Cyber – AIS Home | Assured Information Security

AIS Publishes Two New Vulnerabilities in Trailer Power Line Communications

A1Sadmin — Tue, 05 Apr 2022 19:47:51 +0000

AIS and the National Motor Freight Traffic Association, Inc. (NMFTA) have published two new vulnerabilities within Trailer Power Line Communications (PLC) signals, now totaling three vulnerabilities discovered by the team and published by the Cybersecurity and Infrastructure Security Agency (CISA). Last month CISA issued an Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) advisory to bring awareness of these vulnerabilities to the transportation systems sector.

AIS researchers Dan Salloum, Chris Poore and Eric Thayer and NMFTA researcher Ben Gardiner reported these vulnerabilities to CISA.

“This research has focused on raising industry awareness to the potential issues that could impact the reliability and integrity of connected systems,” said Thayer, Principal Investigator at AIS “These vulnerabilities could lead to the exposure of sensitive information or possibly enable attacker access to the vehicle bus, so it’s essential to take defensive measures to minimize the risk of exploitation.”

This research indicates that there is missing authentication for critical function and improper protection against electromagnetic fault injection in PLC: J2497 (a.k.a. PLC4TRUCKS). Successful exploitation of these vulnerabilities could allow a nearby attacker to execute diagnostic functions in the trailer or light the trailer ABS fault telltale in a tractor. CVE-2022-25922 has been assigned to the first vulnerability and a CVSS v3 base score of 6.1 has been calculated. CVE-2022-26131 has been assigned to the second vulnerability and a CVSS v3 base score of 9.3 has been calculated.

“With these new discoveries, our team now has three published vulnerabilities as a result of PLC research performed under AIS’s Internal Research and Development Program, which helps shape employees’ concepts and ideas to create future programs for the company and provide value to our customers,” said Cat Hulser, Program Manager at AIS. “This is an incredible accomplishment for AIS and it’s rewarding to know that we’re helping to create a safer transportation sector in our community, while continuing to build our reputation as leading researchers in the field.”

To view the full advisory, click here.

AIS Cyber Infrastructure Expert Dissects Ransomware in Wake of Pipeline Cyberattack

A1Sadmin — Wed, 12 May 2021 15:12:26 +0000

On Saturday, May 8, 2021, news broke of the shutdown of the main fuel supply line to the U.S. East Coast due to a cyberattack. This is just another in the growing number of ransomware incidents to hit U.S. government and commercial organizations.

Ransomware is a form of malware designed to encrypt files on a device, rendering any files and the systems that rely on them unusable. Malicious actors then demand ransom in exchange for decryption.

As a leading cyber and information security company for government and commercial entities, Assured Information Security (AIS) understands just how important it is for the computer systems and networks supporting critical infrastructure, such as a fuel distribution pipeline, to be evaluated on a regular basis for secure design and implementation.

“Cyberattacks against critical infrastructure have grown significantly in the past years and the numbers are likely to continue to rise as more systems are automated and connected to networks,” said Eric Thayer, Principal Engineer for Systems Analysis and Exploitation at AIS. “At AIS we regularly analyze the security of complex systems, such as those that may have been supporting the pipeline. We have a team that specializes in identifying weaknesses and hardening safety critical systems.”

According to the Washington Post, in recent years, ransomware attacks have affected everyone from banks and hospitals to universities and municipalities — almost 2,400 organizations in the U.S. were victimized last year alone. Attackers are increasingly targeting industrial sectors because these firms are more willing to pay up to regain control of their systems, experts say.

“Cyber threats are constantly evolving, and it is important for companies to understand the impact of vulnerabilities before they are discovered and to be prepared with plans in place to mitigate potential threats,” said Thayer. “End to end vulnerability assessments and secure product consulting are services we often encourage our customers to consider. These services help to proactively identify weaknesses before they are exploited and we can build systems securely from the ground up, minimizing potential threats.”

