Leader in cybersecurity solutions, Trend Micro Incorporated, published research revealing how human machine interface (HMI) systems in thousands of critical water and energy organizations around the world could potentially be exploited, causing significant impacts on the world's water supply.
HMIs are a key part of industrial IT systems that allow human operators to interact with supervisory control and data acquisition (SCADA) environments. A majority of the identified exposed systems are from smaller organizations that feed major enterprise supply chains that serve the general public. An exposed HMI system can allow a potential attacker to see all information about critical systems and can interact with the interfaces.
“Critical infrastructure is a national focal point for cybersecurity – and for cybercriminals, who can pinpoint and exploit the weakest link in these connected systems,” says Mark Nunnikhoven, vice president of cloud research for Trend Micro. “That’s troubling, as Trend Micro Research continues to find critical devices, and the networks that they connect to, needlessly exposed. This exposure, combined with the record number of ICS vulnerabilities reported through the Zero Day Initiative this year, highlights a growing risk that extends into each of our communities.”
The report detailed on potential attack scenarios that would have substantial impacts on infrastructure by using information found in the exposed systems, including the type of device, physical location and other system-level information.
it is possible that attackers could turn their attention to exploiting the exposed systems due to an increase in vulnerabilities found. Trend Micro's Zero Day Initiative has published about 400 SCADA-related vulnerability advisories just this year - a 200 percent increase compared to this time in 2017.
To mitigate the risk of potential attacks, security leaders must ensure the interfaces are properly secured and that there's as much isolation as possible in place between the devices and the corporate network.
“If we hadn’t found the command and control malware in our SCADA environment, our toxic gases monitoring systems could have been compromised and may put human lives in danger,” says Ireneo Demanarig, chief information officer, CEITEC S.A. “Security must be at the core of our company. Trend Micro not only provides comprehensive security solutions, but they are a great partner in automating threat intelligence sharing that makes our lives easier.”
