ICS Security Practitioners Share Real-World OT Risks and Lessons
Summary
Practitioners recount ICS/OT risks including IT-to-OT access attempts, a scan that stopped turbines, internet-reachable systems with default credentials, hidden assets and suspicious DNS traffic. Their experiences underscore inventory, monitoring and careful network and
Key points
- Fortinet incident responders reported that an apparently Iranian-linked actor repeatedly tried to move from a customer’s IT environment into OT. They said the actor never fully compromised OT and that remediation removed its access and persistence.
- A cybersecurity scan at a power-generation plant reportedly stopped both turbines shortly after it began, illustrating the operational risks of applying IT tools in OT environments.
- An assessment found unpatched Solaris servers and cameras using default credentials; the assessor reported being able to reach them from the public internet, escalate to root and issue commands to field control systems.
- A pharmaceutical company’s security team found shadow-connected and outdated systems, including Windows XP consoles and an active labeling machine with open USB ports. The team said it reduced exposure within 48 hours while accounting for safety and compliance constraints.
- Tenable described discovering thousands of devices across a manufacturing network and more than 1,000 previously unknown assets at two retail sites, including indirectly connected devices missed by other approaches.
- At a manufacturing facility, recurring DNS alerts involving unusually long, apparently encoded labels led investigators to identify a known malware infection; the account describes DNS tunneling as a suspected communication and exfiltration method.
- A manufacturing risk assessment found broader IT/OT connectivity than expected; teams mapped communication patterns and enforced policies to remove unnecessary pathways while preserving legitimate traffic.
Article Details
- Topic
- Real-world security risks and exposure in industrial control systems and operational technology environments
MITRE ATT&CK
People
Agnidipta SarkarDescribed identifying shadow IT, vulnerable systems, and unmanaged connections in OT environments and coordinating remediation while accounting for GMP constraints.Brian ProctorDescribed a vulnerability scan at a power generation plant that caused both turbines to stop.Dan HewittShared OT security deployment experiences involving discovery of exposed control systems and previously unknown assets in manufacturing and retail distribution environments.John SimmonsFortiGuard Incident Response representative who described an investigation into attempted movement from a customer’s IT environment into its OT systems and remediation of persistent access.Jose BonillaDescribed investigating suspicious DNS traffic from a manufacturing computer that led to the identification of malware.Kevin PaigeDescribed discovering exposed, unpatched Solaris servers and network cameras with default credentials that could reach industrial field control systems.Morey HaberDescribed work installing a client-approved solution at a secure facility and the discovery that a contractor had loaded unauthorized software.Nicholas DiColaDescribed mapping connectivity between IT and OT systems and reducing unnecessary network pathways to limit lateral movement.Vivek PonnadaDescribed advising an oil and gas refinery on assessing and documenting OT risks and identifying appropriate mitigations.
Vendors
Products
Cisco SwitchesThey chuckled and said, look around you – we’ve workstations all on Windows XP, out of support Cisco Switches etc., so we know it’s risky.SolarisThe Solaris servers hadn’t been patched in years, and local accounts, like the cameras, were on default credentials.Tenable OTHowever, when we deployed Tenable OT and directed it to perform remote discovery of their manufacturing environment, it came back with thousands of devices.Windows XPWe found Windows XP consoles that were not connected to the IT network but had a nearby LAN port.
Industries
GovernmentDid I say this was a secure government facility?Oil and gas“Walked into an oil and gas refinery to discuss a risk assessment.Power Generation“Working at a combined-cycle power generation plant, a cybersecurity compliance member walked in the room and said, “I’m gonna conduct a vulnerability scan on the turbine networks.” I replied, “Oh no, you aren’t; this