Addressing the SCADA in the room

Issue 4 2023 Industrial (Industry), Information Security, IoT & Automation

The industrial and manufacturing spaces are critical to the global economy. They produce the goods and services we rely on every day, from food and clothing to cars and electronics. Disruptions to this space can have far-reaching effects as proven by recent COVID effects on the supply chain. Much like other sectors, they are targeted by cybercriminals for monetary or destructive purposes. However, few other spaces command the breadth of purpose-built and custom devices necessary to function, as the industrial and manufacturing industries. These unique devices create an uncommon risk that must be assessed and understood to fully protect against incoming attacks.

Such attacks can have massive implications, as seen during the Khuzestan Steel Co. attack in June 2022. Khuzestan Steel Co. and two other manufacturers were targeted to disrupt steel production, crippling services across Iran. The attackers who took credit for this attack go by Gonjeshke Darande or Predatory Sparrow. They did so by comprising the Industrial Control System (ICS) Siemens PCS7 Process Control System, manipulating the hydrogen gas density causing structural integrity and massive fires.

Their ability to disrupt steel production is only half the story though. Notice this attack was enabled in part through compromising an ICS system, systems that are easily overlooked in a typical threat assessment. Most OS have routine patching cycles such as ‘Patch Tuesday’, and many major software packages have easy or automated patching mechanisms. On the other hand, ICS are typically not front-and-centre like desktop software but are mounted somewhere within the facility – making them much more troublesome to update and patch regularly. This attack is just one example showing how the impact of ignoring such ICS systems can be catastrophic.

Assessing the current threat landscape

In order to understand what risks are unique to industry and manufacturing, our team curated 120 different publicly disclosed vulnerabilities in the Supervisory Control and Data Acquisition (SCADA) or ICS space. We specifically looked at those that were disclosed since the beginning of 2023, enabling us to narrow the focus on current systems that are in production or in planning for implementation. Some systems may in fact be older, but generally the approach had the intended effect.

There are two great sources of vulnerability information that the team used as primary sources:

• National Vulnerability Database (NVD,

• CS Advisories from CISA (

We first used NVD for its simple-to-use search functionality. To ensure that we only had information relevant to industry and manufacturing, we filtered our results to only include instances of SCADA and then ICS.

This filter is only a text matching filter, so the team then manually reviewed each result so that only the desired results remained. CISA Advisories have similar value, albeit more tailored. Again, not all ICS systems are typically found within the industry and manufacturing space, so we manually reviewed each advisory to keep the results relevant. There is a lot of overlap between NVD and CISA Advisories; duplicates were removed leaving the examined vulnerabilities.


Since there are a variety of different solutions within the space, we organised the results into five main categories:

1. Communication.

2. Device management and monitoring.

3. Facility management.

4. Software.

5. Other.

By and large, at 38%, the software category takes up the largest percentage of disclosed CVEs. These CVEs are specifically comprised of software-only based solutions that do not lend themselves to other categories. The most prevalent technology within this category is asset tracking software used to manage goods, equipment, and/or personnel across the facility.

HMI or Human-Machine Interface is also among the top contributors, representing the software used for a human to interact with a device, or to design such user interfaces. From a research perspective, it is easy to understand why software solutions have the most CVEs disclosed. They are typically easier for an attacker to understand and interact with – which makes them more straightforward targets for cybercriminals.

Device management and monitoring follows significantly behind at 23% of disclosed CVEs. The majority of these are device management solutions, with 15 CVEs disclosed from a single vendor. The remaining CVEs are scattered among management of different devices such as industrial robots, PLCs, and automotive factory devices. One potential reason for so many disclosed CVEs in this category is that device management and monitoring solutions inherently communicate to other devices. Exploiting communications leads to lateral movement making them a higher priority target.

The next category coming closely behind at 20% of disclosed CVEs was facilities management, which also included ‘plant management’ for lack of a better grouping. The largest representative sub-category is access control with 11 CVEs, while plant automation only included five CVEs. Other more traditional sub-categories include HVAC management, energy management, access control, and remote management. Facility management has gained interest among researchers in recent years, including Trellix with our access control research in 2022 (*trellix1).

The communication category covers devices that are purpose-built for communicating, with disclosed CVEs sitting at 13% of the total. These are nearly exclusively routers. The few exceptions are relays and a wireless communication framework. The wireless communication framework CVEs also happen to have public proof-of-concept code available, which was rare among other CVEs. In fact, we only discovered three other proof-of-concepts among the others. We did expect a higher representation from this category as network devices tend to get a lot of scrutiny from both researchers and cyber criminals. It will be interesting to see if the remainder of the year sees similar results.

The other category, composed of generic SCADA solutions for services like geolocations or telemetry that did not easily fit into another category, only accounts for 6% of disclosed CVEs.

Surprisingly however, the breadth of vulnerability types was quite large. We’ve based these categories on the standard Common Weakness Enumeration (CWE) but grouped similar ones for brevity. Not many could be grouped together easily. The remaining breadth is so large in fact that the second largest category of vulnerability, out-of-bound read, only took up 8% of the population. The largest, at 34%, was authentication. This included lack of authentication, clear text storage of passwords, improper permissions, hard coded credentials, and similar issues. We’ve seen similar issues with authentication vulnerabilities in other spaces such as the medical industry. The differing vulnerability types often diverged into smaller groups of one or two representing less than 1% each. This is why the other category is so large at 45% of the overall population.

