How to quantify ICS exposure on the Internet when the data is out to get you

Industrial control system devices that speak automation protocols are often counted across the internet to illustrate how severe the exposure problem is, but raw totals can be misleading. The talk looks at why simply tallying everything that resembles ICS overstates real exposure, since honeypots and personal or lab setups get mixed in with production equipment.

The method starts from a full IPv4 scan and adds extra detection logic for protocols and web-based control panels that the baseline scanning missed. Known ICS honeypots such as GasPot and Conpot are recognised by differences in their responses and removed from the data. The US dataset narrows from roughly 57,000 exposed devices to about 18,000 after excluding building-automation protocols that sit at the edge of water-sector relevance. Network ownership metadata from DNS and WHOIS revealed little, so the team turned to exposed web interfaces, which often display facility names and let them identify owners for about half of the roughly hundred water-related panels found.

The main takeaway is that the number of devices matters less than what those devices control. The verifiable systems were often municipal water facilities with no authentication in front of them. The talk closes by noting that accurate counting is harder than it looks, and it touches on manufacturer incentives, regulation, and the limited resources of small utilities.