SANS Releases Guide to Address Rise in Attacks on Manufacturing and Industrial Control Systems

Increased ransomware attacks on industrial control systems (ICS), mixed with general ICS insecurity found across the manufacturing sector, has given rise to a guide specifically addressing this risk.

Manufacturing has been a target of ransomware for quite some time — I’ve even covered a recent attack focused on credential harvesting.

With the goal of a ransomware attack to disrupt operations, bringing operational technologies to a halt is an impactful way to make the statement “pay the ransom.”

According to cybersecurity vendor Dragos’s recently-released 2023 OT Cybersecurity in Review report, manufacturing has been a major target:

• Ransomware attacks against industrial organizations increased 50% over the previous year
• 70% of all ransomware attacks targeted 638 manufacturing entities in 33 unique manufacturing subsectors.

In other words, it’s a big problem.

In response, SANS has released the SANS Strategy Guide: ICS Is the Business as a means of providing guidance on how to better secure ICS/OT environments. The controls they recommend are:

1. ICS-Specific Incident Response
2. Defensible Control System Network Architecture
3. ICS Network Visibility and Monitoring
4. ICS Secure Remote Access
5. Risk-Based ICS
6. Vulnerability Management

What’s a little unnerving is that SANS (who quotes the Dragos report several times) completely missed the boat on where manufacturing’s greatest risk is; according to the Dragos report, the number one TTP used by threat groups is Valid Accounts (found in 60% of all attacks on manufacturing).

And nowhere in the SANS recommendations is anything about securing credentials with MFA, encouraging complex (read: not easily guessed) passwords, and security awareness training (as the primary ways accounts are compromised is through phishing and social engineering).

Manufacturing definitely has some securing to do; the key will be addressing its the greatest risks.

KnowBe4 empowers your workforce to make smarter security decisions every day. Over 70,000 organizations worldwide trust the KnowBe4 platform to strengthen their security culture and reduce human risk.