Bitsight Research Identifies Exposed Industrial Control Systems – October 2, 2023

Overview

Bitsight has identified nearly 100,000 exposed industrial control systems (ICSs) owned by organizations around the world, potentially allowing an attacker to access and control physical infrastructure such as power grids, traffic light systems, security and water systems, and more.

To measure device exposure, Bitsight identified exposed ICSs and mapped them to our inventory of global organizations.

Visit the Bitsight Blog to learn more.

Use Bitsight to Identify Exposed ICSs

If Bitsight detects an ICS protocol, that ICS is exposed to the public internet. The following ICS protocols are searchable in the Security Performance Management (SPM) and Continuous Monitoring (CM) applications using the Open Ports filter:

• Modbus
• BACnet
• KNX
• EthernetIP – in product a.k.a “EtherNet/IP”
• Niagara Fox
• S7comm
• Lantronix and "Unsecured Lantronix"
• Automatic Tank Gauge (ATG) – in product a.k.a “fuel tank monitor”
• Moxa NPort – in product a.k.a. “Moxa Nport device”

SPM Application

In the SPM application, identify exposed ICS protocols using the Findings table.

1. Navigate to the Findings table (Risks > Findings).
2. Select the Risk Vector filter set, then select the Diligence filter set.
3. Locate and apply the Open Ports filter.
4. Use the search bar to search for a specific exposed ICS protocol in your company’s infrastructure.

CM Application

In the CM application, identify companies with exposed ICS protocols using the Companies List.

To view companies in your portfolio with exposed ICS protocols:

1. Navigate to the Companies List (Portfolio Risk > Companies List).
2. Search for and select the relevant protocol filters to apply them to the Companies List. This displays the companies in your portfolio that have the selected ICS protocols with an open port.

To view ICS protocol findings at a single portfolio company:

1. Select the options button at the far right of the company’s entry in the list, then select View Findings.
2. Search for an ICS protocol using the search box above the Findings table. The results set displays all findings related to the selected ICS protocol.