Vulnerability Management in Atypical Environments: ICS, Networks, IoT, Mobile, Hardware, and ML Systems

Vulnerability management follows the same fundamental cycle everywhere: discover assets, scan for weaknesses, assess severity, agree on remediation timelines, apply fixes or compensating controls, and verify closure. The devil lies in the details when these processes are applied to industrial control systems, network infrastructure, IoT devices, mobile endpoints, hardware, and machine-learning platforms.

ICS environments introduce the highest stakes because exploitation can cause physical harm rather than data loss. A dedicated process owner for SCADA and PLC systems must participate in every decision. Scanning must use authenticated audit mode rather than aggressive black-box techniques, exclude non-redundant systems, and follow narrowly scoped plans limited to specific IP addresses and profiles. Patches can only be applied during planned outages with tested rollback procedures, often after validation on a digital twin. CVSS 4.0 Safety metrics become essential for prioritization.

Network devices commonly suffer from missing or incorrect segmentation, overly permissive firewalls, and default SNMP community strings such as “public” and “private.” Legacy SNMPv1/v2c transmits data in clear text, allowing both reconnaissance and active configuration changes. Additional frequent issues include outdated Wi-Fi protocols, Telnet or HTTP management interfaces, weak passwords, and lack of multi-factor authentication. Recommended controls include strict least-privilege ACLs, VLAN segmentation with inter-VLAN routing only through firewalls, RBAC, and migration to SNMPv3 with encryption.

IoT devices remain a persistent source of large-scale botnets because vendors ship products with default credentials and rarely release firmware updates. The Mirai botnet, built on 61 hardcoded username-password pairs, famously disrupted DNS provider Dyn in 2016, taking down Twitter, Netflix, Reddit, and other major services. Later variants such as Reaper and VPNFilter shifted to known firmware vulnerabilities, infecting hundreds of thousands of routers and NAS devices. Defenses include immediate password changes, network segmentation, disabling unnecessary services such as Telnet and UPnP, and selecting vendors that publish updates. Tools like Shodan make both defensive auditing and attacker reconnaissance trivial.

Machine-learning systems face new attack classes documented in the OWASP Top 10 for LLM Applications. Prompt injection embeds malicious instructions inside legitimate-looking input, causing the model to ignore safety policies or leak secrets. Prompt leaking tricks the model into revealing its hidden system prompt, while jailbreaking bypasses built-in restrictions. Classic injection techniques such as SQL or command injection can also be delivered through prompts. Protections require input validation, output filtering, least-privilege model permissions, and continuous monitoring for anomalous behavior.

Mobile devices introduce fragmentation challenges. Historical examples include Stagefright (2015), Pegasus spyware, BlueBorne (2017), and QuadRooter (2016), all of which affected hundreds of millions of devices yet remained unpatched on many handsets for years. Corporate programs rely on MDM/EMM platforms for policy enforcement, application whitelisting, remote wipe, and centralized update monitoring, supplemented by encryption, VPN, and multi-factor authentication.

Hardware and firmware vulnerabilities demonstrate that risks exist below the operating system. Notable cases include BadUSB, which reprograms USB microcontrollers to emulate keyboards, Thunderstrike UEFI implants, and the Spectre and Meltdown speculative-execution flaws affecting Intel, AMD, and ARM processors. Additional silicon issues such as Rowhammer and Zombieload/MDS further illustrate the need for coordinated microcode, firmware, and software updates.