In a report released today by Honeywell (NYSE: HON)based on cybersecurity threat data collected from hundreds of industrial facilities globally, the severity of threats detected to operational technology (OT) systems has risen by significant amounts over a12-month period.
The findings from the latest Honeywell Industrial USB Threat Report show thatthe total amount of threats posed by USB removable media to industrial process control networks remains consistently high, with 45% of locations detecting at least one inbound threat. Over the same time period, the number of threats specifically targeting OT systems nearly doubled from 16 to 28%, while the number of threats capable of causing a loss of view or other major disruption to OTsystems more than doubled, from 26 to 59%.
The report showsthat 1 in 5of all threats wasdesigned specifically to leverage USB removable media as an attack vector, andmore than half the threats were designed to open backdoors, establish persistent remote access or download additional malicious payloads. These findingsare indicative of more coordinated attacks, likely attempting to target air-gapped systems used in most industrial control environments and critical infrastructure.
“USB-borne malware continues to be a major risk for industrial operators,” said Eric Knapp, director of Cybersecurity Research and engineering fellow, Honeywell Connected Enterprise, Cybersecurity. “What’s surprising is that we’re seeing a much higher density of significant threats that are more targeted and more dangerous. This isn’t a case of accidental exposure to viruses throughUSB – it’s a trend of using removable media as part of more deliberate and coordinated attacks.”
The Honeywell Industrial USB Threat Reportexamines data collected from Honeywell’s Secure Media Exchange (SMX)technology, which is designed to scan and control removable media, including USB drives. As the second most prevalent attack vector into industrial control and automation systems, USB devices play an important role in attacks that target OT systems. In recent years, such attacks have included Disttrack, Duqu, Ekans, Flame, Havex, Industroyer,USBCulprit and others.
To reduce the risk of USB-related threats, Honeywell recommends that organizations implement a blend of OT cybersecurity software products and services such as Honeywell’s Secure Media Exchange (SMX),the Honeywell Forge Cybersecurity Suite, people training and process changes.
SMX provides operators with unprecedented control and visibility into the more secure use of USB technology with the latest in advanced threat detection capability for critical infrastructure and facilities. The Honeywell Forge Cybersecurity Suite can monitor for vulnerabilities such as open ports or the presence of USB security controls to strengthen endpoint and network security, and it helps ensure better cybersecurity compliance.
For more information on Honeywell products and services that can help reduce cybersecurity risk, visit Honeywell Forge Cybersecurity.
