2024年运营技术/工业控制系统网络安全年度报告

Contents Introduction�������������������������������������������������������������������������������������������������04Methodology������������������������������������������������������������������������������������������������06Executive Summary����������������������������������������������������������������������������������������08 2024Annual OT/ICSCybersecurity Report Chapter 1: The Changing Threat Landscape of OT Environments�������������������������������10 Spill-Over Effects of IT-OT Integration: Human Factor is Key                                                10 Ongoing Geopolitical Risks for Critical Infrastructure                                                        11Exploiting Supply Chains and Vulnerabilities                                                                 14 Emerging Industrial Control System Malware                                                                 15 Ransomware: The Need for Ongoing Vigilance                                                              16 Chapter 2: Prioritizing Vulnerabilities and Overcoming Patching Challenges���������������20 Known Exploited Vulnerabilities in 2024                                                                     23Infrequent Patching in OT Environments                                                                     24Overcoming Patching Challenges in OT Environments                                                      25Critical Defense Measures During Patch Delays                                                              28Dynamic Patch Prioritization Model                                                                          29 Cyber-Informed Engineering: From Defense to Design Upgrades                                           36 Supply Chain Security Management as a Primary Focus for the Future                                     37Regulatory Requirements for Dynamic Risk and Response Management                                   40Enhancing Incident Reporting and Information Sharing                                                      41 Chapter 4: Overcoming Pitfalls and Securing the Future Perception vsReality: Overcoming False Security and Achieving True OT Cybersecurity                  42 Budget Alone is Not Enough: The Challenges of Implementation                                           43Secure by Design: The Necessity of Tailored Solutions                                                       45Future Priorities: Supply Chain Audits and Third-Party Risk Management                                  46 Enhancing OT Asset Visibility                                                                                 46Implementing Patch Management Strategies                                                                48Conclusion���������������������������������������������������������������������������������������������������50Reference����������������������������������������������������������������������������������������������������52 The rapid growth of digital technologies within modern enterprises is reshaping the boundaries between InformationTechnology (IT) and Operational Technology (OT) systems. Historically, these domains operated in silos, each indepen-dent and disconnected, a configuration that often left organizations grappling with fragmented architectures and cum- Key Areas of Focus This research will analyze the multi-faceted dimensions of cybersecurity risks, vulnerabilities, and compliance demands, •Prevalent Threat Landscape: Examining the most common attack vectors and outlining practical, implementable The convergence of IT and OT ecosystems has been accelerated by the industrial Internet of Things (IIoT), encompassingtechnologies like industrial control systems (ICS), smart sensors, edge computing devices, asset tracking solutions, andremote monitoring tools. While t