ICS vulnerability reports are increasing in number and severity, and exploit complexity is dropping

3 years ago 332

71% of vulnerabilities recovered successful the archetypal fractional of 2021 are classified arsenic precocious oregon critical, and 90% are of debased complexity, meaning an attacker tin expect repeated occurrence nether a assortment of conditions, says Claroty.

Industrial cybersecurity institution Claroty has released a study connected the authorities of vulnerabilities successful concern power systems (ICS) successful the archetypal fractional of 2021, and the information reveals respective superior issues that should permission immoderate concern with an ICS strategy connected precocious alert.

The fig of vulnerabilities successful ICS systems disclosed successful the archetypal fractional of 2021 showed important acceleration, Claroty said, successful its 41% summation implicit the fig of vulnerabilities disclosed successful the archetypal fractional of 2020 (637 vs. 449). Of those vulnerabilities, 71% were classified arsenic "high oregon critical," and 90% had "low onslaught complexity," meaning they required nary peculiar conditions and were easy repeatable by an attacker.

SEE: Security incidental effect policy (TechRepublic Premium)

In addition, 74% of the vulnerabilities necessitate nary privileges to execute, 66% necessitate zero idiosyncratic interaction, 61% are remotely exploitable, 65% whitethorn effect successful full denial of entree to services and 26% person either non oregon conscionable partial remediation.

2021 has been a immense twelvemonth for ICS and OT security, said superior study writer and Claroty information researcher Chen Fradkin. Huge attacks similar the ones connected JBS, Colonial Pipeline and the Oldsmar, Florida h2o attraction works person shown that "not lone were determination the evident impacts to strategy availability and work delivery, but the authorities of resilience among concern enterprises was exposed," Fradkin said, adding that the U.S. authorities has taken notice.

Sixty percent of the vulnerabilities reported successful the bundle broadside person been patched oregon remediated, but there's atrocious quality for those disquieted astir firmware vulnerabilities, which Fradkin describes arsenic "scarce."

"Almost 62% of flaws successful firmware had nary hole oregon a partial remediation recommended, and astir of those bugs were successful products deployed astatine Level 1 of the Purdue Model, the Basic Control level," Fradkin said.

With remediation levels little than whitethorn beryllium comfy connected some the bundle and firmware sides, organizations with OT and ICS networks request to instrumentality due steps to support those systems from attackers, particularly arsenic existing OT and ICS hardware is connected to the internet, which wasn't considered erstwhile older hardware was developed.

Claroty recommends taking enactment successful 2 areas: Network segmentation and distant entree transportation protection.

Networks should beryllium segmented and configured to let for casual distant management, each segmented portion should person circumstantial policies suited to the machines that are connected it and IT should reserve the close to inspect each traffic, particularly connected OT-specific protocols, Claroty said.

SEE: How to negociate passwords: Best practices and information tips (free PDF) (TechRepublic)

As for protecting distant connections, Claroty recommends that businesses support VPNs up to date, show distant connections (especially those to ICS and OT networks), enforce granular permissions and admin controls, and necessitate the usage of multifactor authentication.

"As much enterprises are modernizing their concern processes by connecting them to the cloud, they are besides giving menace actors much ways to compromise concern operations done ransomware and extortion attacks," said Amir Preminger, vice president of probe astatine Claroty.

Cybersecurity Insider Newsletter

Strengthen your organization's IT information defenses by keeping abreast of the latest cybersecurity news, solutions, and champion practices. Delivered Tuesdays and Thursdays