mirror of
https://github.com/V33RU/awesome-connected-things-sec.git
synced 2026-02-20 13:50:42 +00:00
13 KiB
13 KiB
Industrial Control Systems (ICS) Security - Complete Guide
Industrial Control Systems (ICS) are the backbone of critical infrastructure: power, water, oil & gas, manufacturing, and more. This file covers the full ICS security landscape - basics, threats, exploits, major incidents, key vulnerabilities, standards, and the best resources.
Table of Contents
- Overview
- Key ICS Components
- Current ICS Security Challenges
- Attack Vectors & Notable Exploits
- Critical ICS Vulnerabilities (2024–2025)
- Infamous ICS-Focused Malware
- Ransomware & Targeted OT Attacks
- ICS Security Best Practices & Standards
- Recent Research & Conference Insights
- Ultimate ICS Security Resources (Links)
Overview
Industrial Control Systems like SCADA, DCS, and PLCs—control everything from electricity generation to water treatment to factory automation. ICS environments:
- Run on legacy tech with safety & uptime as priorities.
- Are rapidly connecting to IT and cloud, exposing new risks.
A single breach may mean physical destruction, blackouts, or threats to human life.
Learn more: ICS Overview by CISA
Key ICS Components
- SCADA (Supervisory Control and Data Acquisition)
- DCS (Distributed Control System)
- PLC (Programmable Logic Controllers)
- HMI (Human Machine Interface)
- RTU (Remote Terminal Unit)
- Industrial Protocols: Modbus, DNP3, OPC UA, Siemens S7, Profibus
Current ICS Security Challenges
- Legacy Devices: No modern authentication/encryption; many default credentials
- Maximum Availability: Downtime is unacceptable, so patching is hard
- Insecure Protocols: Industrial protocols lack security by design
- IT/OT Integration: Merging IT & OT expands attack surface
- Human Factors: Misconfiguration, lack of training, accidental insider error
- Supply Chain Risks: 3rd-party software/equipment often introduce vulnerabilities
- Internet Exposure: 100,000+ ICS devices found online in 2024 (Shodan ICS Exposures)
Rockwell Automation: What is ICS Security?
Attack Vectors & Notable Exploits
| Incident | Year | Description/Impact | Link |
|---|---|---|---|
| Stuxnet | 2010 | Sabotaged Iran’s nuclear centrifuges via Siemens PLCs | Stuxnet WIRED |
| Maroochy Water Breach | 2000 | Insider hacks sewage treatment SCADA to release sewage | SANS Report |
| Ukraine Power Grid Attack | 2015 | Malware disables power for 200,000+ residents | Dragos Blog |
| Triton/Trisis | 2017 | Targeted Schneider Triconex SIS, aiming for sabotage | Dragos Triton |
| Colonial Pipeline Ransomware | 2021 | Ransomware forces major East US fuel pipeline shutdown | CISA Response |
| Ransomhub (Spain, SCADA ransomware) | 2024 | Locks out bioenergy SCADA, encrypts 400+GB, disrupts ops | Cyble Report |
| Fuxnet, FrostyGoop | 2024–5 | Fuxnet (Russia gas/water sensor disruption), FrostyGoop (Ukraine heating sabotage) | Dragos 2024 Threats |
| US/UK/Global Water Utility PLC Hacks | 2023–4 | Iran-affiliated and hacktivist groups target exposed PLCs BLAM, causing real outages | Aon OT Report |
- Shodan Scan: Live Exposed ICS Devices
Critical ICS Vulnerabilities (2024–2025)
| Vendor | Product(s) | CVE/Advisory | Impact | Link |
|---|---|---|---|---|
| Siemens | TeleControl Server Basic SQL | CVE-2025-40312/-40313 | SQLi, remote access | Siemens Adv. |
| Siemens | Industrial Edge Management | CVE-2024-45032 (CVSS 10) | Remote code exec, unauth | Cyble Analysis |
| Schneider Elec. | Modicon M580 PLCs | ICSA-25-035-04 | Remote code exec, persistence | CISA Advisory |
| ABB | MV Drives | ICSA-25-112-04 | Privilege escalation | CISA Advisory |
| Viessmann | Vitogate 300 Climate Controller | Public PoC | Internet-exposed, RCE | Cyble Analysis |
| Schneider Elec. | Wiser Home WHC-5918A | ICSA-25-112-03 | Unauth remote control | CISA Advisory |
- Constantly updated: ICS-CERT Vulnerabilities Feed
Infamous ICS-Focused Malware
- Stuxnet: Destroyed centrifuges by reprogramming Siemens PLCs.
- Triton/Trisis: Sabotaged safety instrumented systems in petrochemical plants.
- Industroyer/CrashOverride: Ukraine power grid malware (uses ICS protocols directly).
- EKANS/Snake Ransomware: Ransomware with ICS service/process termination.
- INCONTROLLER: Modular, state-sponsored toolkit for Omron/Schneider PLCs.
- Fuxnet & FrostyGoop: Latest 2024–2025 ICS malware—sensor and process disruption.
Ransomware & Targeted OT Attacks
- Ransomware up 46% in 2025: Honeywell 2025 OT Threat Report
- Groups: Cl0p, Ransomhub, and others are increasingly OT-aware.
- Attack vectors:
- USB devices: Proofpoint 2024 Report
- Ransomware-as-a-service (RaaS)
- Supply chain compromise, IABs (Initial Access Brokers)
ICS Security Best Practices & Standards
- Segment OT/ICS from IT: Air gaps, VLANs, strict firewalling
- Remove or restrict legacy protocols (no Telnet/FTP)
- No default passwords! Strong authentication for all ICS assets
- Periodic assessment & managed patching (track vendor advisories)
- Asset inventory & network monitoring — baseline normal, detect anomalies
- Multi-factor authentication (MFA), VPN for remote
- Physical controls: Limit physical access to ICS
- Incident response plans and backup recovery processes
- Security training for all OT/engineering staff
- Compliance standards:
Comprehensive ICS Security Practices — Vumetric
Recent Research & Conference Insights
- Geopolitics: Ukraine war and US-China tensions fueling ICS attacks (JPCERT 2025)
- Manufacturing: 2/3 of ICS ransomware victims are manufacturing orgs (Dragos 2024, Honeywell 2025)
- Disclosure: SEC Form 8-K and new CISA reporting rule improving transparency.
- Malware: Repurposed older malware now dominates—little truly “new” malware, but attacks are more creative and critical.
Ultimate ICS Security Resources (Links)
- CISA: ICS/SCADA Security Hub
- CISA ICS Advisories / Real-Time Vulnerabilities
- Dragos ICS Threat Reports & YIR
- Honeywell OT Threat Report 2025
- Cyble: Weekly ICS Vulnerabilities
- Aon: Common Attacks and Vulnerabilities in ICS
- Rockwell: What is ICS Security?
- Vumetric: ICS Security Best Practices
- NIST SP 800-82 (ICS Security Standard)
- ISA/IEC 62443 Standard Series
- SANS ICS Whitepapers
- JPCERT/CC ICS Security Conference Insights
- Proofpoint: USB-Borne Attack Trends
- Check Point: ICS Security Hub
This guide integrates case studies, threat intelligence, high-impact malware, critical vulnerabilities, and best practices, your single reference for research, defense, or investigation in ICS environments.