Cybersecurity report reveals 145,000 exposed ICS systems

A report by cybersecurity firm Censys highlights the exposure of over 145,000 Industrial Control Systems (ICS) worldwide.

The findings indicate a significant risk to critical infrastructure, as cyberattacks on systems like water utilities have been increasing in regions such as the United States and the United Kingdom. In the UK, Thames Water has been identified as having security vulnerabilities that need addressing.

According to Censys' research, 35 per cent of exposed ICS services are located in Europe, with over 5,000 of these vulnerabilities present in the UK, placing it tenth worldwide in terms of ICS exposure. The report also details nearly 7,700 exposed Human-Machine Interfaces (HMIs), devices crucial for industrial system management and monitoring.

Censys Co-Founder and Chief Scientist, Zakir Durumeric, commented on the findings: "Many of these protocols can be dated back to the 1970s but remain foundational to industrial processes without the same security improvements the rest of the world has seen. The security of ICS devices is a critical element in protecting a country's critical infrastructure. To protect it, we must understand the nuances of how these devices are exposed and vulnerable. Censys' unmatched visibility into the internet makes us the only company to not only see the full extent of critical infrastructure exposure but to drive its remediation with government and commercial partners."

The report outlines that global ICS services are predominantly located in North America, Europe, and Asia, which account for 38 per cent, 35 per cent, and 22 per cent respectively. Censys identifies that attack surfaces are distinct to regions; for instance, protocols like Modbus, S7, and IEC 60870-5-104 being more prevalent in Europe, while Fox, BACnet, ATG, and C-More are more common in North America.

Additionally, the report notes that a significant portion of C-More HMIs are related to water and wastewater management (34 per cent) and agricultural processes (23 per cent). The reliance of ICS devices on mobile or consumer-grade internet service poses further challenges, particularly in remote industrial settings where wired connections may not be available.

Research by the cybersecurity community continues to highlight the necessity of understanding the complete ecosystem of ICS components to mitigate the impact of potential cyber threats. Censys' report serves as a reminder of the complex landscape of industrial cybersecurity and the need for continued vigilance in protecting critical infrastructure.