Security Experts:

Connect with us

Hi, what are you looking for?

SecurityWeekSecurityWeek

ICS/OT

Published XIoT Vulnerabilities Trend Down, but Vigilance Must Remain High: Report

While the total number of new XIoT vulnerabilities is reducing, the difficulty in securing these devices remains high – especially in OT situations.

Published XIoT vulnerabilities are trending down and have been since 2021. At the same time, the percentage of vulnerabilities published by the device manufacturer rather than third-party researchers is trending up. The clear implication is device manufacturers are taking greater responsibility for the security of their own devices.

The reason is probably twofold: government pressure and commercial reality. The introduction of SBOM’s has focused manufacturers’ attention on the software make-up of their devices, while the increasing frequency of adversarial attacks against critical industries – especially healthcare – is making buyers question the security of devices before they purchase.

This does not mean that companies can relax vigilance around their cyber-physical devices. A report (PDF) from Claroty’s Team82 research arm on the state of XIoT security in 2H, 2022 notes that 688 vulnerabilities were published in this period – and that 74% affected OT devices. Four hundred and eighty-seven of the total number of vulnerabilities were assessed as either critical or high severity under CVSS v3. The potential effect of a successful attack against such OT systems, especially in critical infrastructure companies, could be extreme. 

Team82 reported 65 of the vulnerabilities. Thirty of these had a CVSS v3 critical rating of 9.5 or higher.

Although the total number of new vulnerabilities is reducing, the difficulty in securing these devices remains high – especially in OT situations. Software patches are released by the manufacturers more speedily than firmware updates, but the difficulty and reluctance to shut down operations to perform updates remains strong in OT environments. As a result, it is important to maintain in-house security at a high level regardless of known vulnerabilities or impending patches, especially within critical infrastructure organizations.

“Mitigations are often the only available remediation option given the software and firmware patching challenges,” notes the report. “In addition, many legacy ICS and medical devices may have end-of-life status and are no longer supported by the affected vendor, further placing a reliance on mitigations.”

Team82 suggests the most important factor is segmentation around the devices, including virtual zoning to allow zone-specific policies. This becomes more important as OT’s traditional reliance on airgaps becomes less feasible within business transformation. “There. are very few networks that are truly air gapped,” Nadav Erez, Claroty’s VP of data, told SecurityWeek. “But there are enough mechanisms in network security that should make it at the very least very hard to get to your critical devices.”

Second to segmentation is secure remote access, including the addition of encryption, authentication, and authorization capabilities. For encryption, note that NIST recently recommended a new family of encryption algorithms specifically for small devices.

Recognizing the difficulty in patching OT devices, the publication of vulnerabilities and even the release of patches is often accompanied by such mitigation recommendations. “Other significant mitigation strategies published along with OT vulnerabilities were traffic restriction, user and role policy implementation, and workstation hardening,” adds the report.

Related: Risk Mitigation Strategies to Close the XIoT Security Gap

Related: XIoT Vendors Show Progress on Discovering, Fixing Firmware Vulnerabilities

Related: COVID’s Silver Lining: The Acceleration of the Extended IoT

Written By

Kevin Townsend is a Senior Contributor at SecurityWeek. He has been writing about high tech issues since before the birth of Microsoft. For the last 15 years he has specialized in information security; and has had many thousands of articles published in dozens of different magazines – from The Times and the Financial Times to current and long-gone computer magazines.

Click to comment

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

Join this webinar to learn best practices that organizations can use to improve both their resilience to new threats and their response times to incidents.

Register

Join this live webinar as we explore the potential security threats that can arise when third parties are granted access to a sensitive data or systems.

Register

Expert Insights

Related Content

Vulnerabilities

Less than a week after announcing that it would suspended service indefinitely due to a conflict with an (at the time) unnamed security researcher...

Application Security

Drupal released updates that resolve four vulnerabilities in Drupal core and three plugins.

Risk Management

The supply chain threat is directly linked to attack surface management, but the supply chain must be known and understood before it can be...

Vulnerabilities

Apple has released updates for macOS, iOS and Safari and they all include a WebKit patch for a zero-day vulnerability tracked as CVE-2023-23529.

Cloud Security

VMware vRealize Log Insight vulnerability allows an unauthenticated attacker to take full control of a target system.

Application Security

A CSRF vulnerability in the source control management (SCM) service Kudu could be exploited to achieve remote code execution in multiple Azure services.

IoT Security

Lexmark warns of a remote code execution (RCE) vulnerability impacting over 120 printer models, for which PoC code has been published.

CISO Strategy

Cybersecurity-related risk is a top concern, so boards need to know they have the proper oversight in place. Even as first-timers, successful CISOs make...