Network anomalies and attacks are the most prevalent threat to OT and IoT environments, according to new research from Nozomi Networks Labs
SAN FRANCISCO, February 8, 2024 — The latest Nozomi Networks Labs OT & IoT Security Report released today finds that network anomalies and attacks were the most prevalent threat to OT and IoT environments. Vulnerabilities within critical manufacturing also surged 230% – a cause for concern as threat actors have far more opportunities to access networks and cause these anomalies.
Unique telemetry from Nozomi Networks Labs, collected from OT and IoT environments covering a variety of use cases and industries across 25 countries, finds network anomalies and attacks represented the most significant portion (38%) of threats during the second half of 2023. The most concerning of these network anomalies, which can indicate highly sophisticated threat actors being involved, increased 19% over the previous reporting period.
“Network scans” topped the list of Network Anomalies and Attacks alerts, followed closely by “TCP flood” attacks which involve sending large amounts of traffic to systems aiming to cause damage by bringing those systems down or making them inaccessible. “TCP flood” and “anomalous packets” alert types exhibited significant increases in both total alerts and averages per customer in the last six months, increasing more than 2x and 6x respectively.
"These trends should serve as a warning that attackers are adopting more sophisticated methods to directly target critical infrastructure, and could be indicative of rising global hostilities,” said Chris Grove, Director of Cybersecurity Strategy at Nozomi Networks. “The significant uptick in anomalies could mean that the threat actors are getting past the first line of defense while penetrating deeper than many would have initially believed, which would require a high level of sophistication. The defenders have gotten better at protecting against the basics, but these alerts tell us that the attackers are quickly evolving in order to bypass them.”
Alerts on access control and authorization threats jumped 123% over the previous reporting period. In this category “multiple unsuccessful logins” and “brute force attack” alerts increased 71% and 14% respectively. This trend highlights the continued challenges in unauthorized access attempts, showing that identity and access management in OT and other challenges associated with user-passwords persist.
Below is the list of top critical threat activity seen in real world environments over the last six months:
With this spike in network anomalies top of mind, Nozomi Networks Labs has detailed the industries that should be on highest alert, based on analysis of all ICS security advisories released by CISA over the past six months. Manufacturing topped the list with the number of Common Vulnerabilities and Exposures (CVEs) in that sector rising to 621, an alarming 230% increase over the previous reporting period. Manufacturing, Energy and Water/Wastewater remained the most vulnerable industries for a third consecutive reporting period – though the total number of vulnerabilities reported in the Energy sector dropped 46% and Water/Wastewater vulnerabilities dropped 16%. Commercial Facilities and Communications moved into the top five, replacing Food & Agriculture and Chemicals (which both dropped out of the top 10). Of note, Healthcare & Public Health, GovernmentFacilities, Transportation Systems and Emergency Services all made the top 10. In the second half of last year:
Nozomi Networks Labs also analyzed a wealth of data on malicious activities against IoT devices, revealing several notable trends for these industries to consider. According to the findings, malicious IoT botnets remain active this year, and botnets continue to use default credentials in attempts to access IoT devices.
From July through December 2023, Nozomi Networks honeypots found:
Nozomi Networks Labs “OT & IoT Security Report – February 2024” provides security professionals with the latest insights needed to re-evaluate risk models and security initiatives, along with actionable recommendations for securing critical infrastructure.
Nozomi Networks protects the world’s critical infrastructure from cyber threats. Our platform uniquely combines network and endpoint visibility, threat detection, and AI-powered analysis for faster, more effective incident response. Customers rely on us to minimize risk and complexity while maximizing operational resilience. www.nozominetworks.com