How threat actors abuse ICS-specific file types

Abstract

Project files are integral to industrial control system (ICS) solutions, providing all the necessary data and instructions each machine on the operational technology (OT) network needs to operate. While engineers will use them to ensure the smooth running of operations, security teams can use them to gather an accurate picture of what machines are running on the system along with other critical data, such as where they are and what they are supposed to be doing. Project files are integral to industrial control system (ICS) solutions, providing the data and instructions each machine on the operational technology (OT) network needs to operate. While engineers will use them to ensure the smooth running of operations, security teams can use these files to gather an accurate picture of what machines are running, along with other critical data, such as where they are and what they are supposed to be doing. However, extracting information from ICS engineering project files is not always straightforward, and a lack of full visibility into what is running on the network and how it normally functions presents a significant security risk, explains Nadav Erez at Claroty.