IT Pro is supported by its audience. When you purchase through links on our site, we may earn an affiliate commission. Learn more

Critical infrastructure vulnerabilities increased by 41% in first half of 2021

Vulnerability reports are growing in severity too

There has been a 41% increase in disclosed flaws within industrial control systems in the first half of 2021 compared to the previous six months, according to a new report from cyber security firm Claroty.

Claroty found this particularly significant given they increased by just 25% in 2020 relative to  2019 and 33% compared to 2018.

The research said that 637 ICS vulnerabilities were disclosed in the first half of 2021, a 41% increase from the 449 vulnerabilities disclosed in the second half of 2020. Of those vulnerabilities, 81% were discovered by sources other than the affected vendor, such as third-party companies, independent researchers, academics, and other research groups. 

Of those vulnerabilities, 71% were classified as high or critical and 90% had a low attack complexity, meaning they required no special conditions and a hacker could easily repeat them. 

The report also found that 74% of the vulnerabilities did not require privileges. This means an unauthorized hacker could easily access settings or files. Sixty-six percent of the vulnerabilities did not require user interaction, such as opening an email, clicking on links or attachments, or sharing sensitive personal or financial information.

Of the vulnerabilities, 61% are remotely exploitable, demonstrating the importance of securing remote connections and internet of things (IoT) and industrial IoT (IIoT) devices, the report said.

Related Resource

X-Force Threat Intelligence Index

Top security threats and recommendations for resilience

Transparent cube against a black background - whitepaper from IBMFree download

The report said more researchers than ever are looking for flaws in ICS products and OT protocols: 42 new researchers disclosed vulnerabilities in the first half of 2021, and 20 vendors had vulnerabilities disclosed publicly for the first time.

Siemens was the affected vendor with the most reported vulnerabilities at 146, many of which were disclosed as part of internal research conducted by the Siemens CERT.

"As more enterprises are modernizing their industrial processes by connecting them to the cloud, they are also giving threat actors more ways to compromise industrial operations through ransomware and extortion attacks," said Amir Preminger, vice president of research at Claroty. 

"The recent cyber attacks on Colonial Pipeline, JBS Foods, and the Oldmsar, Florida water treatment facility have not only shown the fragility of critical infrastructure and manufacturing environments that are exposed to the internet but have also inspired more security researchers to focus their efforts on ICS specifically. This is exactly why we are committed to helping the industry at large gain a deep understanding of the risks facing industrial networks and how to mitigate them with this report."

Featured Resources

Accelerating AI modernisation with data infrastructure

Generate business value from your AI initiatives

Free Download

Recommendations for managing AI risks

Integrate your external AI tool findings into your broader security programs

Free Download

Modernise your legacy databases in the cloud

An introduction to cloud databases

Free Download

Powering through to innovation

IT agility drive digital transformation

Free Download

Recommended

LockBit 2.0 ransomware disguised as PDFs distributed in email attacks
Security

LockBit 2.0 ransomware disguised as PDFs distributed in email attacks

27 Jun 2022
Best free malware removal tools 2022
Security

Best free malware removal tools 2022

22 Jun 2022
A guide to cyber security certification and training
Careers & training

A guide to cyber security certification and training

16 Jun 2022
What is shoulder surfing?
social engineering

What is shoulder surfing?

10 Jun 2022

Most Popular

Salaries for the least popular programming languages surge as much as 44%
Development

Salaries for the least popular programming languages surge as much as 44%

23 Jun 2022
The top programming languages you need to learn for 2022
Careers & training

The top programming languages you need to learn for 2022

23 Jun 2022
Swift exit: How the world cut off Russian banks
finance

Swift exit: How the world cut off Russian banks

24 Jun 2022