NCSC Warns of Rising Threats to Internet-Exposed Systems and Edge Devices

The UK's National Cyber Security Centre (NCSC) has observed a significant increase in cyber activity targeting operational technology (OT) systems globally, with a notable impact on organizations within the UK. This surge in attacks, carried out by a diverse range of threat actors, has already resulted in tangible, albeit limited, real-world disruptions. The NCSC urges all organizations that utilize, deploy, or maintain OT systems to take this development seriously and conduct a thorough review of their security posture.

Any organization with internet-exposed OT systems is potentially at risk. The NCSC emphasizes that organizations should not assume their OT environments are inaccessible from the internet without explicit verification. Unintended exposure can arise from various factors, including misconfigurations, legacy connections that remain active, or the presence of unmanaged assets that lack proper security controls. This lack of visibility can create an inadvertent attack surface.

This advisory follows direct engagement by the NCSC with affected sectors and is part of broader national resilience efforts. The agency has been tracking a wider pattern of disruptive cyber activity for some time, perpetrated by both state-sponsored and non-state actors, impacting organizations across critical national infrastructure (CNI) and non-CNI sectors. The NCSC assesses that the threat from state actors employing offensive cyber capabilities, even outside of active conflict zones, has almost certainly increased due to technological advancements and heightened geopolitical instability.

In light of this evolving threat landscape, the NCSC recommends several key actions for organizations. These include prioritizing the prompt application of vendor security updates, implementing robust network segmentation to limit lateral movement, and enforcing strong access controls to prevent unauthorized entry. Maintaining visibility of all internet-exposed assets and edge network devices is crucial, alongside understanding their specific functions and data flows.

For organizations not directly operating OT, the advisory highlights that the broader pattern of disruptive cyber activity targeting internet-exposed systems and edge devices continues to affect all sectors. Previous advisories, such as those concerning poorly configured routers, underscore the importance of diligent asset management. Key actions for these organizations include maintaining an accurate inventory of internet-facing systems, disabling insecure management protocols like SNMP v1, SNMP v2, and Telnet, and actively monitoring for unexpected configuration changes or suspicious outbound connections.

Building long-term cyber resilience is paramount. Organizations should review their preparedness for significant cyber incidents, ensuring response and recovery plans are established, maintained, and regularly exercised. The NCSC strongly encourages all organizations to register for its free Early Warning service, which helps identify publicly exposed vulnerabilities and other potential security issues on internet-facing systems, thereby supporting proactive risk mitigation.

Furthermore, the NCSC recommends leveraging frameworks like the Cyber Assessment Framework (CAF) to assess security and resilience outcomes, particularly for systems supporting essential functions. For organizations seeking a foundational security standard, the Cyber Essentials certification provides a baseline of protection against common cyber threats, recommended by the UK government for all businesses.

The NCSC provides extensive resources to aid organizations in bolstering their defenses, including guidance on responding to cyberattacks, secure connectivity principles for OT, and vulnerability management strategies. These resources are vital for navigating the increasingly complex and dangerous cyber threat landscape.