ICS vulnerability disclosures increase as cyberattacks intensify

A new report released by cybersecurity company Claroty indicates an increase in companies disclosing the vulnerabilities of their industrial control systems (ICS), as well as increased cyberattacks on critical infrastructure.

The increase in cyberattacks is due to attackers being innovative in the ways in which they are launching attacks on critical infrastructure. Moreover, companies are finding it difficult to efficiently secure their infrastructure and systems as digitalisation increases, according to the report.

Amir Preminger, vice president of research at Claroty, said: “As more enterprises are modernizing their industrial processes by connecting them to the cloud, they are also giving threat actors more ways to compromise industrial operations through ransomware and extortion attacks.”

However, industrial enterprises have also elevated ICS security to a mainstream issue, and the increase in ICS vulnerability disclosures shows a willingness by global enterprises to play a key role in sharing best cybersecurity practices and contributing to the development of modern security standards that can match the changing nature of attacks, states the report.

Have you read?
Portland State to lead Pacific Northwest cyber threat initiative
Digitalising Europe’s energy sector – a proposed action plan

The Biannual ICS Risk & Vulnerability report has found a 41% increase in ICS vulnerabilities disclosed in the first half of 2021 compared to the previous six months. In 2020, reporting increased by 25% from 2019 and 33% from 2018.

Other key findings of the report include:

• ICS vulnerability disclosures are accelerating significantly. Some 637 ICS vulnerabilities were disclosed in 1H 2021, a 41% increase from the 449 vulnerabilities disclosed in 2H 2020.
• 71% of the vulnerabilities are classified as high or critical, reflecting the high severity and impactful nature of the exposures and their potential risk to operations.
• 90% have low attack complexity, meaning they do not require special conditions and an attacker can expect repeatable success every time.
• 74% do not require privileges, meaning the attacker is unauthorised and does not require any access to settings or files, and 66% do not require user interaction, such as opening an email, clicking on links or attachments, or sharing sensitive personal or financial information.
• 61% are remotely exploitable, demonstrating the importance of securing remote connections and Internet of Things (IoT) and Industrial IoT (IIoT) devices.
• 65% may cause total loss of availability, resulting in denial of access to resources.
• The top mitigation steps noted in ICS-CERT alerts and vendor advisories include network segmentation (applies to 59% of vulnerabilities), secure remote access (53%), and ransomware, phishing, and spam protection (33%).

Preminger, added: “The recent cyber attacks on Colonial Pipeline, JBS Foods, and the Oldsmar Florida water treatment facility have not only shown the fragility of critical infrastructure and manufacturing environments that are exposed to the internet, but have also inspired more security researchers to focus their efforts on ICS specifically.”

Find out more about the report.