“The motivation of the malicious actors is irrelevant; if an organization’s exposed sensitive systems are exposed to the internet with no security hardening, they are at risk of a compromise,” said Thomas Richards, infrastructure security practice director at Black Duck. “Many times, these systems are provided with internet access for remote connectivity from support teams and vendors, but this creates a major security risk without restricting who can access it and adding proper authentication controls.”
On the subject of remote access to OT networks, CISA recommended that for essential remote access, upgrading to a private IP network connection to remove these OT assets from the public internet or using a virtual private network (VPN) functionality with a strong, phishing-resistant MFA authentication might help.
Additionally, organizations must document and configure remote access solutions to apply principles of least privilege. “The recommendations to secure these environments aren’t advanced security measures, they’re foundational practices that should already be in place,” Hempel noted.
