Exposed Industrial Control Systems Endanger Critical Facilities

This post is also available in: עברית (Hebrew)

Industrial control systems are part of our everyday lives, controlling traffic lights, power grids, security, water systems, and many more. But according to cybersecurity firm Bitsight, thousands of them are exposed worldwide, allowing attackers to take over critical physical infrastructure.

Researchers claim that critical infrastructure sectors “heavily rely on industrial control systems to control cyber-physical systems, compounding concerns that the exposed systems identified in this research could present significant risks to organizations and communities around the world.”

According to Interesting Engineering, exposed industrial control systems pose major risks since disruption of these systems could impact human safety and pose national security risks, since attackers could potentially alter water treatment systems or disrupt the energy supply.

The researchers studied systems that communicate via the most commonly used industrial control system protocols, like Modbus, KNX, BACnet, Niagara Fox, and others. The report states that nearly 100,000 industrial control systems are currently public facing, meaning that attackers can pinpoint where the systems are and what they do, which is information that is absolutely vital for an attack.

At the top of the list with the highest number of exposed organizations was the US, followed by Canada, Italy, the UK, and France. Furthermore, the sector with the most exposed industrial control systems was education organizations, after which were the technology, government, business services, and manufacturing sectors.

The report concluded that manufacturers of industrial control systems and other operational technology must take action to increase the cybersecurity of their devices, elaborating that this includes improving device security prior to deployment and working with clients to ensure the proper configuration and security of already deployed devices.