When the risks of internet exposure and connectivity affect industrial control systems, entire cities and even nations can be disrupted.
As high-profile cyberattacks on critical infrastructure and industrial enterprises have elevated ICS security to a mainstream issue, Industrial Control System (ICS) vulnerability disclosures are drastically increasing.
This is what a biannual ICS risk and vulnerability report for H1 2021 by industrial cybersecurity firm Claroty is claiming. The report is based on data disclosed as follows: “our research team’s effort to define and analyze the vulnerability landscape relevant to leading automation products used across the ICS domain. Team82 delivers a comprehensive look at ICS vulnerabilities publicly disclosed during the first half of the year, including those found by Team82 and those found by affected vendors, independent security researchers, and experts inside other organizations.”
Based on this definition of their data set, the report shows a 41% increase in ICS vulnerabilities disclosed in the H1 of 2021 compared, compared to past years’ increases of 25% in 2019 and 33% in 2018.
Key findings
- 637 ICS vulnerabilities were disclosed in H1 2021, a 41% increase from the 449 vulnerabilities disclosed in H2 2020. 81% of those were discovered by sources external to the affected vendor, including third-party companies, independent researchers, academics, and other research groups. Additionally, 42 new researchers reported vulnerabilities.
- 71% of the vulnerabilities were classified as high or critical.
- 90% had low attack complexity, not requiring special conditions, and attackers could expect repeatable success.
- 74% did not require privileges, meaning the attacker was unauthorized and did not require any access to settings or files; 66% did not require user interaction, such as opening an email, clicking on links or attachments, or sharing sensitive personal or financial information.
- 61% were remotely exploitable, implicating IoT and IIoT devices.
- 65% may have caused total loss of system resource availability.
- 26% had either no available fix or only a partial remediation, pointing to one of the key challenges of securing OT environments compared to IT environments.
- Network segmentation (this applied to 59% of vulnerabilities), secure remote access (53%), and ransomware, phishing, and spam protection (33%) were top mitigation steps noted in ICS-CERT alerts and vendor advisories.
Said the firm’s Vice President of Research, Amir Preminger: “The recent cyberattacks on Colonial Pipeline, JBS Foods, and the Oldmsar, Florida water treatment facility have not only shown the fragility of critical infrastructure and manufacturing environments that are exposed to the internet, but have also inspired more security researchers to focus their efforts on ICS specifically.”
Preminger hoped that the report could help the industry at large gain a deep understanding of the risks facing industrial networks and to mitigate them.
