vulnerabilities and response playbooks added: The latest updates introduce over 1,000 new threat detections, addressing emerging threats such as CyberAveng3rs, FrostyGoop and other advanced threats. The Dragos Platform’s rapid development and deployment of threat analytics enable organizations to respond swiftly to emerging threats. This capability is vital in maintaining the security and integrity of OT environments, ensuring that critical operations are protected from disruption.

The Dragos Platform’s ability to quickly turn threat intelligence into actionable guidance for customers was most recently demonstrated in response to FrostyGoop, the ninth known ICS malware, which directly interacts with industrial control systems (ICS) using Modbus TCP over port 502, and was discovered by Dragos in April 2024. Dragos Threat Intelligence experts quickly developed new detection analytics and response playbooks and pushed them to Platform users through a Knowledge Pack update. New to this release, opted-in organizations in Neighborhood Keeper can automatically receive these pushed content updates within their Platform instances for immediate coverage. 

The Dragos Platform was awarded Best Industrial Security Solution by SC Awards (2023), won gold in two categories – Critical Infrastructure Security and ICS/SCADA Security – in the Cybersecurity Excellence Awards (2024); recognized as Market Leader in OT Security and Most Comprehensive Industrial Cybersecurity solution by Cyber Defense Magazine’s Global InfoSec Awards (2023); and was a Platinum award winner in ASTOR’s American Security Today Homeland Security Awards for Best ICS/SCADA Cybersecurity (2023).The latest updates further enhance the Dragos ecosystem, equipping it to more effectively tackle critical OT cybersecurity challenges. To gain deeper insights into the newest version of the Dragos Platform, Dragos is offering a public webinar. During this session, Dragos will discuss how new features operationalize asset data for prioritizing and addressing vulnerabilities, as well as how the platform’s threat analytics are developed and deployed to safeguard essential operations.

According to cybersecurity firm Dragos, ransomware attacks on industrial infrastructure more than doubled last year. Of the 600 industrial sector ransomware attacks tracked by Dragos in 2022, three-quarters of them (437) targeted manufacturing in 104 subsectors. That was a 92% increase over the 315 attacks the firm detected in 2021.

The Dragos report also highlighted the emergence of a new, highly dangerous threat group, Chernovite, which developed a modular ICS toolset designed to cause destruction against critical infrastructure companies in the US and Europe.

International conflicts and wars have exacerbated the use of cyber attacks as compliments to political pressure. During 2022, Ukraine saw increased threat group activity targeting its energy and critical industrial infrastructure sectors. Russia’s 2022 invasion of Ukraine provide opportunities for Russia-aligned actors to use their cyber offensive capabilities preemptively and in parallel to its kinetic attacks.

Top 10 Ransomware Group attributions from study:

1. LOCKBIT: 169
2. CONTI: 58
3. BLACK BASTA: 54
4. ALPHA V: 43
5. HIVE: 33
6. KARAKURT: 30
7. ROYAL: 22
8. SNATCH: 17
9. AVOS LOCKER: 14
10. BIANLIAN: 14

Morten Gammelgard EVP, EMEA at BullWall has this perspective:

“Anyone who’s looking at Ransomware as strictly a financial play by criminal enterprises is missing the bigger picture. We are, in most senses, in a war. North Korea, China and Russia are the biggest players in the Ransomware game and as tensions and armed conflicts with these nations continue to escalate the threat actors are shifting their focus to industries that will harm the US and its allies the most: Infrastructure, communications, supply chain, manufacturing and even the government itself. 

“Countless government agencies have been under attack and some, particularly tax assessor offices, have been inoperable for months due to successful ransomware events. We will continue to see maximum focus on these parts of our economy as China, Russia and North Korea attempt to exacerbate our already record inflation to do maximum damage on our economy. The Ransom is only part of a longer game.

“With Russia, China and North Korea so focused on hurting our supply chain and production capability these organizations have to realize they won’t be able to stop those ransomware events from a determined nation-state actor. They MUST also have a solid response and containment strategy, including automated ransomware containment.

What’s clear from this report is ransomware is not going away anytime soon. Thus organizations need to ensure that they are fully protected from the threat that ransomware poses, or be prepared to suffer the consequences if they aren’t.