(TLP:CLEAR) Why Every Published Count of Exposed Rockwell PLCs Differs, and What That Means for Your Utility

Summary: Due to the recent attacks at water and wastewater entities across the country, and following CISA’s July 30 alert, multiple organizations (including Censys) have published counts of how many Rockwell programmable logic controller (PLC) devices are exposed on the public internet. An analysis by Flare, a cyber threat intelligence company, found those counts disagree wildly (ranging from about 4,148 down to roughly 1,512 U.S. devices). Flare made sure to indicate the exposure has not changed between counts, but the way each group counted did. Some counts treat every internet address as a separate device, when a single facility often uses several addresses at once. Many of the devices being counted are not controllers at all, but the cellular modems sitting in front of them. Some counts include decoy systems (honeypots) set up to attract attackers, and none of them capture older Allen-Bradley controllers that use a different, dated connection method.

Analyst Note: The main takeaway for members is that no outside scan can truly tell you whether your own systems are exposed. While those numbers and the information gathered can help a sector-wide understanding of the vulnerabilities that exist, they are not a substitute for checking your own network. WaterISAC encourages members to look at their own internet-facing addresses directly rather than relying on someone else’s count. A few points are worth keeping in mind. Much of this exposure was set up by outside integrators or vendors and was never recorded in the utility’s own equipment list, so ask your vendors what they installed and whether it can be reached from the internet. Securing a controller does little good if the modem in front of it is still open, so check both. Because many of these devices go offline and come back, a single clean scan can be misleading, so check more than once.

Original Source: https://flare.io/learn/resources/blog/minnesota-water-system-cyberattackscount-exposed-rockwell-plcs-differs

Additional Reading:

• CISA Urges Water and Wastewater Systems Sector to Protect OT Against Activity Targeting PLCs
• Malicious Cyber Actors Targeting Water and Wastewater Sector Internet-Facing PLCs
• (Censys) CISA Alert: Water Sector PLC Targeting Exposure Characterization