We’re Tracking the Future of Security

Category: Cyber-Physical Security

Coverage of the convergence between IT/cybersecurity and physical security systems, including networked device risk, secure system integration and unified threat response.

  • Google Cloud Publishes Secure Agentic AI Blueprint for Manufacturing

    Google Cloud Publishes Secure Agentic AI Blueprint for Manufacturing

    Google Cloud has published a blueprint for deploying agentic artificial intelligence in manufacturing while preserving physical safety, operational resilience and human authority. The framework addresses agents that can move beyond analysis to plan tasks or propose actions across enterprise, engineering and plant-floor workflows.

    Three connected operating domains

    The blueprint groups opportunities into business operations, engineering and industrial operations, and unified cybersecurity and resilience. Examples include procurement checks, predictive-maintenance analysis and the triage of security telemetry across IT and operational technology. Google emphasizes targeted pilots, data readiness, governance and access controls rather than unrestricted deployment.

    That distinction matters because an error in a factory can have physical consequences. An agent that summarizes maintenance records presents a different risk from one that can change a production schedule or interact with control infrastructure. The latter requires constrained permissions, tested rollback paths and a human decision point for consequential actions.

    Security architecture before scale

    Manufacturers should separate deterministic control from experimental AI services, validate data flows and monitor agent activity as a privileged workload. Digital twins and isolated environments can support testing without exposing production equipment. The blueprint reinforces a wider industrial monitoring principle: faster automation is valuable only when teams can explain, authorize and reverse its actions.

    Sources

  • HKCERT Warns VPNs, Firewalls and Remote Access Devices Face Rising Attacks

    HKCERT Warns VPNs, Firewalls and Remote Access Devices Face Rising Attacks

    Hong Kong’s computer emergency response team is warning organizations that VPN appliances, firewalls, routers and remote-access systems remain high-value entry points for attackers. The guidance, issued on 15 September and reported by Industrial Cyber, stresses that installing a patch does not prove an already-exposed device is clean.

    Why patching may be only the first step

    An attacker can exploit an edge device before remediation, steal credentials, create an account or establish another persistence mechanism. Closing the original vulnerability does not automatically remove those access paths. HKCERT therefore recommends reviewing accounts, active sessions, privilege changes, logs and suspicious data transfers after patching, particularly when a vulnerability is known to have been exploited.

    The issue matters in industrial environments because remote-access systems often bridge corporate and operational networks. An edge compromise can expose credentials or routes that would otherwise remain unavailable from the public internet. Asset owners need an accurate inventory of external interfaces, including systems installed by contractors or retained after projects end.

    Operational response

    Defenders should prioritize exploited vulnerabilities, enforce multifactor authentication, revoke suspect sessions and investigate for unauthorized accounts or backdoors. Monitoring should continue after the immediate incident. These measures fit a broader cyber-physical security program that treats identity, network architecture and recovery planning as connected controls.

    Sources

  • Google Says Gemini Security Test Reached Three Companies’ Systems

    Google Says Gemini Security Test Reached Three Companies’ Systems

    Google has disclosed that a security assessment involving Gemini reached systems belonging to three companies after test infrastructure was associated with domains the researchers did not actually control. The event was part of an authorized evaluation, but it demonstrates how autonomous or highly assisted testing can move beyond its intended boundary when scope assumptions are wrong.

    A scoping failure, not an AI permission model

    Reporting by The Record and The Hacker News says the test environment treated certain domains as controlled assets. Gemini then followed the available paths and interacted with external systems. Google said it contained the activity and contacted affected organizations. The episode is a reminder that a model can obey its task while still producing an unsafe result if inventory and ownership data are inaccurate.

    Traditional penetration tests already require written scope, target validation and stop conditions. Agentic tooling increases the need for those controls because it can enumerate and act faster than a human tester. Domain ownership should be verified immediately before execution, and high-impact actions should require an independent approval step.

    Lessons for production AI

    Security teams should place agentic test systems inside constrained networks, maintain explicit allowlists and log every action. A kill switch is useful only if operators can see that a boundary has been crossed. The incident also reinforces the value of separating simulation from live infrastructure when evaluating emerging security technologies.

