Only half of industrial companies believe their vital infrastructure is adequately protected against cyber attacks. 40% of companies report that their industrial networks have been targeted by cyber attacks in the past six months. 66% of organisations are particularly concerned about the impact of cyber attacks on the production process.
This is according to research by IT security firm Kaspersky Lab among 320 decision-makers in industrial security at organisations worldwide. 25% of the organisations surveyed are based in Western Europe. Twelve industrial security experts were also interviewed for the study. Underutilisation, lack of investment and human error are the biggest threats to the digital security of industrial networks, among others, the security company concludes.
Security of vital infrastructure lags behind
52% of industrial organisations surveyed have taken precautions to adequately protect against cyber attacks on their vital infrastructure, according to Kaspersky Lab. This leaves vital infrastructure security behind the security of the regular IT environment. Thus, 77% of respondents in the survey indicated that their IT landscape is adequately secured.
This is also reflected in the type of security measures organisations have implemented to secure critical networks and the general IT environment, respectively. For example, only 56% of the companies surveyed indicate that they monitor network traffic and analyse log files as part of the security of their critical infrastructure, while this is a well-established feature in securing the regular IT environment. Other examples include network segmentation and intrustion detection, implemented by 47% and 45% of companies respectively to protect critical infrastructure. Both are deployed for securing regular IT by the vast majority of companies.
Who is responsible?
Protecting vital networks is often the responsibility of security professionals in manufacturing; at 40% of manufacturing companies, ICS protection is the responsibility of IT security professionals. Kaspersky Lab points out that in many other industries, this task has been given to a dedicated team dedicated to fighting cyber threats full-time. For example, 58% of respondents within the transport and logistics sector indicate that this is the case.
The IT security firm therefore argues that industrial organisations need highly specialised and qualified staff to plug gaps in their security. This is especially true for industrial companies with complex technological processes. However, 58% of companies cite hiring employees specialised in critical network security as a major challenge.
The increasing risks posed by connectivity and integration of production systems into new Internet of Things (IoT) ecosystems is also cited as a major challenge by more than half (54%) of respondents. Having to implement new forms of IT security to protect IoT devices and finding reliable partners who can implement industrial security solutions are in a shared third position. Both were cited as major challenges by half of the respondents in the survey.
Management is far from always involved
35% of respondents state that securing vital infrastructure was a management priority in 2017, with 15% even calling it the top priority. At the same time, it appears that at 54% of manufacturing companies, top management had little or no involvement in vital network security issues in the past year. In many cases, this has resulted in a lack of the necessary investment. For instance, 66% of respondents indicated that they do not have a specific budget available for critical infrastructure security. It is also striking that 17% of manufacturing companies indicate that the risk of becoming a victim of cyber incidents is insufficient reason to invest in critical network security.
More information can be found in the research report State of Industrial Cybersecurity (ICS) 2018, which can be downloaded here.
Author: Wouter Hoeffnagel
Source photo: Pixabay / pixelcreatures
