Kaspersky has released its 2022 ICS (industrial control systems) threat landscape report that determined some 41% of operational technology (OT) computers were hit by malicious attacks in one form or another last year.
Attack Surface Expands
In particular, in the second half of 2022, roughly 34% of industrial sector computers were affected by malware with a growing number of attacks using malicious scripts, phishing pages and denylisted resources.
Attacks on the automotive manufacturing and energy sector showed record growth in the second half 2022, accounting for 37% and 35% of all industries. Overall, by Kaspersky’s count, 2022 ended up accounting for the highest percentage of OT computers affected by malware.
Malicious scripts and phishing pages are distributed both online and via email. A significant part of denylisted internet resources are used to distribute malicious scripts and phishing pages.
In North America, building automation saw the highest percent of OT computers attacked (22%), followed by manufacturing (21%), ICS engineering and integration (19%), oil and gas (19%) and energy (16%).
Commenting on the report, Kirill Kruglov, senior researcher at Kaspersky, said:
“The growing attack rates in industrial sectors that are being conducted using social engineering seems alarming. We strongly recommend customers in these sectors revise their existing approach to security and check whether all security systems are up to date and their personnel are well-trained.”
Recommendations to Protect OT Computers
To keep OT computers protected from various threats, Kaspersky recommends organizations take the following measures:
- Conduct regular security assessments of OT systems to identify and eliminate possible cyber security issues.
- Establish continuous vulnerability assessment and triage as a basement for an effective vulnerability management process.
- Perform timely updates for the key components of the enterprise’s OT network. Apply security fixes and patches or implement compensating measures as soon as it is technically possible.
- Use endpoint detection and response (EDR) solutions for timely detection of sophisticated threats, investigation, and effective remediation of incidents.
- Improve the response to new and advanced malicious techniques by building and strengthening your teams’ incident prevention, detection and response skills. Dedicated OT security training for IT security teams and OT personnel is one of the key measures helping to achieve this.
Kaspersky said its security solutions during 2022 blocked malware from 7,684 different families on industrial automation systems, such as building automation, automotive, oil and gas, energy and engineering. This number is slightly more (6%) than the first six months of the year and roughly 1.5 times more than in the second half of 2021.
