38% of Riskiest Cyber-Physical Systems Overlooked by Traditional Vulnerability Management Approaches, Claroty's Team82 Finds

Claroty Launches CPS-native Exposure Management Solution to Reveal and Prioritize Risks Facing Critical Systems

NEW YORK and SAN FRANCISCO, May 7, 2024 /PRNewswire/ -- Claroty, the cyber-physical systems (CPS) protection company, today released new proprietary data revealing that 38% of the riskiest CPS assets are overlooked by traditional approaches to vulnerability management, illuminating a major blind spot that is ripe for exploitation by threat actors. To address this blind spot, Claroty is introducing a complete built-for-purpose CPS exposure management solution, empowering organizations to minimize their attack surface by prioritizing the most immediate threats.

Organizations Are Blind to Some of Their Riskiest Exposures

To understand the scope of exposure and the associated risk facing CPS environments, Claroty's award-winning research group Team82 analyzed data from over 20 million operational technology (OT), connected medical devices (IoMT), IoT, and IT assets in CPS environments. The research focused on assets that are defined as "high risk," have an insecure internet connection, and contain at least one Known Exploited Vulnerability (KEV). Researchers defined "high risk" as having a high likelihood and high impact of being exploited, based on a combination of risk factors such as end-of-life state, communication with insecure protocols, known vulnerabilities, weak or default passwords, PII or PHI data, consequence of failure, and several others.

Key findings include:

• 20% of OT and IoMT have CVSSv3.1 scores of 9.0 or above – a metric representing the traditional approach to vulnerability management, relying solely on the Common Vulnerability Scoring System version 3.1.¹ This volume is too overwhelming and resource-intensive for most organizations to realistically address, especially on CPS assets with limited windows for patching, and provides no indication of where to start remediation efforts.
  
  
• 1.6% of OT and IoMT are defined as "high risk," have an insecure internet connection, and contain at least one KEV – the apex of exposure factors that together pose a real, imminent danger to organizations. This represents tens of thousands of high-risk CPS assets that can be accessed remotely by threat actors and contain vulnerabilities actively exploited in the wild.
  
  
• Of these ultra-high-risk OT and IoMT devices, 38% do not have a CVSS score of 9.0 or above – meaning they go unnoticed by traditional vulnerability management methods, yet are alarmingly ripe for exploitation by threat actors, signifying a high risk blind spot for organizations.

"It's important to understand the implications of any number higher than zero when measuring the risk associated with hyper-exposed assets used to control systems like the power grid or deliver life-saving patient care," said Amir Preminger, vice president of research for Claroty's Team82. "Organizations must take a holistic approach to exposure management that focuses on the ticking time bombs in their environment, because even if they somehow mastered the impossible task of addressing every single 9.0+ CVSS vulnerability, they'd still miss nearly 40% of the most dangerous threats to their organization."

Learn more about Team82's findings in "The CPS Blind Spot" report.

Closing the Gap with CPS-native Exposure Management

According to Gartner®, "Security leaders always look for improved frameworks and tools for reducing their cybersecurity risks. This includes a shift from a preventative-only approach to more mature, strategy-augmenting-preventative controls with detection and response capabilities. Previous approaches to managing the attack surface are no longer keeping up with digital velocity — in an age where organizations can't fix everything, nor can they be completely sure what vulnerability remediation can be safely postponed. Continuous threat exposure management (CTEM) is a pragmatic and effective systemic approach to continuously refine priorities, walking the tightrope between those two impossible extremes."²

To meet the evolving needs of manufacturing, healthcare, and other critical infrastructure organizations, Claroty is introducing a complete built-for-purpose CPS exposure management solution that Claroty believes aligns to the Gartner CTEM framework. The solution further equips customers to understand their current CPS risk posture, allocate their existing resources to improve it more efficiently and effectively, and ultimately accelerate their journey to CPS security maturity – no matter their starting point.

Key capabilities include:

• Inclusion of CPS Devices in Exposure Management Programs: Leverage multi-data collection methods and tailored risk calculations that account for the relative business value of different aspects of the production process. This approach lays the foundation for network scoping to both secure areas that may be blindspots for traditional enterprise solutions and account for operational outcomes when prioritizing security controls.
  
  
• CPS Discovery & Vulnerability Assessment: Identify and profile all CPS assets using highly flexible discovery methods, including Claroty Edge and associated SBOMs, mapping their communication paths and protocol usage, attributing vulnerabilities, and monitoring for threats, resulting in risk scores based on a transparent and uniquely tailored risk framework.
  
  
• Support Prioritization for Critical CPS Processes: Receive actionable recommendations that prioritize remediation efforts based on quantified outcomes as defined by specific attack vectors and their likelihood of being exploited, impact if exploited, and compensating controls that have been applied.
  
  
• Safe Validation of Exposure Scenarios: Go beyond vulnerability management by investigating exploitability using VEX files and additional discovery tactics such as active scanning techniques, or consulting with OEMs to validate risk assessments and enable proper remediation techniques.
  
  
• Streamline Remediation & Program Mobilization: Integrate with the industry's leading IT/OT cybersecurity and asset management solutions to streamline existing risk management processes and mobilize CPS exposure management.

"Taking a vulnerability-focused view alone doesn't help organizations focus on what matters most, leaving true exposures that can put safety and availability at risk," said Grant Geyer, chief product officer at Claroty. "Reducing risk requires an evolution from a traditional vulnerability management program to a more focused and dynamic exposure management program that considers unique CPS asset characteristics and complexities, unique operational and environmental constraints, organizational risk tolerances, and desired outcomes of the CPS cyber risk program."

To learn more about Claroty's CPS-native exposure management solution:

• Visit Claroty at RSA Conference 2024, taking place May 6-9 in San Francisco
• Register for the webinar, "Evolving CPS Cybersecurity: The Journey to Exposure Management," on Thursday, May 30, 2024 at 11:00 a.m. ET
• Read the CPS exposure management overview or the Claroty blog

About Claroty
Claroty empowers organizations to secure cyber-physical systems across industrial, healthcare, commercial, and public sector environments: the Extended Internet of Things (XIoT). The company's unified platform integrates with customers' existing infrastructure to provide a full range of controls for visibility, risk and vulnerability management, threat detection, and secure remote access. Backed by the world's largest investment firms and industrial automation vendors, Claroty is deployed by hundreds of organizations at thousands of sites globally. The company is headquartered in New York City and has a presence in Europe, Asia-Pacific, and Latin America. To learn more, visit claroty.com.

Media Contact:
Kelly Ferguson
[email protected]

SOURCE Claroty