The Dragonfly campaign hangover in Spain (II)

I know Internet ICS open ports were not Dragonfly attack vectors but, in my opinion, that's not a good practice. There are a lot of open source and commercial solutions to access your industrial control devices over Internet in a secure and controlled way.

So, what the results were? .....

In this table you can see that the number of devices with these four open ICS protocol ports grew in the period.
On the other hand, the percentage of spanish open port devices compared with the total worldwide open port devices grew for ICCP and MODBUS TCP protocols, but decrease when talking about EthernetIP and BacNET protocols.

The summary data for the period is the following:

• Total open ports worldwide
• Total open ports in Spain
• Percentage of Spanish devices over worldwide devices

Some findings:

• Having in mind that the Spanish Gross Domestic Product on 2013 was just 1,83% of the worldwide GDP, every percentage protocol is over that. (Sometimes 3 or 4 times over)
• Although the growth in the period is not big, it is a tendency just one month after a serious incident on industrial control systems organizations. Is our Cyber Security awareness growing in Spain? (I don't think so)
• Most of the systems recorded by SHODAN were installed in critical sectors (as the banners showed). 

Some easy advices:

• Shodan yourself!!!!. (It's Free and easy)
• Ask your ICS provider for secure remote access solutions if you really need it.
• Read this Blog peridically. (It's Free as well)