2020 Tech Council Update

Millie Occhionero — Wed, 30 Dec 2020 20:41:11 +0000

Throughout 2020, the Tech Council has continued to deliver on its purpose statement through the facilitation of communications amongst teams, contributions to research integrity and quality and sharing of lessons learned on the COVID-driven changes in workforce structure. These contributions are in the spirit of delivering excellence to our customers and supporting our teams that deliver that excellence daily. Our focus has been on three main points:

Cross-Team Communication Flows

Our regular meetings have shifted focus in 2020, with major topics including DevOps and development automation, technical brainstorming and continuous alignment of AIS’s unique business requirements with the compliance initiative. We’ve also been sharing lessons learned through COVID-19 and how we can successfully on-ramp and engage an almost entirely remote staff while staying highly responsive to our customers. Information sharing across our company is invaluable. Technical leaders from the Adaptive Systems Technology and the Cross Domain Virtualization Solutions Teams collaborated on a lessons learned exchange with regards to effectively shaping our software development processes to our customer’s needs. As a result, the processes are continually evolving to be efficient, effective and agile.

Research Integrity and Product Quality

Internal research and development (IRaD) projects set direction for long-term initiatives and strategy areas, so making sound decisions is critical. Our feedback helps shape concepts and ideas that create our future programs and provide value to customers and stakeholders. In collaboration and close alignment with the AIS Chief Technology Officer, the Tech Council is actively involved in the IRaD proposal review process and a subset of members have contributed to strategy for projects in 2021 and beyond.

Facilitating New Research Opportunities

An initial down-select of government Small Business Innovation Research (SBIR) topics by the Tech Council and Business Development Department provides potential proposal teams a more focused selection of topics with clear alignment to AIS capabilities and future strategies. In 2020, we identified Tech Council representatives to sup-port the effort and had two rounds of filtering, reviewing more than 100 SBIR topics to allow potential AIS proposal authors to quickly review highly applicable topics before turning their attention to the broader list.

Looking Ahead

In 2021, the Tech Council is looking forward to staying true to its purpose statement through direct daily engagement with teams while also further engaging business development and culture initiatives.

About the AIS Tech Council

The purpose of the Tech Council is to provide advisement and support on issues and initiatives with regards to technical information flows, research integrity, product quality, enhancing culture, enabling vision and fostering an enjoyable work environment.

ACCESS – A Year in Review at AIS

Millie Occhionero — Wed, 30 Dec 2020 19:46:36 +0000

A Year In Review

The year 2020 was without question, a challenging one. However, our company has made many strides and we would be amiss to not celebrate the achievements of our talented team and growing organization. Many of these achievements are also highlighted in our 7th issue of ACCESS. Take a look

Growth Without Compromise, How the AIS Culture is Evolving

From wearing slippers in the hallways to hanging a pirate flag up at the office, the beginnings of our company are anything but typical. The AIS culture is rooted in innovation, collaboration, resilience and just being different. From our start in 2001, we’ve grown into a 350-employee company with offices and customer locations across the nation. With this growth, the need to nurture and evolve the culture that has made us who we are is essential. Read more >>

Keeping Employees Safe During COVID-19

When the pandemic emerged, AIS responded swiftly. With the COVID-19 still ever-present, we’ve created a Workplace Safety Committee (WSC). The WSC been working diligently to stay informed on local, state and country-wide guidelines and restrictions. Using this information, they are continuously developing policies and guidelines to keep employees and their families as healthy as possible. Read more >>

Senior Vice President, Barry McKinney, Retires

In November 2020, Barry McKinney, Senior Vice President, retired after more than 15 years at AIS. McKinney and his growing family made this decision together and are looking forward to making new memories. Read more >>

Leadership Team Welcomes New Members

Our leaders continue to move us forward. This year, we welcomed:

Jeffrey Dailey, Director of Information Technology. Read more >>
Christopher Ficke, Controller. Read more >>
Byron Parker, VP of Business Development. Read more >>
Diana Wolgemuth, Director of Organizational Development. Read more >>

Can You Hack It?® Challenge Reaches New Milestones

The AIS Can You Hack It?® Challenge site contains several different programming challenges for anyone who is willing to test their skills. As of December 2020, the site has challenged more than 5,500 people internationally and has resulted in multiple talented hires at AIS. Read more >>

Leadership Changes at GreyCastle Security

On January 1, 2020, Dan Kalil was named the Chief Executive Officer (CEO) at GreyCastle Security. Prior to becoming CEO, Kalil served as the company’s Board Chairman and Chief Strategy Officer since 2016, when AIS acquired majority interest in the business. As one of the co-founders of AIS, Kalil also continues to serve as the company’s Vice President of Commercial Operations and Corporate Communications. Read more >>

