Rockwell's New Advisory: Enhance ICS Security by Disconnecting Internet

 Source: Rockwell Advises Disconnecting Internet-Facing ICS Devices Amid Cyber Threats (thehackernews.com)

Rockwell Automation, a leading American provider of industrial automation technology, recently updated its customers via an urgent advisory, imploring all of them not to allow public internet access to their industrial control systems (ICS). The reasoning behind this advisory is the intent to safeguard such systems against the increasing threat of malicious cyber activities, such as those driven by APTs and nation-states. This comes at a time when geopolitical tensions have reached their highest levels in recent memory across the globe, and cyber is being seen by many as a relatively low-cost but high-reward tool to use against one's adversaries globally. 

Consequently, the advisory emphasizes that by nature, ICS systems should never be configured to connect directly to the public internet in the first place, as doing so significantly increases the attack surface of their users while exposing such systems to increasingly dangerous cyberspace. In this light, disconnecting such devices is a proactive measure to safeguard companies and organizations that continue utilizing them for various purposes. Furthermore, customers of Rockwell Automation are further encouraged to seek out and identify all possible server and internet connections to ICS devices that aren't meant to be publicly accessible and to terminate such connections, as doing so will significantly reduce the risk of successful cyberattacks from threat actors that exploit such devices and connections. 

Similarly, the US governmental agency known as the Cybersecurity and Infrastructure Security Agency, CISA, has also echoed the sentiments expressed by Rockwell, as they recommended that users and administrators follow previously released guidelines by the agency. These include instructions surrounding measures to enhance security in ICS and operational technology (OT) environments, which are vital to protecting critical infrastructure. As history has shown, critical infrastructure heavily depends on ICS and OT. As such, attacks that utilize them as vectors to attack such infrastructure can have especially deadly impacts, such as affecting a nation's power, water, or even manufacturing industries. 

Highlighting this threat is the fact that research conducted recently and presented at the NDSS Symposium in March of this year revealed that Stuxnet-style capabilities were present in the arsenals of cyber attackers. Web applications hosted by embedded web servers within programmable logic controllers (PLCs) were the main targets of such attacks. These PLCs would be exploited through their web-based interfaces, upon which attackers would then gain initial access and move on to manipulate legitimate APIs to sabotage the underlying machinery. Consequently, this worrying revelation means that threat groups could potentially launch malware with the sole purpose of causing destruction and wreaking havoc at targets of their choice, and with PLC devices being directly connected to the internet, the risk of such attacks rises even further. 

To mitigate the impact of such attacks, organizations are encouraged to limit direct internet access to their ICS systems as much as possible, along with conducting security-related audits of remote access points. Doing so, while also restricting legitimate users' access to control system tools and scripts, will go a long way to improving the security posture of organizations that utilize such systems, many of which are related to critical industries. Consequently, the risk of catastrophic failure due to cyberattacks can be significantly mitigated, which will be important in deterring such threats globally. 

For more details, check out The Hacker News.