As we wind down 2024, some of our Nexus contributors have looked back on the challenges and wins the cybersecurity industry has achieved, and provided their take on what lies ahead next year within their industries and specialty areas. Today, Dan Ricci, founder of the popular ICS Advisory Project and noted critical infrastructure cybersecurity expert, identifies vulnerability key trends that emerged this year, and what we can anticipate for 2025.
2024 has undeniably been a challenging year for industrial control systems (ICS) cybersecurity. The increased stream of CISA ICS Advisories underscores the persistent threat landscape, with vulnerabilities targeting critical infrastructure across various sectors. As you can see below, through early December, there have been close to 1,000 CISA ICS advisories, affecting more than 200 vendors. This is a wide cut of the industry, affecting many of the biggest automation vendors, below.
Persistent Vulnerabilities: Classic vulnerabilities such as improper input validation (CWE-20), and out-of-bounds reads/writes (CWE-125, CWE-787) continue to plague ICS systems such as Siemens and Rockwell Automation products and Fuji Electric. This may suggest that fundamental principles of security by design are overlooked in the software development cycle.
Third-Party Component Risks: Vulnerabilities in third-party components, such as libraries and frameworks, have exposed ICS systems to significant risks.
Ransomware Threat: Ransomware attacks targeting third-party software common to IT products that are used in ICS products such as Windows operating systems that support engineering workstations and SCADA software. This has become more significant in 2024 with five ICS products affected by Linux, Fortinet, and Palo Alto operating systems. The potential for attackers exploiting these vulnerabilities to disrupt operations has increased by affecting adjacent network IT systems.
Supply Chain Attacks: The supply chain remains a weak link, as malicious actors can compromise software or hardware components before they reach end-users.
Based on the trends observed in 2024, we can anticipate the following in 2025:
Evolving Threat Landscape: Attackers will continue to refine their techniques, targeting specific vulnerabilities and exploiting zero-day exploits.
Increased Focus on IoT and OT Convergence: As IoT devices become more integrated into ICS environments, new attack vectors will emerge.
Supply Chain Attacks: Supply chain attacks will remain a significant threat as attackers seek to compromise software and hardware components.
Ransomware Persistence: Ransomware will continue to be a major threat, with attackers targeting critical infrastructure for maximum impact.
To mitigate these risks, organizations should implement the following strategies:
Proactive Patch Management:
Regular Patching: Establish a patch management process to address vulnerabilities as needed and necessary for critical infrastructure promptly without compromising operational availability.
Prioritize Critical Patches: Prioritize patches for high-severity vulnerabilities that pose immediate risks.
Test Patches Thoroughly: Test patches in controlled environments to minimize the risk of unintended consequences.
Implement Workarounds: Patching may not be possible or necessary, but compensating control provides adequate mitigation to vulnerabilities without compromising critical infrastructure's operational availability and safety.
Network Segmentation:
Isolate Critical Systems: Segment networks to limit the impact of a breach.
Implement Access Controls: Restrict access to critical systems and devices.
Strong Access Controls:
Password Policies: Enforce strong password policies, including multi-factor authentication.
User Privileges: Limit user privileges to the minimum necessary.
Security Awareness Training:
Regular Training: Provide regular security awareness training to employees to reduce human error.
Incident Response Planning:
Develop Incident Response Plans: Create detailed incident response plans to guide actions in case of security breach.
Regular Testing: Test incident response plans regularly to ensure their effectiveness.
Threat Intelligence:
Stay Informed: Monitor threat intelligence feeds and security advisories to stay informed about emerging threats.
Proactive Defense: Use threat intelligence to identify and mitigate potential risks proactively.
By adopting these strategic measures, organizations can greatly strengthen their security framework and effectively shield critical infrastructure from the looming threat of cyberattacks. Taking action now is essential for a safer future!
Dan Ricci is founder of the ICS Advisory Project, an open-source project to provide DHS CISA ICS Advisories data visualized as a dashboard to support vulnerability analysis for the OT/ICS community. He retired from the U.S. Navy after serving 21 years in the information warfare community.
