These systems have traditionally been kept separate from IT networks, and are even often owned, managed, and operated by a different team inside the organization. That’s because OT systems are often tasked with monitoring and managing the highly sensitive processes associated with critical infrastructure. The other is that these systems can be notoriously delicate. Something as benign as an active system scan can cause these devices to fail. And any failure or compromise can have serious if not catastrophic results.However, new requirements being driven by digital transformation, such as smart environmental control systems, just in time manufacturing, and interactive systems tied to Big Data have begun to change all of that. In addition, companies are looking for productivity improvements and cost savings by implementing changes such as optimizing plant operations, deploying a more flexible operating environment, or establishing a more proactive inventory control system that requires real time online data. As a result, many of today’s OT systems are transited or tunneled over corporate networks, leverage common internet protocols, run on general-purpose hardware and mainstream operating systems, and are increasingly connected via wireless technologies. Which also makes them targets for cybercriminals looking to steal data or proprietary processing systems, or simply to cause havoc.In the Q3 2017 Threat Landscape Report, the FortiGuard Labs team identified a number of new attacks targeted at ICS, which generally lie much further under the radar than those targeting widespread IT aplications. For instance, the most prevalent ICS-related detection in Q3, according to our sensors, was reported by nearly 1 in 100 firms. However, this seemed to be an anomaly as no other ICS exploit even crossed the 1 in 1,000 threshold. Since then, however, FortiGuard has seen a steady uptick in ICS exploit activity and our intelligence operations suggest these under-the-radar attacks might be climbing higher on attackers’ priority lists.Case in point are the recent revelations around the Triton (Trisis) attack. Triton targets safety instrumental systems (SIS), and is very sophisticated in nature, especially with regards to its ability to cover its tracks and thwart forensics. SIS are designed to protect assets and ensure a safe and stable environment within a plant, and Distributed Control Systems (DCS) allow a plant operator to control industrial processes within their environment. In order to control costs and simplify ease of use, many plants are moving towards integrating DCS and SIS machines, making these systems a tempting target of attack.Fortunately, in the case of Triton, plant operators were able to discover the attack because safety mechanisms put the SIS into failsafe mode as a precautionary measure when the attack caused the SIS system to behave in unexpected ways. However, we can’t rely on this sort of serendipity to protect us. This attack is especially concerning because our analysis of Triton indicates that it was designed to cause physical damage. Scenarios for achieving this include hijacking the SIS to terminate processes, run in an unsafe state, and even manipulate other DCS controls. To cover its tracks, Triton is able to overwrite the malware itself with garbage data to thwart forensic analysis.