The Industrial Control System Cyber Emergency Response Team (ICS-CERT) released a report showing that 295 incidents involving critical infrastructure were reported in the U.S. in 2015, compared to 245 incidents in 2014.

Sources of these incidents come from a combination of self-reporting to ICS-CERT, Information Sharing Analysis Center (ISAC) reports shared with ICS-CERT, third-party and researcher reports and U.S. government sources. These numbers provide an indication of the frequency of incidents, but they should not be considered comprehensive since not all parties choose to share incident information.

Manufacturing Sector

The critical manufacturing sector had 97 reported incidents, which accounted for 33 percent of all incidents reported. This is due mostly to a widespread spear phishing campaign that targeted critical manufacturing companies, as reported in the September 2015 ICS-ALERT-15-198-01AP.

The attacker, believed to be the threat group known as APT3, exploited a zero-day vulnerability in Adobe Flash Player (CVE-2015-3113) in the campaign. Adobe said at the time that “systems running Internet Explorer for Windows 7 and below, as well as Firefox on Windows XP, are known targets.”

Bad Networks

But it wasn’t just spear phishing at work here. ICS-CERT found a significant number of incidents that were enabled by insufficiently architected networks, such as an ICS network being directly connected to the Internet. Corporate networks also fell into this insecure class, as well.

ICS-CERT also reported a sharp decline in the network scanning and probing incidents reported as compared to FY2014. ICS-CERT suggests that this decrease may not be representative of a reduction in incident frequency but in the capability of individual organizations to independently handle these low-level issues.

However, ICS-CERT reports, “Approximately 69 percent of incidents had no evidence of successful intrusion into the asset owner’s environment compared to 49 percent in FY2014. Of concern, however, is the 12 percent of incidents in FY2015 that had evidence of intrusion into the control system environment. This is up from 9 percent in FY2014.”

Other Sectors

The energy sector, which in 2014 accounted for 32 percent of these incidents, reported only 46 incidents in 2015 (a decrease of 16 percent of the total). Incidents were also reported in sectors such as water (25), transportation systems (23), government facilities (18), health care (14) and communications (13).

ICS-CERT recommends that asset owners concentrate on security fundamentals such as those outlined in the DHS/FBI/NSA joint publication “Seven Steps to Effectively Defend Industrial Control Systems” as well as ICS-CERT’s “Recommended Practice: Improving Industrial Control Systems Cybersecurity with Defense-In-Depth Strategies.”