2020 Tech Council Update

Employees Make Mark in Transportation Sector

This year, AIS and the National Motor Freight Traffic Association, Inc. (NMFTA) published a vulnerability within trailer Power Line Communications (PLC) signals. Read more >>

AIS Wins Largest Prime DARPA Contract in Company History

This $9 million contract will enable the Systems Analysis and Exploitation Team, along with teaming partners Cummins Incorporated, Colorado State University and GRIMM, to develop challenge problems and evaluate performer’s solutions to problems related to heavy-duty engine systems. Read more >>

2020 Patents

With our increased research efforts at AIS, we have a growing number of patents that have been filed and several that have been awarded. Congratulations to our brilliant employees on their achievements in innovation. Read more >>

Forward Thinking, CTO Round-Up

In September 2019, we launched our plan to reinvigorate the AIS Research Program. The vision for this initiative was to provide a foundation of intellectual property, talent, partnerships and community to support our company’s strong commitment towards our people, our customers and innovation. Since beginning this process, we’ve hit multiple milestones and have further developed our goals in accordance to our five-year plan. Read More >>

See You Next Year!

These are just a few of the exciting milestones achieved in 2020 at AIS. Looking ahead to 2021, we will continue to challenge the impossible to create a secure future for our customers, employees and community.

Top Ten Gifts for the Engineer in Your Life

Millie Occhionero — Wed, 09 Dec 2020 19:11:15 +0000

Without the expertise of software engineers and research scientists, the world would be a much different place. Let’s make sure they have the best holiday season with these cool finds:

Blue Light Blocking Computer Glasses – They are always in front of the screen! Let’s protect their eyes.
Tinkering Labs Stem Kit for Kids – For the next generation coders!
Chopstick LightSabers – Need we say more?
3D Printer – More expensive gift but worth it!
Coded Candle – Everyone needs a good candle, even engineers.
Internal/external hard drives – Who couldn’t use more of these?
Fungineer Shirt – Because engineers are fun too!
Steam gift cards – So many games to choose from!
Mechanical keyboard – They use them all day, give them one to last!
Robotic Arm – Because every engineer deserves a robot.

AIS Publishes Vulnerability in Trailer Power Line Communications

A1Sadmin — Mon, 10 Aug 2020 20:19:56 +0000

AIS and the National Motor Freight Traffic Association, Inc. (NMFTA) have published a vulnerability within trailer Power Line Communications (PLC) signals. The Cybersecurity and Infrastructure Security Agency (CISA) has issued an Industrial Control Systems Cyber Emergency Response Team (ICS-CERT) advisory to bring awareness of the vulnerability to the transportation systems sector.

This research indicates that it is possible to read PLC signals reliably using active antennas at six feet and up to eight feet away. NMFTA researcher Ben Gardiner and AIS researchers Dan Salloum, Chris Poore and Eric Thayer reported this vulnerability to CISA.

“This vulnerability could lead to the exposure of sensitive information, traversing the vehicle bus,” said Thayer, Principal Investigator at AIS. “We expect to be able to build upon this research to identify other potential issues that could impact the reliability and integrity of connected systems.”

CVE-2020-14514 has been assigned to this vulnerability and it has been given a Common Vulnerability Scoring System Version Three (CVSS v3) base score of 4.3.

“This is the first ICS-CERT advisory that AIS has had published,” said Cat Hulser, Program Manager at AIS. “Not only is this an exciting accomplishment for our team, it’s also rewarding to know that we’re contributing to a safer transportation sector in our community.”

To learn more about this advisory, click here.

SecureView®

A1Sadmin — Mon, 21 Oct 2019 14:51:42 +0000

Resources > SecureView^®

TECH INSIGHT

SecureView^®

Solving Some of the Hardest Security Access Problems in Cross Domain

AIS is committed to leading the industry in the development of cross domain solutions, performing advanced research and development and growing a line of commercial software products for both domestic and international customers.

SecureView exemplifies this dedication to building solutions from start to finish. SecureView is a cross domain access solution originally built in support of the Air Force, that is now used across the United States (US) Department of Defense (DoD) and Intelligence Community (IC). SecureView provides access to multiple networks operating at different security levels and eliminates the need for multiple physical workstations.

