Dive Brief:
- More than half of operational technology environments contain at least four remote access tools, increasing the attack surface for potentially malicious threat activity, according to a report released Tuesday from Claroty, based on data from more than 50,000 remote access devices.
- One-third of OT environments contain six or more remote access tools, Claroty found. Most OT environments, 4 in 5, have more than two non-enterprise grade tools installed on OT network devices.
- These non-enterprise tools pose an even greater risk because they lack features to manage access privileges, such as auditing, role-based access controls and session recording. The non-enterprise tools also lack basic access features like multifactor authentication, Claroty said.
Dive Insight:
Remote access tools are widely used in OT settings and more threat activity is abusing these tools.
The report highlights the problem of managing security tool sprawl, which has become a major issue at companies with budget constraints, personnel shortages and alert fatigue. The report found 1 in 5 organizations run at least eight remote access tools, while some run as many as 16.
Remote access tools have been at the center of several major threat campaigns in the past year, Claroty said. Earlier this summer, the state-linked threat group Midnight Blizzard launched an attack against the IT network of TeamViewer, by abusing compromised employee credentials.
TeamViewer said no customer environments were compromised during that incident, however researchers from NCC previously warned organizations to disengage remote access tools from their environments.
A May report from At-Bay found remote access tools were the primary intrusion point across 3 in 5 ransomware attacks in 2023.
The Cybersecurity and Infrastructure Security Agency in January 2023 released a guide for how to protect against the malicious use of remote monitoring and management software.
