The latest report provides an assessment of Anonymous' capability to penetrate Industry Control Systems (ICS) and gain access to infrastructural networks, which follows up on a previous report that investigated the group's ability to develop new cyber attack tools.
However, the government's concern is that the simple capability of "recognizing and posting code", which Anonymous has done, for example, in the case of Siemens Simatic control software, "could gain the attention of those knowledgeable in control systems". However, at least in this unclassified report, there is no clear answer why the government believes that Anonymous appears to have increased interest in ICS, especially those that are tied to its "hacktivist" campaigns.
The report concludes:
"While Anonymous recently expressed intent to target ICS, they have not demonstrated a capability to inflict damage to these systems, instead choosing to harass and embarrass their targets using rudimentary attack methods, readily available to the research community. Anonymous does have the ability to impact aspects of critical infrastructure that run on common, internet accessible systems (such as web-based applications and windows systems) by employing tactics such as denial of service."
The advice to ICS owners is to make sure their security needs of their control system assets are addressed.