    Sources

  • TASK#STOMP Backdoor Steals Wi-Fi Credentials, Screenshots and Business Files

    TASK#STOMP Backdoor Steals Wi-Fi Credentials, Screenshots and Business Files

    Security researchers have described a Windows backdoor tracked as TASK#STOMP that uses PowerShell to collect sensitive information from compromised computers. Reported capabilities include stealing stored Wi-Fi credentials, capturing screenshots and clipboard data, and searching for business documents that may be useful for espionage or follow-on intrusion.

    Living-off-the-land tradecraft

    According to Securonix research summarized by Help Net Security, the operation relies heavily on native Windows components and scripted execution. That approach can reduce the number of obvious malicious binaries placed on disk. The backdoor also uses scheduled-task behavior for persistence, giving defenders a reason to examine task creation and modification alongside PowerShell logging.

    The collection profile is notable because it combines access information with operational context. Wi-Fi credentials can help an attacker understand trusted networks, while screenshots and clipboard captures may reveal session tokens, internal tools or information that users never intended to save as files. Document discovery then broadens the impact beyond the initially compromised endpoint.

    Defensive implications

    Organizations should monitor suspicious PowerShell ancestry, encoded or unusual command lines, new scheduled tasks and unexpected access to credential stores. Endpoint telemetry should be correlated with identity and network events rather than reviewed in isolation. This is especially important where office networks connect to cyber-physical systems, because stolen administrative credentials can create a path toward operational environments.

    Sources

  • Security System Log Retention and Forensic Readiness

    Security System Log Retention and Forensic Readiness

    After a security incident, teams often discover that the decisive event existed in a log that was overwritten, stored on a failed appliance or timestamped differently from the video. Forensic readiness means planning evidence collection before an incident so that investigators can reconstruct events without relying on memory or incomplete exports.

    Identify the evidence sources

    Relevant records can include access grants and denials, door-forced events, alarm acknowledgements, camera health, video exports, administrator logins, configuration changes, intercom calls, visitor transactions, network authentication, firewall decisions and time-service status. Document where each source is stored and who can retrieve it.

    Synchronize time

    Correlation is unreliable when devices use different clocks or time zones. All systems should use approved time sources, record time-zone context and alert when synchronization fails. SectechMedia’s guide to NTP in physical security systems explains why consistent time is an evidentiary requirement, not a cosmetic setting.

    Choose retention by purpose

    A single retention period rarely fits every record. Consider detection delays, investigation timelines, regulatory duties, contractual requirements, storage cost and privacy. High-volume operational telemetry may have a shorter online period than privileged-access and configuration logs. Retention should be documented and enforced automatically.

    Protect integrity and availability

    Logs stored only on the device being investigated can be altered or lost with it. Forward important records to controlled storage with restricted administration, monitoring and backups. Use hashing or immutable storage where justified, but do not treat a technology label as proof; validate permissions, export procedures and restoration.

    Reduce unnecessary sensitive data

    More logging is not always safer. Avoid collecting full credentials, unnecessary personal data or unrestricted audio when a less intrusive event record will meet the purpose. Document access to investigative logs and separate security monitoring from broad employee surveillance. Retention and deletion should follow approved policy rather than the capacity of the storage platform.

    Monitor the logging pipeline

    A silent collector failure can erase evidence for days. Monitor source connectivity, ingestion delay, storage capacity and parsing errors. Alert when a normally active source stops sending events. Keep enough local buffering to survive a temporary network outage, and test whether buffered records retain their original timestamps when forwarded later.

    Prepare an evidence workflow

    1. Define who may authorize collection.
    2. Record the source, date range, tool and operator.
    3. Preserve original exports and calculate integrity hashes.
    4. Work from verified copies.
    5. Maintain chain-of-custody records.
    6. Document gaps, clock drift and uncertain interpretations.

    Test the plan

    Run exercises that ask a realistic question: who opened a door before a camera stopped recording, which administrator changed the rule, and can the team prove the sequence? The exercise should include retrieval from backup and comparison with the video evidence chain-of-custody process.

    Conclusion

    Forensic readiness converts routine logs into dependable evidence. It depends on synchronized time, intentional retention, protected storage and a collection process that can be explained later.

    Reference sources

  • Asset Inventory and Configuration Management for Electronic Security Devices

    Asset Inventory and Configuration Management for Electronic Security Devices

    Electronic security estates grow one project at a time. Cameras, readers, intercoms, sensors, recorders and gateways are added by different contractors and may remain in service for many years. Without a reliable inventory, teams cannot know what needs patching, what depends on an obsolete server or which failure will create a blind spot.

