Operational Technology (OT) systems lack basic security controls

[AntoinetteHodes]

 

Operational Technology (OT) systems lack basic security controls

Top 5 vulnerabilities |

1. Legacy software

OT Systems run on legacy software that lack sufficient user and system authentication, data authenticity verification, or data integrity checking features that allow attackers uncontrolled access to systems

2. Default configuration

Out-of-box systems with default or simple passwords and baseline configurations make it easy for attackers to enumerate and compromise OT systems

3. Lack of encryption

Legacy SCADA controllers and industrial protocols lack the ability to encrypt communication. Attackers use sniffing software to discover username and passwords

4. Remote access policies

SCADA systems connected to unaudited dial-up lines or remote-access servers give attackers convenient backdoor access to the OT network as well as the corporate LAN

5. Policies & Procedures

Security gaps are created when IT and OT personnel differ in their approach to securing industrial controls. Different sides should work together to create a unified security policy that protects both IT and OT technology.

Top 5 threats |

1. Lack of network segmentation

Internet connected OT flat and misconfigured network, firewall features that fail to detect or block malicious activity provide attackers a means to access OT systems

2. DDoS attacks

Invalidated sources and limited access-controls allow attackers intent on sabotaging OT systems to execute DoS attacks on vulnerable unpatched systems

3. Web application attacks

Traditional OT systems including human-management interfaces (HMI) and programmable logic computers (PLC) are increasingly connected to the network and accessible anywhere via the web-interface. Unprotected systems are vulnerable to cross-site scripting and SQL injection attacks

4. Malware

OT Systems are vulnerable to attack and should incorporate anti-malware protection, host-based firewall controls, and patch-management policies to reduce exposure

5. Command injection and parameters manipulation

Invalidated data not verified as legitimate system traffic allows attackers to execute arbitrary system commands on OT systems