Seven Years After Stuxnet, Industrial Firms Still Lag on Security

Seven years after Stuxnet, many industrial and manufacturing firms still lack basic ICS security controls: FireEye's “Subversive Six” highlights vulnerable protocols and software, outdated hardware, poor password practices, weak firmware integrity checks, vulnerable control logic and over-reliance on Windows and opaque third-party dependencies. The report urges improved monitoring (packet inspection, set-point monitoring), stricter update authorization, and file-integrity checking; DHS data is cited showing APTs were implicated in a majority of reported ICS incidents in 2014, underlining meaningful risk to critical infrastructure.