    What the inventory should contain

    Each record should identify the asset type, manufacturer, model, serial number, physical location, owner, installer, network identifiers, firmware and software versions, support status, warranty, configuration backup location and operational role. It should also show upstream power and network dependencies and the business consequence of failure.

    Use stable identifiers

    Names such as Camera 12 become ambiguous after renovations. A stable asset identifier should remain attached to the device record even when its hostname, IP address or display label changes. Floor plans, rack diagrams, maintenance tickets and monitoring platforms should reference the same identifier.

    Track configuration as controlled data

    The inventory states what exists; configuration management records how it is intended to operate. Maintain approved baselines for network settings, user roles, recording profiles, door schedules, alarm rules and integrations. Sensitive exports must be encrypted and access-controlled because they can reveal credentials, topology and security coverage.

    Discover and reconcile

    Automated discovery can find network-connected assets, but active scanning may disrupt fragile devices. Combine safe discovery, switch and DHCP data, controller exports and physical verification. Differences between observed and approved state should create a review task rather than being silently overwritten.

    Control installation and retirement

    Inventory quality is usually lost at the project boundary. Require installers to provide final device schedules, firmware versions, credentials handover, licenses and tested configuration backups before acceptance. At retirement, remove network access, certificates, cloud registrations and monitoring rules, then record disposal or secure reuse. A device that has been physically removed but remains trusted in software is still an exposure.

    Measure inventory quality

    Useful measures include devices without owners, unsupported firmware, missing configuration backups, unknown network locations and records not reviewed on schedule. Trend the exceptions by site and system owner. A rising asset count with a stable number of unknowns can represent improvement, while a perfect dashboard built from stale records cannot.

    Link inventory to lifecycle decisions

    Firmware advisories and end-of-support notices become actionable only when affected models can be located quickly. The same records support commissioning, spares planning, license renewal and replacement budgets. During changes, the inventory should also reflect redundancy and recovery relationships described in security network failover planning.

    Minimum operating process

    1. Assign an owner for the authoritative inventory.
    2. Require updates during installation, moves and decommissioning.
    3. Reconcile automated and physical evidence on a defined schedule.
    4. Review unsupported and internet-exposed assets first.
    5. Preserve approved configuration backups and test restoration.
    6. Measure unidentified devices and overdue reviews.

    Conclusion

    An inventory is useful only when it supports decisions. The objective is not a perfect spreadsheet; it is the ability to locate risk, understand dependencies and restore known-good operation without guessing.

    Reference sources

  • Secure Remote Maintenance for Physical Security Systems

    Secure Remote Maintenance for Physical Security Systems

    Remote maintenance reduces travel time and lets specialists diagnose cameras, access-control panels, fire interfaces and security servers quickly. It can also create a durable path around the very controls the system is meant to enforce. A safe design treats every remote session as temporary privileged access, not as a convenience feature left permanently exposed.

    Know every remote path

    Start with an inventory of vendor portals, VPNs, remote desktop tools, cloud relays, cellular modems and undocumented support accounts. A firewall rule is not the only path into a system. Appliances may initiate outbound tunnels, and integrators may install support software outside the formal architecture.

    Use controlled access

    Remote maintenance should pass through an approved gateway with multifactor authentication, named accounts and role-based authorization. Shared vendor credentials make attribution difficult and should be removed. Access should be enabled for an approved window, limited to the required assets and disabled automatically when work ends.

    Separate maintenance from daily operation

    Management interfaces belong on protected networks, not on the same unrestricted segment as user devices or public services. Jump hosts can enforce inspection and recording while reducing direct exposure. Where equipment cannot support modern authentication, compensating controls around the device become essential.

    Protect availability

    A maintenance session can interrupt recording, door decisions or alarm communications even without malicious intent. Changes should follow an approved plan with a rollback path, local operational contact and defined stop conditions. Redundancy should be tested rather than assumed; see the guide to network redundancy for IP security systems.

    Log and review the session

    Record who requested access, who approved it, the target systems, start and end times, commands or configuration changes, files transferred and the final result. Logs should be protected from alteration and correlated with system events. Screen recording may be appropriate for high-consequence systems, subject to privacy and contractual controls.

