Operational Technology (OT) vulnerability management is a critical focus for large enterprises seeking to protect their critical infrastructure. As OT systems increasingly converge with IT networks, managing vulnerabilities effectively is more complex and urgent. This blog looks at the current “state of affairs” and the intricacies of effective OT vulnerability management.

Understanding OT Vulnerability Management

OT vulnerability management differs significantly from its IT counterpart. While IT vulnerability management often revolves around software updates and patches, OT environments require a more nuanced approach. OT systems, which include hardware and software that detect or cause changes through direct monitoring and control of physical devices, are often deeply integrated into industrial processes. These systems can consist of everything from SCADA systems to PLCs and various other industrial control systems (ICS).

The fundamental difference lies in the nature of the vulnerabilities themselves. In the IT world, vulnerabilities are usually associated with software. However, in OT, vulnerabilities are often tied to specific product versions, including firmware and software. The National Vulnerability Database (NVD) lists Common Vulnerabilities and Exposures (CVEs) primarily linked to software versions. The challenge for OT environments is identifying which vulnerabilities affect their installed base.

A Contextualized OT Asset Inventory’s Role

A contextualized OT asset inventory is paramount to effectively managing vulnerabilities in OT environments. With detailed knowledge of your installed base, you can assess which vulnerabilities are relevant to your systems. This means tracking the types of devices in use and their specific configurations, including firmware versions.

Consider an example from the NVD involving PowerFlex 525 drives, a type of actuator used in industrial settings. A specific vulnerability was identified in these devices, affecting those running firmware version 5001 or earlier. Without precise knowledge of which PowerFlex drives are in use and their firmware versions, an organization cannot determine whether it is at risk.

Managing Hundreds of Thousands of Vulnerabilities

Once a contextualized OT asset inventory is established, users better understand the sheer volume of vulnerabilities impacting their installed base. In a typical midsize manufacturing enterprise, hundreds of thousands of vulnerabilities are not uncommon. That is overwhelming even for the most prepared organizations.

Attempting to address all vulnerabilities is not feasible. While the traditional method of focusing solely on the CVE severity score is applicable in IT contexts, it is less effective in OT environments. Prioritization is needed.

Effective OT Vulnerability Prioritization

Effective OT vulnerability management requires a strategic approach to prioritization. The goal is to focus on vulnerabilities that pose the most significant risk to the organization. Consider the following key strategies for a company with 700,000 vulnerabilities:

1. Focus on Known Exploited Vulnerabilities (KEVs): By filtering vulnerabilities to include only those with known exploits, the number of vulnerabilities to manage can be significantly reduced. The KEV database maintained by the Cybersecurity and Infrastructure Security Agency (CISA) is valuable. For example, a company facing 700,000 vulnerabilities might reduce that number to around 23,000 by focusing on KEVs.

2. Prioritize Based on Attack Vector and Complexity: Not all vulnerabilities are created equal. Those that can be exploited remotely or with low complexity are often the most dangerous. The vulnerability list can be further narrowed by applying filters for remote exploitability and low attack complexity. This approach might reduce the list to approximately 7,700 vulnerabilities, making the task more manageable.

3. Consider Device Criticality: Another critical factor is the criticality of the devices affected by vulnerabilities. Devices that are essential to safety or business continuity should be prioritized. Focusing on critical devices can refine the vulnerability list even further, potentially down to around 5,500 vulnerabilities.

Localized Mitigation Efforts

Unlike IT environments, where patches can often be deployed centrally, OT environments typically require localized mitigation efforts. This means that control engineers at individual sites are responsible for applying patches or other remediation measures to the specific machines under their purview. For instance, engineers in any given plant might be tasked with addressing more than 2,700 vulnerabilities affecting critical devices.

Automation can significantly assist in this process. Modern OT asset management systems allow for filtered views of vulnerabilities, which can be saved and assigned to local engineers as remediation tasks. These systems also provide tracking and reporting features, enabling organizations to monitor progress and ensure that the most critical vulnerabilities are addressed on time.

The Importance of Automation in OT Vulnerability Management

Given the complexity and scale of OT environments, automation is essential for effective OT vulnerability management. Automated systems can match CVEs to the installed base of OT assets, update vulnerability data daily, and assist in prioritization. By automating as much of the process as possible, organizations can use their limited resources better and focus on the vulnerabilities that genuinely matter.