ICS security covers industrial control systems running physical processes and relying on reliable networks, where failures may affect safety and availability.
Search across headline titles and summaries.
Background for this topic.
Industrial control systems (ICS) are the computers, networks, programmable controllers, sensors, and actuators that monitor and operate physical processes. They include supervisory control and data acquisition (SCADA), distributed control systems, and plant-floor automation in sectors such as manufacturing, energy, transport, and water. Their critical assets are the control logic and process data, while their dependencies include engineering workstations, operator consoles, industrial protocols, communications links, and sometimes connections to enterprise or remote-access systems.
ICS security must protect availability, process integrity, and safety as well as confidentiality. Unauthorized changes to controller logic, compromised remote access, vulnerable engineering software, or disruption of communications can produce unsafe conditions or halt operations, though impact depends on the process and its safeguards. Defenses commonly include accurate asset inventories, network segmentation, tightly controlled and monitored remote access, secure configuration, tested backups of control logic, and vulnerability management that accounts for maintenance windows and the risks of disrupting real-time systems. Incident response may require isolating affected equipment while preserving safe operation or manual fallback.
Industrial devices are less likely to be patched due to expensive downtime, and threat actors have taken notice.
About 34% of security vulnerabilities impacting industrial control systems (ICSs) that were reported in the first half of 2023 have no patch or remediation, registering a significant increase from 13% the previous year
Researchers uncovered new worming second-stage tools used to locally exfiltrate data from air gapped ICS environments, putting threat actors one step away from transmission of the info to a C2.