    Plan emergency access

    Emergency maintenance cannot become an excuse for permanent administrator access. Define a break-glass process with strong authentication, limited duration and immediate post-session review. If the primary gateway is unavailable, the fallback method should be documented and tested without exposing a direct public interface. Local staff must know how to terminate a session that begins to affect safety or availability.

    Vendor governance questions

    • Can support access be disabled locally?
    • Does the vendor require unique accounts and multifactor authentication?
    • Where are session logs stored and for how long?
    • Can access be restricted by asset and time window?
    • How are emergency sessions approved?
    • What happens when the support contract ends?

    Conclusion

    Remote maintenance is safest when it is visible, temporary and fully attributable. Organizations should be able to prove that a vendor reached only the intended system, performed approved work and lost access when the task ended.

    Reference sources

  • Arcjet Launches Runtime Security Controls for Production AI Agents

    Arcjet Launches Runtime Security Controls for Production AI Agents

    Arcjet has launched a runtime security product designed to monitor and govern artificial-intelligence agents while they execute production workflows. The service creates an execution record and returns policy decisions before selected protected actions are allowed to continue.

    Developers can use those decisions to block an operation or require human approval. Arcjet says available controls include usage limits, automation detection, prompt-injection screening and measures intended to prevent or redact exposure of personally identifiable and other sensitive information.

    The product addresses a gap between pre-deployment model testing and live operational behavior. An agent may call tools, retrieve data and trigger business processes in combinations that are difficult to predict from static testing alone. Runtime controls can reduce that uncertainty, but their effectiveness depends on how comprehensively protected actions are instrumented and whether bypass paths remain in production environments.

    Why it matters

    AI-agent security increasingly resembles privileged-access and transaction monitoring: high-impact actions need explicit policy, traceable decisions and a reliable human escalation path. The same principle applies when AI is connected to physical-security workflows and command-and-control platforms, where an automated action can have physical consequences.

    Sources

  • CISA Publishes Cyber Decoy Guidance for Critical Infrastructure Defenders

    CISA Publishes Cyber Decoy Guidance for Critical Infrastructure Defenders

    The U.S. Cybersecurity and Infrastructure Security Agency has released its first detailed guide to designing and operating cyber decoys for critical infrastructure environments. The approach places realistic but controlled systems and information assets inside a network so that attempts to access them can generate high-confidence evidence of malicious activity.

    CISA said decoys can help expose attackers who use stolen credentials, legitimate administration tools and living-off-the-land techniques that may bypass conventional perimeter controls. The guide aligns implementation with the MITRE ATT&CK knowledge base and MITRE Engage framework, and treats decoys as a complement to zero-trust controls rather than a replacement for asset management, identity security or monitoring.

    The agency recommends planning decoys around likely adversary paths and high-value areas, then integrating the resulting alerts into established investigation and response procedures. Organizations must also prevent a decoy from becoming a pivot point and ensure its data does not create privacy or operational risk.

    Why it matters

    Critical infrastructure defenders often face weak signals from legitimate-looking activity. Properly isolated decoys can give operations teams an earlier, higher-confidence warning that an intruder is moving through the environment. That makes them relevant to the broader task of risk-based security planning.

    Sources

  • CISA Cyber Storm X Tests National Response to Critical Infrastructure Attacks

    CISA Cyber Storm X Tests National Response to Critical Infrastructure Attacks

    The U.S. Cybersecurity and Infrastructure Security Agency completed Cyber Storm X, a four-day national exercise that brought together 2,000 participants from more than 200 public- and private-sector organizations. CISA said the tenth exercise in the 20-year Cyber Storm program tested how government and industry would coordinate during a large cyber incident affecting essential services.

    The 2026 scenario centered on a nation-state adversary targeting transportation systems, including rail and ports, alongside the water and wastewater sector. Participants used the exercise to test incident-response plans, information-sharing arrangements and cross-sector coordination without exposing operational systems to a live attack.

    CISA said it will work with the participating organizations to identify lessons and produce a public after-action report. The exercise is intended to expose gaps in plans and decision-making before a real event forces agencies, infrastructure operators and suppliers to coordinate under pressure.

    Why it matters

    Cyber resilience depends on more than defensive products. Large exercises test whether technical teams, executives, regulators and emergency partners can share reliable information and make coordinated decisions while transportation and water services are under stress.

    Sources