The Vulnerable Backbone: Cyber Threats to Critical Infrastructure Devices

100,000 Industrial Control Systems Exposed to Internet, Posing Significant Cybersecurity Risk

Introduction

A recent analysis conducted by cyber-risk handicapper Bitsight revealed that there are at least 100,000 industrial control systems (ICS) exposed to the public Internet worldwide. These systems play a critical role in controlling operational technologies (OT) such as power grids, water systems, and building management systems (BMS). While the large number of exposed ICS devices is alarming, the true cyber-risk associated with this exposure lies in the protocols used by these systems.

The Risk Landscape

Bitsight’s analysis found that the exposed ICS footprint represents an attractive target for cyber attackers, posing a global risk to physical safety in at least 96 countries. Incidents like the Colonial Pipeline hack and malware designed to subvert power grids highlight the real-world impact that such cyberattacks can have. Disruption of ICS systems can result in significant business disruption, threats to human safety, data and intellectual property compromise, national security threats, and more.

Protocol Vulnerabilities

The use of different protocols in ICS environments is a crucial factor in determining cyber-risk. Some protocols lack basic security measures, leaving devices open to unauthorized access. Others provide attackers with valuable information about the brand, model, and version of a device, making the search for exploits easier. Furthermore, the adoption of different protocols indicates the presence of devices from various vendors and different software running within an organization’s exposed surface.

Geotargeting and Protocol-Specific Risks

Bitsight’s analysis also revealed that the concentration of exposed industrial control systems using specific protocols varies across different regions. For example, systems using CODESYS, KNX, Moxa Nport, and S7 are primarily found in the European Union (EU), while systems using ATG and BACnet are more common in the United States. Modbus and Niagara Fox, on the other hand, have a global presence. Understanding these protocol-specific risks allows organizations to tailor their security strategies and prioritize areas of vulnerability.

Industry 4.0 and Improved Security

Despite the alarming number of exposed ICS devices, it is worth noting that the level of exposure has actually decreased over time. Initiatives like CISA’s “Securing Industrial Control Systems: A Unified Initiative” and discussions within the security community have likely contributed to this trend. Additionally, the advent of Industry 4.0 has brought new technologies and more mature security programs, providing organizations with improved means to interact with and secure their ICS environments.

Improving ICS Security

To improve the security of their ICS environments, organizations can take several practical steps recommended by Bitsight:

Identify and Assess ICS Systems

Organizations should promptly identify and assess all ICS devices deployed within their infrastructure, as well as those used by third-party business partners. This comprehensive inventory will provide a clear understanding of the security posture and potential vulnerabilities.

Remove ICS from the Public Internet

There are typically no legitimate reasons for ICS devices to be directly reachable via the Internet. Organizations should ensure that all ICS systems are removed from the public Internet to minimize the risk of unauthorized access.

Employ Safeguards and Access Controls

Implementing safeguards such as firewalls and access controls is critical in preventing unauthorized access to ICS devices. Organizations should configure their systems to restrict access to authorized personnel only.

Recognize the Unique Control Needs of OT

Traditional IT risk models may not adequately address the unique security requirements of OT and ICS environments. Organizations should acknowledge the need for downtime in order to apply patches and updates to ICS systems, allowing for proper maintenance without compromising operational continuity.

Reduce Exposure

As a rule of thumb, organizations should aim to reduce the exposure of their ICS devices. Industrial control systems do not belong on the public Internet. Leveraging firewalls, access controls, virtual private networks (VPNs), and other mechanisms can significantly reduce the risk of unauthorized access.

Conclusion

The widespread exposure of industrial control systems to the Internet poses a significant cybersecurity risk, with the potential for severe consequences on physical safety, business operations, and national security. Organizations must prioritize the security of their ICS environments by implementing proactive measures to identify and mitigate vulnerabilities. The decreasing trend in ICS exposure indicates progress, but continued vigilance and adherence to best practices are essential to ensure the protection of critical infrastructure in the face of evolving cyber threats.