The Lingering Threat: Assessing the Decrease in Internet-Exposed ICS Devices

The Decrease in Internet-Exposed Industrial Control Systems (ICS)

A recent report from cybersecurity ratings company Bitsight has revealed that the number of internet-exposed industrial control systems (ICS) has dropped below 100,000 as of June 2023. This marks a significant decrease from the approximately 140,000 internet-exposed ICS observed in 2019. The report also highlights a decrease in exposed organizations, dropping from around 4,000 to 2,300 over the same period.

Positive Developments and Trend Analysis

Bitsight suggests that this decline in the number of exposed ICS can be attributed to organizations properly configuring, switching to other technologies, or removing previously exposed systems from the public internet. While actual numbers may vary depending on different methodologies employed by various organizations, it is noteworthy that the same company, Bitsight, has consistently tracked this trend. The report shows a gradual reduction in the number of internet-exposed ICS over the past few years.

Sector Analysis and Prevalent Protocols

The report indicates that the most impacted sectors by this decrease in exposed ICS include education, technology, government, business services, manufacturing, utilities, real estate, energy, tourism, and finance. The analysis also identifies the top ten countries with the highest number of exposed organizations as the United States, Canada, Italy, the UK, France, the Netherlands, Germany, Spain, Poland, and Sweden.

The report further highlights the prevalence of certain protocols in the exposed ICS systems. The most commonly observed protocols include Modbus, KNX, BACnet, Niagara Fox, Siemens’ S7, Ethernet/IP, Lantronix, Automatic Tank Gauge (ATG), Moxa’s NPort, and Codesys. The prevalence of certain protocols differs across sectors and regions. For example, BACnet, Niagara Fox, and Lantronix are typically used for building automation and physical security systems in the education sector, while Codesys, KNX, Nport, and S7 protocols are mainly found in the European Union, and ATG and BACnet are predominantly seen in the United States.

Importance of Internet Security for Industrial Control Systems

Though the decrease in the number of internet-exposed ICS is a positive development, it is important to recognize the potential risks associated with not properly securing these systems. Industrial control systems are crucial for the functioning of critical infrastructure, including energy, water, transportation, and manufacturing. Any compromise of these systems can have severe consequences, including physical damage, disruption of services, and even loss of life.

Organizations that still have public-facing ICS systems need to be especially vigilant in implementing robust security measures to protect against potential threats. Hackers and malicious actors are constantly evolving their tactics, and even a small number of exposed systems can provide opportunities for exploitation.

Developing an Effective OT/ICS Security Strategy

The Bitsight report emphasizes the need for organizations to adopt a proactive approach to OT/ICS security. It suggests that organizations should be aware of changes in the prevalence of protocols to inform their security strategies. By staying informed about the current landscape of exposed systems and the protocols most commonly targeted by attackers, organizations can make informed decisions on where to allocate their resources and implement appropriate security measures.

Organizations should consider the following steps to mitigate the risks associated with internet-exposed ICS:

1. Regular Vulnerability Assessments

Organizations should conduct regular vulnerability assessments to identify and address potential weak points in their ICS. This includes comprehensive vulnerability scanning and penetration testing to evaluate the security posture of their systems. Proactive identification of vulnerabilities allows organizations to remediate issues before they are exploited.

2. Secure Configuration and Access Controls

Proper configuration and access controls are crucial for securing ICS. Organizations should ensure that all systems are configured securely, including updating default passwords, disabling unnecessary services, and implementing strong access controls. This includes limiting access to critical systems and conducting regular audits to monitor and manage user permissions.

3. Continuous Monitoring and Threat Intelligence

Continuous monitoring of ICS networks is essential to detect and respond to any suspicious activity. Organizations should implement robust monitoring systems that can analyze network traffic and identify any anomalies or potential indicators of compromise. Additionally, leveraging threat intelligence feeds can provide real-time information about emerging threats and vulnerabilities specific to ICS.

4. Employee Training and Awareness

Organizations must invest in training and educating employees about the risks associated with ICS and the best practices for maintaining a secure environment. Employees should be aware of the potential threats they may encounter, such as social engineering tactics or phishing attempts, and be trained on how to identify and respond to these threats appropriately.

5. Collaboration and Information Sharing

Collaboration and information sharing between organizations, industry associations, and government entities are essential in combating ICS security risks. Sharing knowledge, best practices, and threat information can help organizations stay ahead of evolving threats and ensure a collective effort in securing critical infrastructure.

The Role of Governments and Policy-Makers

While organizations bear the primary responsibility for securing their ICS, governments and policy-makers also play a crucial role. They should establish comprehensive regulations and standards for ICS security, encouraging organizations to prioritize the protection of critical infrastructure. Governments should also invest in cybersecurity research and provide resources to support organizations in their efforts to secure their ICS systems. Additionally, international cooperation is necessary to address the global nature of cyber threats and promote information sharing to enhance collective defense against cyber attacks.

Conclusion

The decrease in the number of internet-exposed ICS represents a positive development in the security of critical infrastructure systems. However, organizations must remain vigilant and continue to prioritize the implementation of robust security measures to protect their ICS networks against emerging threats. By adopting a proactive and comprehensive approach to OT/ICS security, organizations can significantly reduce the risks associated with internet-exposed systems and ensure the integrity and availability of critical infrastructure.