Addressing the SCADA in the room

Issue 4 2023 Industrial (Industry), Cyber Security

The industrial and manufacturing spaces are critical to the global economy. They produce the goods and services we rely on every day, from food and clothing to cars and electronics. Disruptions to this space can have far-reaching effects as proven by recent COVID effects on the supply chain. Much like other sectors, they are targeted by cybercriminals for monetary or destructive purposes. However, few other spaces command the breadth of purpose-built and custom devices necessary to function, as the industrial and manufacturing industries. These unique devices create an uncommon risk that must be assessed and understood to fully protect against incoming attacks.

Such attacks can have massive implications, as seen during the Khuzestan Steel Co. attack in June 2022. Khuzestan Steel Co. and two other manufacturers were targeted to disrupt steel production, crippling services across Iran. The attackers who took credit for this attack go by Gonjeshke Darande or Predatory Sparrow. They did so by comprising the Industrial Control System (ICS) Siemens PCS7 Process Control System, manipulating the hydrogen gas density causing structural integrity and massive fires.

Their ability to disrupt steel production is only half the story though. Notice this attack was enabled in part through compromising an ICS system, systems that are easily overlooked in a typical threat assessment. Most OS have routine patching cycles such as ‘Patch Tuesday’, and many major software packages have easy or automated patching mechanisms. On the other hand, ICS are typically not front-and-centre like desktop software but are mounted somewhere within the facility – making them much more troublesome to update and patch regularly. This attack is just one example showing how the impact of ignoring such ICS systems can be catastrophic.

Assessing the current threat landscape

In order to understand what risks are unique to industry and manufacturing, our team curated 120 different publicly disclosed vulnerabilities in the Supervisory Control and Data Acquisition (SCADA) or ICS space. We specifically looked at those that were disclosed since the beginning of 2023, enabling us to narrow the focus on current systems that are in production or in planning for implementation. Some systems may in fact be older, but generally the approach had the intended effect.

There are two great sources of vulnerability information that the team used as primary sources:

• National Vulnerability Database (NVD,

• CS Advisories from CISA (

We first used NVD for its simple-to-use search functionality. To ensure that we only had information relevant to industry and manufacturing, we filtered our results to only include instances of SCADA and then ICS.

This filter is only a text matching filter, so the team then manually reviewed each result so that only the desired results remained. CISA Advisories have similar value, albeit more tailored. Again, not all ICS systems are typically found within the industry and manufacturing space, so we manually reviewed each advisory to keep the results relevant. There is a lot of overlap between NVD and CISA Advisories; duplicates were removed leaving the examined vulnerabilities.


Since there are a variety of different solutions within the space, we organised the results into five main categories:

1. Communication.

2. Device management and monitoring.

3. Facility management.

4. Software.

5. Other.

By and large, at 38%, the software category takes up the largest percentage of disclosed CVEs. These CVEs are specifically comprised of software-only based solutions that do not lend themselves to other categories. The most prevalent technology within this category is asset tracking software used to manage goods, equipment, and/or personnel across the facility.

HMI or Human-Machine Interface is also among the top contributors, representing the software used for a human to interact with a device, or to design such user interfaces. From a research perspective, it is easy to understand why software solutions have the most CVEs disclosed. They are typically easier for an attacker to understand and interact with – which makes them more straightforward targets for cybercriminals.

Device management and monitoring follows significantly behind at 23% of disclosed CVEs. The majority of these are device management solutions, with 15 CVEs disclosed from a single vendor. The remaining CVEs are scattered among management of different devices such as industrial robots, PLCs, and automotive factory devices. One potential reason for so many disclosed CVEs in this category is that device management and monitoring solutions inherently communicate to other devices. Exploiting communications leads to lateral movement making them a higher priority target.

The next category coming closely behind at 20% of disclosed CVEs was facilities management, which also included ‘plant management’ for lack of a better grouping. The largest representative sub-category is access control with 11 CVEs, while plant automation only included five CVEs. Other more traditional sub-categories include HVAC management, energy management, access control, and remote management. Facility management has gained interest among researchers in recent years, including Trellix with our access control research in 2022 (*trellix1).

The communication category covers devices that are purpose-built for communicating, with disclosed CVEs sitting at 13% of the total. These are nearly exclusively routers. The few exceptions are relays and a wireless communication framework. The wireless communication framework CVEs also happen to have public proof-of-concept code available, which was rare among other CVEs. In fact, we only discovered three other proof-of-concepts among the others. We did expect a higher representation from this category as network devices tend to get a lot of scrutiny from both researchers and cyber criminals. It will be interesting to see if the remainder of the year sees similar results.

The other category, composed of generic SCADA solutions for services like geolocations or telemetry that did not easily fit into another category, only accounts for 6% of disclosed CVEs.

Surprisingly however, the breadth of vulnerability types was quite large. We’ve based these categories on the standard Common Weakness Enumeration (CWE) but grouped similar ones for brevity. Not many could be grouped together easily. The remaining breadth is so large in fact that the second largest category of vulnerability, out-of-bound read, only took up 8% of the population. The largest, at 34%, was authentication. This included lack of authentication, clear text storage of passwords, improper permissions, hard coded credentials, and similar issues. We’ve seen similar issues with authentication vulnerabilities in other spaces such as the medical industry. The differing vulnerability types often diverged into smaller groups of one or two representing less than 1% each. This is why the other category is so large at 45% of the overall population.

