Industrial and energy enterprises, and transport and logistics companies, have different opinions on the negative effects of cyberattacks on their industrial networks. But, when it comes to the issues affecting their ability to keep networks secure, there are three key concerns they can agree on; under-staffing, under-investment by senior management and the human factor, according to Kaspersky Lab’s ‘State of Industrial Cybersecurity 2018’ survey. These cyber-security gaps in critical infrastructure can significantly increase the risks for organisations, the IT security product company warns.
Depending on the industry, organisations have different assessments concerning the damage caused to their business by cyber-threats. For transport and logistics companies that build their business based on a service model, the most negative impact is losing customer confidence (75pc). But for the majority of manufacturing enterprises (66pc) and energy companies (73pc), their biggest concern is compromising the quality of production due to a cyberattack.
The research found that despite the frequency and debilitating impact of ICS network attacks, only 52pc of companies have dedicated response measures in place to deal with such an incident. This is compared to the protection afforded to corporate networks, which is at a more mature level: the majority (77pc) have implemented response measures in the case of incidents affecting corporate IT. Kaspersky points to several common reasons why this might be the case, which unite industrial firms as they struggle to keep ICS networks secure.
The task of protecting industrial networks often falls to those providing corporate information security. In 40pc of manufacturing organisations, ICS protection is the responsibility of corporate IT security officers. Within transport and logistics companies, over half of those surveyed (58pc) confirm that ICS safety is provided by a dedicated team working full-time to combat threats. Industrial organisations, especially those with complex technological processes, need highly specialised, qualified employees to fill the gap. For example, in the energy sector, where national critical infrastructure is managed with the help of ICS, the main challenge when it comes to security management (61pc) is hiring employees with the relevant skills.
In many enterprises, IT security is a priority for senior management, but in more than half (54pc) of manufacturing companies, top management is little – if at all – involved in ICS protection issues, which results in underinvestment. Indeed, two-thirds (66pc) do not have a dedicated budget for providing security of critical infrastructure. And this position remains unchanged, even in the event or risk of an incident, with 17pc of manufacturing organisations not considering this a sufficient enough reason to invest in ICS security.
The consequences of employee errors pose a critical threat to half of all organisations in all sectors (49pc). This is not surprising, given that after malware and ransomware, it is the most common reason for security incidents in ICS (27pc). Fortunately, companies are aware of this problem and are trying to solve it by training personnel and creating rules of behaviour on critical infrastructure objects. Most, 82pc of organisations have already implemented training for employees, contractors and vendors. Whatever the most feared consequences for industrial organisations, the only way to prevent or lessen the effect of an attack is to put in place robust safety measures and procedures for ICS networks. Monitoring and timely responses to incidents on industrial networks should become key IT security priorities, along with educating and arming staff on how to minimise the risks to their business.
David Emm, Principal Security Researcher, pictured, said: “We tend not to think of an employee weakness as a reason for posing a threat to a business. However, our research has found that accidental actions are having an impact on the failure or complete shutdown of production processes. The consequences of this may be both financial and reputational, so its important enterprises recognise this factor, and put in place robust safety measures and procedures to prevent this.”
Visit https://ics.kaspersky.com/.
