Report from Claroty's Team82 shows most ICS vulnerabilities are classified as high or critical severity, have low attack complexity, are remotely exploitable, and may cause total loss of availability
NEW YORK – August 18, 2021 – Industrial control system (ICS) vulnerability disclosures are drastically increasing as high-profile cyber attacks on critical infrastructure and industrial enterprises have elevated ICS security to a mainstream issue, according to the third Biannual ICS Risk & Vulnerability Report released today by Claroty, the industrial cybersecurity company. The report shows a 41% increase in ICS vulnerabilities disclosed in the first half (1H) of 2021 compared to the previous six months, which is particularly significant given that in all of 2020 they increased by 25% from 2019 and 33% from 2018.
The report provides a comprehensive analysis of ICS vulnerabilities publicly disclosed during 1H 2021, including those found by Claroty's award-winning research team, Team82, and those from trusted open sources including the National Vulnerability Database (NVD), the Industrial Control Systems Cyber Emergency Response Team (ICS-CERT), CERT@VDE, MITRE, and industrial automation vendors Schneider Electric and Siemens.
"As more enterprises are modernizing their industrial processes by connecting them to the cloud, they are also giving threat actors more ways to compromise industrial operations through ransomware and extortion attacks," said Amir Preminger, vice president of research at Claroty. "The recent cyber attacks on Colonial Pipeline, JBS Foods, and the Oldmsar, Florida water treatment facility have not only shown the fragility of critical infrastructure and manufacturing environments that are exposed to the internet, but have also inspired more security researchers to focus their efforts on ICS specifically. This is exactly why we are committed to helping the industry at large gain a deep understanding of the risks facing industrial networks and how to mitigate them with this report."
Key Findings
ICS vulnerability disclosures are accelerating significantly, shining a light on the magnitude of security flaws that are just now being discovered in operational technology (OT) environments. 637 ICS vulnerabilities were disclosed in 1H 2021, a 41% increase from the 449 vulnerabilities disclosed in 2H 2020. 81% of those were discovered by sources external to the affected vendor, including third-party companies, independent researchers, academics, and other research groups. Additionally, 42 new researchers reported vulnerabilities.
71% of the vulnerabilities are classified as high or critical, reflecting the high severity and impactful nature of the exposures and their potential risk to operations.
90% have low attack complexity, meaning they do not require special conditions and an attacker can expect repeatable success every time.
74% do not require privileges, meaning the attacker is unauthorized and does not require any access to settings or files, and 66% do not require user interaction, such as opening an email, clicking on links or attachments, or sharing sensitive personal or financial information.
61% are remotely exploitable, demonstrating the importance of securing remote connections and Internet of Things (IoT) and Industrial IoT (IIoT) devices.
65% may cause total loss of availability, resulting in denial of access to resources.
26% have either no available fix or only a partial remediation, highlighting one of the key challenges of securing OT environments compared to IT environments.
The top mitigation steps noted in ICS-CERT alerts and vendor advisories include network segmentation (applies to 59% of vulnerabilities), secure remote access (53%), and ransomware, phishing, and spam protection (33%).
Claroty's Team82 remains the market leader in ICS vulnerability research, having disclosed 70 vulnerabilities in 1H 2021 and over 150 vulnerabilities to date, all of which can be found in the Team82 Vulnerability Dashboard.
To access the complete set of findings, in-depth analysis, and additional steps to defend against improper access and risks, download the Claroty Biannual ICS Risk & Vulnerability Report: 2H 2021.
Acknowledgements
The primary author of this report is Chen Fradkin, security researcher at Claroty. Contributors include Rotem Mesika, security research team lead; Nadav Erez, director of innovation; Sharon Brizinov, vulnerability research team leader; and Amir Preminger, vice president of research at Claroty. Special thanks to the entire Team82 for providing exceptional support to various aspects of this report and the research efforts that fueled it.
About Claroty
Claroty is the industrial cybersecurity company. Trusted by the world's largest enterprises, Claroty helps customers reveal, protect, and manage their OT, IoT, and IIoT assets. The company's comprehensive platform connects seamlessly with customers' existing infrastructure and programs while providing a full range of industrial cybersecurity controls for visibility, threat detection, risk and vulnerability management, and secure remote access—all with a significantly reduced total cost of ownership. Claroty is backed and adopted by leading industrial automation vendors, with an expansive partner ecosystem and award-winning research team. The company is headquartered in New York City and has a presence in Europe, Asia-Pacific, and Latin America, and deployments on all seven continents.
