NCSC Urges Organisations to Secure Internet-Exposed OT and Edge Devices
Summary
The NCSC reports increased targeting of internet-exposed operational technology across sectors, with limited real-world disruption, and urges organisations to inventory exposed assets, harden access, monitor networks and prepare for recovery.
Key points
- The NCSC has observed increased targeting of OT systems across sectors globally, including the UK, by multiple threat actors; some activity caused limited real-world disruption.
- Organisations should verify which OT assets are internet-accessible and identify exposure caused by misconfiguration, legacy connections or unmanaged devices.
- The NCSC recommends unique administrator accounts, MFA where supported, secure authentication, supported and updated edge devices, and restricting management access to segregated networks.
- Organisations should use secure protocols where possible, monitor OT connectivity for unexpected access, and segment OT, management and business IT networks.
- Maintain tested, ransomware-resistant backups of OT systems and configurations, and practise isolation, restoration and recovery procedures.
- Non-OT organisations should inventory internet-facing systems, promptly update or retire edge devices, disable insecure management protocols and monitor for unexpected changes or connections.
- The NCSC encourages organisations to review incident readiness and use its Early Warning service, Cyber Assessment Framework or Cyber Essentials as appropriate.
Article Details
- Defense Focus
- Reduce disruptive cyber risk to internet-exposed operational technology and edge devices through exposure management, secure access, monitoring, segmentation, and recovery readiness.
- Detection Methods
- Build and maintain an inventory of OT assets, communications pathways, and external connections to identify exposed, unmanaged, or legacy-connected systems.
- Baseline expected OT communications and investigate connections to PLCs and HMIs from unexpected devices, networks, or routes.
- Monitor OT and edge devices for unexpected configuration changes and outbound connections.
- Use the NCSC Early Warning service to identify publicly exposed vulnerabilities and other potential security issues affecting internet-facing systems.
- Data Sources
- Logs of connectivity to and within OT networks
- OT asset inventories, architecture, communications pathways, and external-connection records
- Configuration-change records and outbound-connection telemetry from edge devices
- Defensive Actions
- Verify which OT assets are internet-exposed; do not assume they are inaccessible, and ensure PLCs and HMIs are not directly exposed to the public internet.
- Change default credentials, prohibit shared passwords, use unique administrator accounts, enable MFA where supported, and prefer stronger authentication such as public/private key authentication where available.
- Restrict external access to OT and manage connectivity devices only from a segregated management network; keep supported devices updated and replace them before end of life.
- Adopt secure industrial and management protocols where possible; remove or isolate insecure protocols such as Telnet and SNMP v1/v2.
- Keep PLCs out of PROGRAM or other maintenance modes when not required, and protect controller logic against unauthorized writes.
- Segment management networks, OT control systems, and business IT networks, permitting only communications required for operations.
- Maintain tested, ransomware-resistant backups of OT systems, configurations, controller logic, and critical engineering data; practise isolation, restoration, and recovery.
- For non-OT environments, inventory internet-facing systems, promptly apply vendor security updates, retire end-of-life equipment, and monitor edge devices.
- Exercise incident response and recovery arrangements and assess resilience using the Cyber Assessment Framework or Cyber Essentials as appropriate.