A reasonable question is why are authentication issues so common in our findings? This is a difficult question to answer but we believe there are two major factors. The most straight forward factor is a there is a lack of priority for security and/or training among the developers of these devices. The developers are tasked with getting devices to communicate together, manage machinery, or other industrial tasks. If security is not prioritised appropriately, then even simple security measures can be overlooked. Another factor is that we see more authentication issues because it happens to be the first line of defence. When these systems get tested for vulnerabilities, authentication is usually the first defence to be challenged and therefore the most discovered.

Is the industry and manufacturing space at risk?

The short answer is yes, these systems are under threat and actively attacked. There have been some major attacks in the last few years indicating so. A prime example is the Khuzestan Steel Co. attack mentioned before, which used ICS systems as part of its attack chain; this is strikingly similar to a 2014 attack against an unnamed German steel company also targeting ICS systems. Both examples resulted in physical damage to the facilities. Some groups opt for more traditional attacks such as with ransomware as was the case in the Colonial Pipeline attack of 2021. Manufacturing accounted for 12% of Ransomware campaigns publicly reported in 2022 from the Trellix Advance Research Centre’s 2023 Threat Report. We also found that the Industrial Goods & Services accounted for 32% of the ‘leaks’ resulting from ransomware extortion. (*trellix2).

An insecure conclusion

So, what can you take from these findings? First and foremost, software-based solutions are the low-hanging fruit for vulnerability discovery. Fortunately, they are also easier to keep up to date in terms of versioning and patching. Ensure the business is using automated patching if possible.

Device management and monitoring systems should be the next priority. Things can get rather difficult if these are purpose-built devices without robust central management. For anyone running these systems, it’s paramount to keep them up to date, if possible, and within vendor support. That may prove difficult or impossible for ICS systems if they don’t come with some form of user update method – in which case the documentation from each vendor can provide more information.

Proper network segregation and monitoring is important to provide some protection while security teams work out how to properly update and patch these systems. It’s certainly easier to focus on traditional attack vectors such as OS and web server vulnerabilities. But these findings make it clear that ignoring the potential impact of more domain specific solutions such as SCADA and ICS is not an option. It’s important that security teams work with their vendors and partners to ensure that each device is securely implemented, and the patching process works in a sustainable way for their business.

Share this article:
Share via emailShare via LinkedInPrint this page

Further reading:

Integrated guarding services
XtraVision Integrated Solutions Access Control & Identity Management Industrial (Industry)
XtraVision offers a few tips on how to go about planning and setting up an integrated approach to sustainable and successful security services, from the initial risk assessment to the technology and people required.

Vulnerabilities in industrial cellular routers’ cloud management platforms
Industrial (Industry) Cyber Security Security Services & Risk Management
Research from OTORIO, a provider of operational technology cyber and digital risk management solutions, unveils cyber risks in M2M protocols and asset registration that expose hundreds of thousands of devices and OT networks to attack

NEC XON appoints Armand Kruger as Head of Cybersecurity
News Cyber Security
NEC XON has announced the appointment of Armand Kruger as the Head of Cybersecurity. Kruger will oversee all cybersecurity offerings including cybersecurity strategy, programmes, and executive advisory.

Caesar Tonkin new head of cybersecurity business, Armata
News Cyber Security
Vivica Holdings has announced the appointment of cybersecurity expert Caesar Tonkin to head up its cybersecurity business Armata, which provides technology solutions and niche expertise needed to help businesses better protect themselves.

Surveillance-free surfing
News Cyber Security Products
Zoho has launched Ulaa, a privacy-centric browser built specifically to help users secure their personal data and activity by providing a browser solution that universally blocks tracking and website surveillance.

Troye and Arctic Wolf join forces
News Cyber Security Security Services & Risk Management
Troye has announced a strategic partnership with Arctic Wolf to enable Troye to provide customers with enhanced cybersecurity solutions and services that help protect their businesses from advanced cyber threats.

Relaxed home cybersecurity could render consumers accidental ‘inside actors’
Editor's Choice Cyber Security Smart Home Automation
Cisco security experts warn of snowball impact of relaxed approach to cybersecurity on personal devices, noting 60% of users primarily use their personal phone for work tasks and 76% have used unsecured public networks for work tasks.

The factory of the future will be data-driven and AI optimised
Industrial (Industry)
Moving AI to the manufacturing edge promises a lot of tantalising benefits, but it also poses some unique challenges that need to be overcome for manufacturing edge AI deployments to be successful.

Corporate cyber maturity levels
News Cyber Security
Only 19% of organisations in South Africa have a cybersecurity posture mature enough to defend against the threats of a hybrid world, while 65% expect a cybersecurity incident to disrupt their business in the next 12 to 24 months.

Financial sector cyber resilience in developing countries
News Cyber Security
While increased financial inclusion is a global goal, the less privileged remain highly susceptible to risks. New Guide calls for regimented cyber resilience testing on financial entities in developing countries to help prepare for and protect from cyberattack.