Authored by Lesley Carhart and Jan Hoff.
OT cybersecurity is a fascinating space to work in. We see some of the most novel technologies in the world, but we also spend a lot of time working with computers over ten, twenty, or even thirty years old. There’s a temptation to focus on the “new and exciting,” but it’s important to remember that a large percentage of the world’s critical infrastructure is still working with legacy and end-of-life devices. Their problems are valid and important.
That’s why we spent the last few months researching a continuous rise in incident response activations and detections tied to prolific but legacy infections. Over the past few years, we’ve seen a sharp increase in requests for help with infections like Sality, Gammima, WannaCry, and Conficker in OT networks. This is likely due to a combination of factors: more networking and remote access exposing industrial systems, better visibility into network conditions, and increased regulation demanding that critical infrastructure networks stay clean. Regardless, many of the networks we’re called into are dealing with 20-70 discrete variants of commodity malware across multiple subnets.
From the outside, as an enterprise cybersecurity leader or professional, it’s easy to wave off infections like this. After all, they’re trivial to clean up in a modern network (if computers get infected at all). Agent-based security such as Endpoint Detection and Response makes detection and cleaning a breeze. Reimaging infected workstations from incremental backups is simple.
That’s just not the case in most industrial environments. Not only do operational concerns and vendor restrictions prohibit agent installations, but many of these systems predate Windows XP SP2 and don’t support real-time antivirus at all. They can’t be modified outside certified-safe parameters. Cleanup often means network segmentation and slow, manual work by hand. It also requires knowledge of operating systems that are older than many cybersecurity analysts.
Then there’s the alternative view, held by many OT personnel: the infection is nearly 20 years old and has been “mostly fine” until now, so why not leave it in place? That’s also dangerously dismissive. The industrial computers in question are aging, and repeated infections drain resources on systems that are already failing, which can destabilize infrastructure that needs to stay stable for safe, consistent operations. On top of that, critical infrastructure regulation in multiple countries has increased cleanliness and incident reporting requirements. All of this must be risk-assessed by the appropriate stakeholders.
So, we produced a white paper discussing all these considerations in detail, including an appendix of available tools and recommended analysis techniques for legacy computers and the malware affecting them, most of which have very little vendor support left. We’ve broken the possible options into three general categories, aligned with the “Now, Next, Never” philosophy.
The first option is to shut down operations and immediately clean up the infection(s). This should be considered if analysis and risk assessment shows the infection could affect operations, safety, or regulatory compliance enough to outweigh the disruption of an unplanned outage. It’s risky not just operationally, but also in terms of effectiveness: if the infection isn’t properly scoped, and any systems or shares are left uncleaned, it may propagate again immediately and require another full cleanup. Given the poor security posture of legacy systems, these infections can become deeply embedded.
The second option is to wait for the next planned maintenance outage and build a project plan to remove the malware and limit its future spread, using a combination of policy, network, and host controls. Common tactics include reducing the removable device footprint, restricting common lateral movement ports and protocols, and removing (or adding) optional Windows features. This allows time for proper scoping of the infection and a comprehensive risk assessment.
Finally, the third option is to make an informed, calculated decision to leave one or more infections in place. This requires a solid understanding of the malware’s capabilities and how it interacts with the system and network, consultation with engineers and vendors on the condition and resources of the infected network and hosts, and analysis of the potential process consequences. If the risks of cleaning outweigh the risks of leaving the malware in place, then monitoring it until system replacement may be the more prudent choice. This can be an uncomfortable call for enterprise security leadership to make.
If you’re dealing with commodity infections such as Conficker in your OT networks, give our paper a read and make use of the references we’ve provided. You can’t approach this the way you would an enterprise IT problem, and the stakes are different. And know that you’re not alone: critical infrastructure and manufacturing organizations around the world are dealing with similarly challenging infections.
Our white paper, Practical Considerations for Legacy Commodity Malware Cleanup in OT, covers the full risk framework, tooling appendix, and analysis techniques.