According to a recent A&O IT Group report, the number of IoT/SCADA devices connected to the public Internet without the right security measures is growing. This practice leaves these devices exposed to potential cybersecurity campaigns.
“Throughout 2020, the number of unprotected SCADA devices has increased,” specialists say. This is a widespread practice, so experts fear that a large-scale attack could compromise the operations of thousands of organizations, especially in the context of the pandemic.
Using the Shodan search tool, experts analyzed six groups of SCADA devices, detecting at least 43,500 exposed systems:
- Tridium (15.706)
- BACnet (12.648)
- IP Ethernet (7.237)
- Modbus (5.958)
- S7 (1.480)
- DNP (517)
Researchers also detected some interesting trends. For example, some users of protocols such as Modbus and S7 have demonstrated the adoption of best security practices, while other protocols do not have any kind of security: “Modbus and S7 are extremely mature technologies that have spent a lot of time in the public eye, so they are subject to greater scrutiny from specialists”.
This analysis also shows that the United States has established itself as the largest area of IoT attacks, with the largest number of unsecured devices in this territory: “Critical infrastructure operates on legacy networks. Now, due to the growing need to work remotely, these networks become increasingly obsolete, resulting in the recurrence of vulnerabilities that had already been fixed.”
As a protective measure, researchers recommend that organizations perform network mapping to identify all vulnerable devices and make all available updates. Network administrators should not underestimate the importance of network mapping to realize a complete security environment.
Finally, potentially vulnerable devices must remain isolated from the company’s overall IT network in order to prevent the infection spreading in the event of a security incident.
He is a cyber security and malware researcher. He studied Computer Science and started working as a cyber security analyst in 2006. He is actively working as an cyber security investigator. He also worked for different security companies. His everyday job includes researching about new cyber security incidents. Also he has deep level of knowledge in enterprise security implementation.