New research reveals most-attacked, most-vulnerable assets

New research from security company Armis has revealed the riskiest assets introducing threats to global businesses. Armis' research focused on connected assets with the most attack attempts, weaponized Common Vulnerabilities and Exposures (CVEs), and high-risk ratings. Based on data from the Armis Asset Intelligence Engine, it found that internet of medical things (IoMT) assets- connected devices used in medical/healthcare environments - are the most susceptible to unpatched, weaponized CVEs, while operational technology (OT) assets are the most attacked.

IoMT assets most susceptible to unpatched, weaponized CVEs

Armis researchers identified a significant number of network-connected assets susceptible to unpatched, weaponized CVEs, listing the highest percentage of devices of each type that had these CVEs between August 2022 and July 2023. Unpatched, these assets introduce significant risks to businesses.

According to Armis, the assets most vulnerable to unpatched, weaponized CVEs are:

1. Media writers (IoMT), 62%
2. Infusion pumps (IoMT), 26%
3. IP cameras (IoT), 26%
4. Media players (IoT), 25%
5. Switches (IT), 18%
6. Engineering workstations (OT), 17%
7. Personal smartwatches (IoPT), 16%
8. Routers (IT), 15%
9. SCADA servers (OT), 15%

It is unsurprising to see medical assets topping the list. In January 2022, Cynerios's State of IoMT Device Security report found that more than half (53%) of the internet of things (IoT) and IoMT devices used in US healthcare pose critical cybersecurity risks with significant vulnerabilities that could jeopardize patient safety, data confidentiality, or service availability if exploited. In June this year, it was revealed that one-third of the UK's National Health Service (NHS) Trusts have no method for tracking IoT devices, potentially exposing information and services to significant security risks.

OT assets most targeted by attacks

The top 10 asset types with the highest number of attack attempts are distributed across IT, OT, IoT, IoMT, internet of personal things (IoPT), and building management system (BMS) assets, Armis found. This demonstrates that attackers prioritize potential access to assets rather than their type, reinforcing the need for security teams to account for all physical and virtual assets as part of their security strategy, the firm said.

The top 10 device types with the highest number of attack attempts are:

1. Engineering workstations (OT)
2. Imaging workstations (IoMT)
3. Media players (IoT)
4. Personal computers (IT)
5. Virtual machines (IT)
6. Uninterruptible power supply (UPS) devices (BMS)
7. Servers (IT)
8. Media writers (IoMT)
9. Tablets (IoPT)
10. Mobile phones (IoPT)

Threat actors intentionally target these assets because they are externally accessible, have an expansive and intricate attack surface, and known weaponized CVEs, said Tom Gol, CTO of research at Armis. "The potential impact of breaching these assets on businesses and their customers is also a critical factor when it comes to why these have the highest number of attack attempts." For example, engineering workstations can be connected to all controllers in a factory, imaging workstations will collect private patient data from hospitals, and UPSs can serve as an access point to critical infrastructure entities, making all of these attractive targets for malicious actors, he added.

Many assets have high vulnerability scores, detected threats, unencrypted traffic

Armis also examined asset types with the most common high-risk factors. Physical devices that take a long time to replace - such as such as servers and programmable logic controllers (PLCs) - often run end-of-life (EOL) or end-of-support (EOS) operating systems. This makes them particularly high risk, especially as EOS assets are no longer actively supported or patched for vulnerabilities/security issues by manufacturers, Armis stated.

Some assets, including personal computers, demonstrate SMBv1 usage, a legacy, unencrypted, and complicated protocol with vulnerabilities that were targeted in the infamous WannaCry and NotPetya attacks. Armis found that 74% of organizations today still have at least one asset in their network vulnerable to EternalBlue, an SMBv1 vulnerability. Meanwhile, Armis found that 50% of pneumatic tube systems - technical equipment in which cylindrical containers are propelled through a complex network of tubes -have an unsafe software update mechanism.