Armis, a leading asset visibility and security company, recently released new research identifying the riskiest devices that pose threats to the key critical infrastructure industries of manufacturing, utilities and transportation. Data analyzed from the Armis Asset Intelligence and Security Platform, which tracks over 3 billion assets, found that the operational technology (OT) and industrial control systems (ICS) devices that present the highest risk to these industries are engineering workstations, supervisory control and data acquisition (SCADA) servers, automation servers, historians and programmable logic controllers (PLCs).
Prioritization and vulnerability management remains an issue
Armis research found that engineering workstations are the OT device that received the most attempts of attack in the industry in the past two months, followed by SCADA servers. Fifty-six percent of engineering workstations have at least one unpatched critical severity common vulnerabilities and exposures (CVEs), and 16% are susceptible to at least one weaponized CVE, published more than 18 months ago.
Uninterruptible power supplies (UPS) are the third device type that suffered the most attack attempts in the past two months. Although critical for continuity in an event of power outage, data showed that 60% of UPS devices have at least one unpatched critical severity CVE, which, as we saw with TLStorm, could potentially lead criminals to cause physical damage to the device itself or other assets connected to it.
PLCs are another example, with 41% having at least one unpatched critical severity CVE. These legacy devices are of high importance as they could lead to the disruption of central operations if attacked, but the research highlighted they can be susceptible to high risk factors such as end of support hardware and end of support firmware.
A set of additional devices represent risk to manufacturing, transportation and utilities environments as they had at least one weaponized CVE published before January 2022: 85% of barcode readers, 32% of industrial managed switches, 28% of IP cameras and 10% of printers.
OT industries are characterized by having multiple locations, multiple lines of production and complex distribution lines with a vast amount of both managed and unmanaged devices on their networks. In that context, understanding where risk comes from and where remediation is needed presents a significant challenge and can be an obstacle to vulnerability management, posing an entry point for malicious actors.
“In an ICS environment, it’s pretty common to have vulnerable devices, so professionals need to see what assets are on their network and additional intelligence on what those devices are actually doing,” said Nadir Izrael, CTO and co-founder of Armis. “Contextual data will enable teams to define what risk each device poses to the OT environment so that they can prioritize remediation of critical and/or weaponized vulnerabilities to quickly reduce the attack surface.”
There is need for collaboration between OT and IT teams
OT industries have significantly changed in the past years due to the convergence of OT and information technology (IT). This alignment is driving a new phase for the industrial era and will enable cross-domain collaboration but, in practice, unified management of both environments has yet to take place. With OT teams focused on maintaining industrial control systems, mitigating risks to OT and ensuring overall integrity within operational environments, more IT-focused duties have been left aside.
Four out of the five riskiest devices notably run Windows operating systems, showcasing how a basic understanding of asset risk and securing vulnerable assets is still a challenge for IT and OT teams.
Armis looked at device types and found that many are more exposed to malicious activity because they are using the SMBv.1 protocol, end of support operating systems and many open ports. SMBv.1 is a legacy, unencrypted and complicated protocol with vulnerabilities that have been targeted in the infamous Wannacry and NotPetya attacks. Security experts previously advised organizations to stop using it completely, but the data shows it is still preeminent in the field.
“From an organizational perspective, having a risk-based approach to vulnerability management must go hand in hand with OT and IT departments working together to help coordinate mitigation efforts,” continued Izrael. “Cross-departmental projects will help streamline process and resource management and achieve greater compliance and data security. Overall, to navigate the challenges of the new industrial era, security professionals need an IT/OT convergence security solution that shields all assets connected to the network.”
Study methodology
Armis calculated device risk by looking at all devices on the Armis Asset Intelligence and Security Platform and identifying which types have the highest-severity risk factor and/or common vulnerabilities and exposures (CVEs). Additionally, business impact level and endpoint protections had a weighted influence.
Original content can be found at Armis.
Do you have experience and expertise with the topics mentioned in this article? You should consider contributing content to our CFE Media editorial team and getting the recognition you and your company deserve. Click here to start this process.
