Dragos Releases Annual Industrial Control Systems Cybersecurity 2020 Year in Review Report

Report captures 3x rise in threats converging with hyperconnected industrial environment; recommends improvements to provide safe and reliable operations

HANOVER, MD, February 24, 2021 –  Dragos, Inc., the global leader in cybersecurity for industrial controls systems (ICS)/operational technology (OT) environments, today released its annual ICS 2020 Year in Review (YIR) report. The Dragos YIR report is an annual analysis of ICS/OT focused cyber threats, vulnerabilities, assessments, and incident response insights.

“In 2020, the industrial community performed amazing feats to keep civilization running under challenging circumstances through a global pandemic.” said Robert M. Lee, Chief Executive Officer and Co-Founder of Dragos, Inc. “A universal impact of this effort is the acceleration of businesses operating in a hyperconnected industrial environment. Data from our YIR report shows that this trend corresponds with a 3X rise in ICS-focused threats. The convergence of an increasingly ICS-aware and capable threat landscape with the trend towards more network connectivity means that the practical observations and lessons learned contained in our 2020 YIR report are timely as the community continues to work to provide safe and reliable operations.”

Dragos’s annual YIR report has been designed since its inception in 2017 to share data-informed observations and lessons learned with the industrial community for their independent analysis and consideration. For many years, the community has struggled with a lack of publicly available insights into cyber threats, vulnerabilities, assessments, and incident response incidents, which has made it difficult to have a meaningful dialog on how best to address these issues. To make the YIR report conclusions accessible to as wide an audience as possible, an all-new, interactive ICS Cybersecurity Year in Review web page has been developed and launched for 2020. This resource will enable the industrial community to better visualize the data and key takeaways.

Details of 2020 Year in Review:

• ICS Threat Landscape Highlights: ICS threat activity continues to rise – both in terms of the number of distinct groups Dragos is tracking and the industries and regions that they are targeting. Dragos analysts identified four distinct new ICS Activity Groups primarily targeting energy and manufacturing, known as KAMACITE, STIBNITE, TALONITE, and VANADINITE. The eleven previously identified Activity Groups were also observed expanding their targeting to new sectors and regions, as well as modifying their behaviors with many seeking to exploit the tectonic shift to remote work to gain access to industrial networks.
• ICS Vulnerability Highlights: Dragos researchers analyzed 703 ICS/OT vulnerabilities in 2020, a 29 percent increase over 2019, demonstrating the rise in publicly known flaws in systems supporting industrial operations. Analysis of these vulnerabilities and related advisories found that a slim minority could be classified as flaws that require immediate actions, such as critical vulnerabilities with perimeter-facing and network exploitable vulnerabilities.
• Lessons Learned from the Front Lines: Based on a growing set of data gathered from annual service engagements conducted by Dragos’s cybersecurity experts across multiple industries (electric, oil and gas, food and agriculture, manufacturing, chemical, transportation, water and wastewater, building automation equipment, mining, etc.), Dragos found that 90% of its services clients had little to no visibility into their ICS environments. While most clients demonstrated a focus on an enhanced asset inventory, this effort is only the foundation for asset visibility. Many customers only monitored the IT to OT boundary without monitoring activity inside the ICS network.

Recommendations for Improvement:

As organizations strategize a path forward, Dragos recommends five key OT cybersecurity initiatives to improve in 2021 and beyond. These are based on the empirical evidence provided throughout the report. 

The top 5 recommendations to enhance the security of an ICS environment are:

• Increase OT Network Visibility
• Identify & Prioritize Crown Jewels
• Boost Incident Response Capabilities
• Validate Network Segmentation
• Secure Credential Management

An all-new, interactive ICS Cybersecurity Year in Review web page has been developed and launched for 2020: https://www.dragos.com/year-in-review/

The full ICS 2020 Year in Review report can be downloaded here: https://hub.dragos.com/2020-year-in-review-download/