A reasonable question is why are authentication issues so common in our findings? This is a difficult question to answer but we believe there are two major factors. The most straight forward factor is a there is a lack of priority for security and/or training among the developers of these devices. The developers are tasked with getting devices to communicate together, manage machinery, or other industrial tasks. If security is not prioritised appropriately, then even simple security measures can be overlooked. Another factor is that we see more authentication issues because it happens to be the first line of defence. When these systems get tested for vulnerabilities, authentication is usually the first defence to be challenged and therefore the most discovered.

Is the industry and manufacturing space at risk?

The short answer is yes, these systems are under threat and actively attacked. There have been some major attacks in the last few years indicating so. A prime example is the Khuzestan Steel Co. attack mentioned before, which used ICS systems as part of its attack chain; this is strikingly similar to a 2014 attack against an unnamed German steel company also targeting ICS systems. Both examples resulted in physical damage to the facilities. Some groups opt for more traditional attacks such as with ransomware as was the case in the Colonial Pipeline attack of 2021. Manufacturing accounted for 12% of Ransomware campaigns publicly reported in 2022 from the Trellix Advance Research Centre’s 2023 Threat Report. We also found that the Industrial Goods & Services accounted for 32% of the ‘leaks’ resulting from ransomware extortion. (*trellix2).

An insecure conclusion

So, what can you take from these findings? First and foremost, software-based solutions are the low-hanging fruit for vulnerability discovery. Fortunately, they are also easier to keep up to date in terms of versioning and patching. Ensure the business is using automated patching if possible.

Device management and monitoring systems should be the next priority. Things can get rather difficult if these are purpose-built devices without robust central management. For anyone running these systems, it’s paramount to keep them up to date, if possible, and within vendor support. That may prove difficult or impossible for ICS systems if they don’t come with some form of user update method – in which case the documentation from each vendor can provide more information.

Proper network segregation and monitoring is important to provide some protection while security teams work out how to properly update and patch these systems. It’s certainly easier to focus on traditional attack vectors such as OS and web server vulnerabilities. But these findings make it clear that ignoring the potential impact of more domain specific solutions such as SCADA and ICS is not an option. It’s important that security teams work with their vendors and partners to ensure that each device is securely implemented, and the patching process works in a sustainable way for their business.

Share this article:
Share via emailShare via LinkedInPrint this page

Further reading:

Perspectives on personal care monitoring and smart surveillance
Leaderware Editor's Choice Surveillance Smart Home Automation IoT & Automation
Dr Craig Donald believes smart surveillance offers a range of options for monitoring loved ones, but making the right choice is not always as simple as selecting the latest technology.

On-camera AI and storage create added benefits
Elvey Security Technologies AI & Data Analytics Surveillance IoT & Automation
The days of standalone security systems are long past, and the drive is now to educate system integrators, installers, and end users on the return on investment that can be derived from intelligent, integrated BMS, IoT and security systems.

Cybersecurity and AI
AI & Data Analytics Information Security
Cybersecurity is one of the primary reasons that detecting the commonalities and threats of what is otherwise completely unknown is possible with tools such as SIEM and endpoint protection platforms.

Data security and privacy in global mobility
Security Services & Risk Management Information Security
Data security and privacy in today’s interconnected world is of paramount importance. In the realm of global mobility, where individuals and organisations traverse borders for various reasons, safeguarding sensitive information becomes an even more critical imperative.

Sophos celebrates partners and cybersecurity innovation at annual conference
News & Events Information Security
[Sponsored] Sun City hosted Sophos' annual partner event this year, which took place from 12 to 14 March. Sophos’ South African cybersecurity distributors and resellers gathered for an engaging two-day conference.

Empowering cities with intelligent security solutions
Secutel Technologies Surveillance IoT & Automation
By leveraging advanced AI analytics, real-time data collection, and seamless integration capabilities, cities can address pressing security challenges and create a safer environment for residents.

A constant armed struggle
Technews Publishing XtraVision Editor's Choice Integrated Solutions Mining (Industry) IoT & Automation
SMART Security Solutions asked a few people involved in servicing mines to join us for a virtual round table and give us their insights into mine security today. A podcast of the discussion will be released shortly-stay tuned.

The CIPC hack has potentially serious consequences
Editor's Choice Information Security
A cyber breach at the South African Companies and Intellectual Property Commission (CIPC) has put millions of companies at risk. The organisation holds a vast database of registration details, including sensitive data like ID numbers, addresses, and contact information.

AI augmentation in security software and the resistance to IT
Security Services & Risk Management Information Security
The integration of AI technology into security software has been met with resistance. In this, the first in a series of two articles, Paul Meyer explores the challenges and obstacles that must be overcome to empower AI-enabled, human-centric decision-making.

Milestone Systems joins CVE programme
Milestone Systems News & Events Information Security
Milestone Systems has partnered with the Common Vulnerability and Exposures (CVE) Programme as a CVE Numbering Authority (CNA), to assist the programme to find, describe, and catalogue known cybersecurity issues.