Security researchers find ‘staggering number’ of industrial control system vulnerabilities in 2021

Published: Thursday, 19 August 2021 08:33

Industrial control system (ICS) vulnerability disclosures are drastically increasing as high-profile cyber attacks on critical infrastructure and industrial enterprises have elevated ICS security to a mainstream issue according to the third Biannual ICS Risk & Vulnerability Report released by Claroty.

The report shows a 41 percent increase in ICS vulnerabilities disclosed in the first half (1H) of 2021 compared to the previous six months, which is particularly significant given that in all of 2020 they increased by 25 percent from 2019 and 33 percent from 2018.

The report provides a comprehensive analysis of ICS vulnerabilities publicly disclosed during 1H 2021, including those found by Claroty's research team, Team82, and those from trusted open sources including the National Vulnerability Database (NVD), the Industrial Control Systems Cyber Emergency Response Team (ICS-CERT), CERT@VDE, MITRE, and industrial automation vendors Schneider Electric and Siemens.

"As more enterprises are modernizing their industrial processes by connecting them to the cloud, they are also giving threat actors more ways to compromise industrial operations through ransomware and extortion attacks," said Amir Preminger, vice president of research at Claroty. "The recent cyber attacks on Colonial Pipeline, JBS Foods, and the Oldmsar, Florida water treatment facility have not only shown the fragility of critical infrastructure and manufacturing environments that are exposed to the Internet, but have also inspired more security researchers to focus their efforts on ICS specifically. This is exactly why we are committed to helping the industry at large gain a deep understanding of the risks facing industrial networks and how to mitigate them with this report."

Key findings include:

More details.