Photo credit: www.darkreading.com

Increasing Threats to Operational Technology Networks

Recent studies have highlighted a significant vulnerability in operational technology (OT) and industrial control systems (ICS), particularly through engineering workstations. A newly identified malware, referred to as “Chaya_003,” has been developed to target Siemens systems, indicating a rising trend of threats targeting industrial networks via on-premises and Internet-connected frameworks.

According to researchers at Forescout, the discovery of Chaya_003 underscores a broader issue within OT cybersecurity. The team reported that in addition to Chaya_003, they uncovered instances of the Ramnit worm compromising two Mitsubishi engineering workstations, illustrating the growing risk of malware in these environments. For more details, you can read their updated report.

The Forescout research team cautioned, “Malware in OT/ICS is more prevalent than commonly perceived, and engineering workstations linked to the Internet are particularly vulnerable.” This highlights a concerning trend as these workstations often serve as entry points for cyber intrusions.

Further investigation conducted by SANS revealed that over 20% of OT cybersecurity incidents arise from the compromise of engineering workstations. Various botnets, including Aisuru, Kaiten, and Gafgyt, exploit Internet connectivity to infiltrate and disrupt OT systems.

Engineering workstations are attractive targets for cybercriminals due to their location and configuration. They operate traditional operating systems alongside specialized software such as Siemens’ TIA Portal and Mitsubishi’s GX Works, making them unique and valuable assets for attackers.

To effectively mitigate these risks, experts advise OT and ICS network operators to enhance protection protocols for engineering workstations. This includes ensuring robust network segmentation and establishing a continuous threat monitoring program to detect and respond to threats proactively.

The report notes that while malware specifically targeting OT environments is not as widespread as threats to enterprise systems, operators in the field should remain vigilant. The growing complexity and frequency of attacks indicate that complacency is not an option for those charged with safeguarding industrial control system security.

Source
www.darkreading.com