The excessive use of remote access tools in operational technology (OT) environments can increase the attack surface, complicate identity management, and hinder visibility, according to cyber-physical systems security firm Claroty.
Claroty has conducted an analysis of data from more than 50,000 remote access-enabled devices present in customers’ OT environments.
Remote access tools can have many benefits for industrial and other types of organizations that use OT products. However, they can also introduce significant cybersecurity problems and risks.
Claroty found that 55% of organizations are using four or more remote access tools, and some of them are relying on as many as 15-16 such tools.
While some of these tools are enterprise-grade solutions, the cybersecurity firm found that 79% of organizations have more than two non-enterprise-grade tools in their OT networks.
“Most of these tools lack the session recording, auditing, and role-based access controls that are necessary to properly defend an OT environment. Some lack basic security features such as multi-factor authentication (MFA) options, or have been discontinued by their respective vendors and no longer receive feature or security updates,” Claroty explains in its report.
Some of these remote access tools, such as TeamViewer and AnyDesk, are known to have been targeted by sophisticated threat actors.
The use of remote access tools in OT environments introduces both security and operational issues.
When it comes to security — in addition to the lack of basic security features — these tools increase the organization’s attack surface and exposure as it’s not easy managing vulnerabilities in as many as 16 different applications.
On the operational side, Claroty notes, the more remote access tools are used the higher the associated costs. In addition, a lack of consolidated solutions increases monitoring and detection inefficiencies and minimizes response capabilities.
Moreover, “missing centralized controls and security policy enforcement opens the door to misconfigurations and deployment mistakes, and inconsistent security policies that create exploitable exposures,” Claroty says.
Related: Ransomware Attacks on Industrial Firms Surged in Q2 2024
Related: ICS Patch Tuesday: Advisories Released by Siemens, Schneider, Rockwell, Aveva
Related: Over 40,000 Internet-Exposed ICS Devices Found in US: Censys
