Norsk Hydro Security Incident

08/04/2019 How Norsk Hydro gave a masterclass in crisis communications Norsk Hydro is a global supplier of aluminium and aluminium products. It's anenterprise that employs 35,000 people across 40 countries. On Tuesday the 19th of March it suffered a cyber attack. Its too early to put an exact figure on it, but Norsk Hydro is estimated to have lost at least $40 million, from lost margins and volumes in the Extruded Solutions business area. Longer term costs are hard to measure - whether Norsk Hydro loses future earnings and suffers from reputational damage is yet to be seen. But in the days that followed the attack, Norsk Hydro gave a masterclass in Cyber Incident Response and crisis communications. LockerGoga Ransomware The attack came in the form of LockerGoga; ransomware that has been infecting industrial engineering and manufacturing businesses. French engineering company Altran suffered a similar attack in January 2019. There are four key stages of Cyber Incident Response: Identify Isolate & Contain Rectify Communicate Ransomware incidents demand swift action to Isolate & Contain to limit spread and speed up recovery. Crypto vs Locker Ransomware There are two strands of ransomware crypto-ransomware and locker-ransomware. The former encrypts user data. The latter lock users out of systems (some types will do both). Targeted vs Mass Ransomware attacks There are also two broad types of attack those that target specific organisations and mass-scale attacks. These work in the same way that businesses either target a mass market with a low cost product vs a more valuable niche (think Vauxhall vs Rolls Royce). Mass-scale attacks usually use a phishing email sent to a large number of email addresses that havent necessarily been specifically selected. The ransom cost is typically low (hundreds or thousands of pounds) because so many organisations will pay. Targeted attacks demand much higher ransoms (perhaps hundreds of thousands of pounds). This higher...

... (truncated for display)