History

SecureView started as a requirement from the Office of the Director of National Intelligence (ODNI), after realizing there was no mechanism for communicating quickly and effectively across the various departments within the US Government. At the time, the solutions available were not feasible for what ODNI needed.

ODNI contacted Air Force Research Laboratory (AFRL) and asked them to create a team to evaluate the problem and provide a list of possible solutions as well as help envision the path forward.

AFRL assembled a team and quickly realized they were going to require secure hypervisor technology to support the proper isolation of systems. AFRL enlisted AIS due to our expertise in hypervisor security through an early research and development project called SecureCore.

“We were added to the SecureView team because AFRL was familiar with work we did under SecureCore, since this project helped us establish a highly credible reputation in hypervisor technology,” said Rian Quinn, Chief Technology Officer at AIS. “We were brought on in an advisory role, until they decided to implement the Virtual Private Network Virtual Machine (VPNVM), which was the first actual code we developed for AFRL.”

The implementation of the VPNVM led to additional work by AIS in support of AFRL. That is how AIS became the prime contractor for SecureView.

“SecureView enables users to simultaneously access multiple security domains with an unparalleled level of security and solves some of the hardest security access problems in cross domain,” said Adam Hovak, Operations Manager. “Today, it is one of only two products in the world certified by the NSA for accessing multiple independent levels of security.”

SecureView is installed at over 97 locations and on over 17,500 computers.

Areas of Operation

The team has three areas of operation: Development, Testing and Deployment.

The Development team is responsible for developing new features, fixing issues and providing support to the Test and Deployment teams. The developers create Feature Design Documents to present to the customer and provide demonstrations. They keep the customers informed and engaged throughout the development process.
The System Engineering/Test team tests for hardware validation, software functionality and security, as well as issue tracking and regression testing. This team also tracks public software security announcements to evaluate against current software versions and ensure the platform maintains the highest level of security.
The Deployment team oversees end-user solution engineering, network design, preparing customer sites for solution installation, installing and performing security testing. The deployment team is also responsible for designing and testing the network infrastructure supporting SecureView implementations and conducting end-user training.

“The three teams work interactively to support SecureView customers across all efforts,” said Sue Stein, Program Manager. “From new feature design to solution testing and implementation, all members of the team are needed for SecureView to be successful.”

Andrew Criscolo, Senior Software Engineer for SecureView sees the significance of the work the team does for the customer.

“We provide a highly usable, trusted multi-level security environment, featuring best-in-class security measures that would be extraordinarily challenging for any adversary to circumvent,” said Criscolo. “The end result is that our customers, the people performing some of our nation’s most critical tasks, are able to discharge their duties with an unparalleled degree of trust in their environment, while saving on hardware spending and improving their work-flow.”

CMMI Level 3 Certification

In late 2019, our Cross Domain Virtualization Solutions (CDVS) Group was appraised at level 3 by the Capability Maturity Model Integration (CMMI) Institute. CMMI is a process improvement approach that provides organizations with the essential elements of effective processes that ultimately improve their performance. This achievement is a result of the hard work of AIS employees, as well as a strategic partnership with Broadsword Solutions, a leader in performance innovation and process improvement.

A Growing Team

In April of 2019, the SecureView team moved into a new office space. They did not move very far, however. Much of the team now sits just across the street from the headquarters in Rome, New York. The move allows the team to utilize the new lab space and be in an environment that will continue to foster growth.

“We have a dedicated training room to support our monthly SecureView training classes without having to setup the equipment and tear it down each time,” said Stein. “We also have a large raised-floor test lab which will support testing, customer specific engineering, troubleshooting and support. There is a conference room with VTC capability, so we can easily meet with our remote employees and customers, which is extremely important to us.”

“The SecureView team is close knit and friendly, we share common interests and truly enjoy working together,” said Criscolo. “On top of this, I feel as though my team can accomplish anything, so there’s this incredible empowerment and privilege that comes with steering such a talented team and being a part of their growth.”

*SecureView® is a registered trademark of the United States Air Force

Want to Learn More?

Visit our SecureView page to get more information

SECUREVIEW