Industrial control system (ICS) vulnerabilitydisclosures are drastically increasing as high-profile cyber attacks oncritical infrastructure and industrial enterprises have elevated ICS securityto a mainstream issue, according to the third Biannual ICS Risk & Vulnerability Reportreleased today byClaroty,the industrial cybersecurity company. The report shows a 41% increase in ICSvulnerabilities disclosed in the first half (1H) of 2021 compared to theprevious six months, which is particularly significant given that in all of2020 they increased by 25% from 2019 and 33% from 2018.

The report provides a comprehensive analysis of ICSvulnerabilities publicly disclosed during 1H 2021, including those found byClaroty’s award-winning research team,Team82,and those from trusted open sources including the National VulnerabilityDatabase (NVD), the Industrial Control Systems Cyber Emergency Response Team(ICS-CERT), CERT@VDE, MITRE, and industrial automation vendors SchneiderElectric and Siemens.

“As more enterprises are modernizing their industrialprocesses by connecting them to the cloud, they are also giving threat actorsmore ways to compromise industrial operations through ransomware and extortionattacks,” said Amir Preminger, vice president of research at Claroty. “Therecent cyber attacks on Colonial Pipeline, JBS Foods, and the Oldmsar, Floridawater treatment facility have not only shown the fragility of criticalinfrastructure and manufacturing environments that are exposed to the internet,but have also inspired more security researchers to focus their efforts on ICSspecifically. This is exactly why we are committed to helping the industry atlarge gain a deep understanding of the risks facing industrial networks and howto mitigate them with this report.”

Key Findings

●       ICS vulnerability disclosures are accelerating significantly, shining a light on the magnitude of security flaws that are justnow being discovered in operational technology (OT) environments. 637 ICSvulnerabilities were disclosed in 1H 2021, a 41% increase from the 449vulnerabilities disclosed in 2H 2020. 81% of those were discovered by sourcesexternal to the affected vendor, including third-party companies, independentresearchers, academics, and other research groups. Additionally, 42 newresearchers reported vulnerabilities.

●       71% of the vulnerabilities are classified as high or critical, reflecting the high severity and impactful nature of the exposuresand their potential risk to operations.

●       90% have low attack complexity, meaningthey do not require special conditions and an attacker can expect repeatablesuccess every time.

●       74% do not require privileges, meaningthe attacker is unauthorized and does not require any access to settings orfiles, and 66% do not require userinteraction, such as opening an email, clicking on links or attachments, orsharing sensitive personal or financial information.

●       61% are remotely exploitable, demonstratingthe importance of securing remote connections and Internet of Things (IoT) andIndustrial IoT (IIoT) devices.

●       65% may cause total loss of availability, resulting in denial of access to resources.

●       26% have either no available fix or only a partial remediation, highlighting one of the key challenges of securing OT environmentscompared to IT environments.

●       The top mitigation steps noted inICS-CERT alerts and vendor advisoriesinclude network segmentation (applies to59% of vulnerabilities), secure remote access (53%), and ransomware, phishing,and spam protection (33%).

●       Claroty’s Team82 remains the market leader in ICS vulnerabilityresearch, having disclosed 70 vulnerabilities in 1H2021 and over 150 vulnerabilities to date, all of which can be found in theTeam82Vulnerability Dashboard.

To access the complete set of findings, in-depthanalysis, and additional steps to defend against improper access and risks,download the Claroty Biannual ICS Risk & Vulnerability Report: 1H2021.

‍