Internet exposure of operational technology (OT) and industrial control systems (ICS) continues to be a critical infrastructure security issue despite decades of raising awareness, new regulations, and periodic government advisories. This is according to the Forescout ‘Better Safe Than Sorry’ report, a seven-year analysis of Internet-exposed OT/ICS data.
A study for the report was conducted by Forescout Research – Vedere Labs, a leading global team dedicated to uncovering vulnerabilities in and threats to critical infrastructure.
In the report, Forescout researchers examine the realistic opportunities for a mass target attack of Internet-exposed OT/ICS devices. These devices are fertile ground for abuse as attackers look no further than using basic rationale driven by current events, copycat behavior, or the emergencies found in new, off-the-shelf capabilities or readily available hacking guides to create chaos, says Forescout.
If these warnings sound familiar, it’s because they are. The looming potential for a mass target scenario is high. Forescout calls on vendors, service providers, and regulatory agencies to work collectively to prevent attacks on critical infrastructure that will spare no one.
Elisa Costante, VP of Research at Forescout Research – Vedere Labs.
Key findings in the report include:
North America is making strides to close the gap, but there is still work to do around the world. The US and Canada significantly reduced the number of exposed devices during the study period by 47% in the US and 45% in Canada. The other top 10 countries increased the number of exposed devices as follows: Spain: 82%, Italy: 58%, France: 26%, Germany: 13%, Russia: 10%.
Proactive, targeted notification is urgently required. The Unitronics hacking incidents and a combination of regulatory alerts and media coverage led to a 48% reduction in Internet exposed Unitronics PLCs within two months. Notably, the decline in Unitronics device exposure in Israel started in early as 2022, coinciding with the initial reports of attacks on these devices. Conversely, in the United States, the decrease only began towards the end of 2023, following more recent attacks.
Robust risk management strategies are critical. Many Internet-exposed OT devices and protocols stem from common system integrator practices, such as delivering pre-packaged units that act as black boxes to asset owners and inadvertently expose multiple systems to the Internet. Most asset owners are unaware that these packaged units contain exposed OT devices. This underscores the need for a precise and detailed software and hardware bill of materials as a critical part of a comprehensive risk management approach.
Nearly half of the reported ports remain vulnerable to attack. After incidents targeting Modicon and Wago PLCs, Forescout researchers reexamined these exposed devices one year after reporting some to CISA. Approximately half of the reported PLCs retained the same open ports without any alterations or protective measures. Thirty percent were no longer exposed to the Internet, while the remaining 20% remained exposed, but had closed the OT port under scrutiny. Still, some FTP and web interfaces were occasionally left vulnerable. Good news, there are now less than 1,000 exposed devices running Nucleus and approximately, 5,500 running NicheStack. This is a significant reduction after the exposure was revealed in the original Forescout research in Project Memoria.
Many asset owners are unaware that OT/ICS systems contain potentially vulnerable devices exposed to the Internet, once again highlighting the need for an accurate and granular software and hardware bill of materials as part of a comprehensive risk management strategy.
