Critical infrastructure is not prepared for cyber attacks
Posted on 11 November 2008.
Secure Computing announced the results of a study conducted during August and September 2008 in the US, Canada and Europe. The study surveyed 199 international security experts and other "industry insiders" from utilities, oil and gas, financial services, government, telecommunications, transportation and other critical infrastructure industries. Despite a growing body of legislation and regulation, more than half of these experts believed that most critical infrastructure continues to be vulnerable to cyber attack. Further, a majority of respondents said that major attacks have already begun or are likely to occur in the next 12 months.

In the study, respondents were asked to indicate the state of readiness for eight different industries. More than 50 percent of respondents believed that utilities, oil and gas, transportation, telecommunications, chemical, emergency services and postal/shipping industries were not prepared. For some sectors, such as postal/shipping and transportation, as many as three out of four experts indicated that the infrastructure was not ready for attack. Only the financial services industry was considered prepared, although nearly 40 percent believed that even this sector was not ready to defend itself.

Survey participants were also asked which industry was the biggest target, which was the most vulnerable to attack and which was the most detrimental if breached. The insiders picked the energy sector in all three cases, with 33 percent saying it was the biggest target, 30 percent saying it was the most vulnerable and 42 percent saying it would be the most detrimental if attacked.

When asked to name the biggest bottleneck to improving cyber security, the largest number of experts (29 percent) pointed to the cost of security measures. Apathy was the second most likely to be selected as the primary bottleneck, with government bureaucracy and internal issues tying for third.

Study participants from North America were also asked how soon major exploits of critical infrastructure would occur. More than 50 percent answered that the attacks had already begun. Another 14 percent said a major exploit was likely in the next 12 months, while only 2 percent said such an exploit would never occur. At the same time that attacks are becoming more likely, many networks are becoming less secure. Energy Insights identified three trends (outlined below) which are likely to increase the vulnerability of critical infrastructure in the future.

Interconnectivity among networks will expand. Already 62 percent of North American respondents said that their control systems were directly connected to an IP-based network or the Internet. A full 98 percent of respondents believed this makes them more vulnerable.

Intelligent grid and similar initiative will continue to grow. As companies deploy new technologies such as smart meters, sensors and advanced communications networks, they run the risk of increasing their vulnerability unless they include security as an integral part of the projects.

Cost cutting efforts will not go away. During times of economic hardship, organizations are expected to increase their use of "standard" IT platforms, further increasing their vulnerability to attack.

Critical infrastructure asset owners and operators should take five steps towards greater cyber security:
  • Performing ongoing vulnerability assessments
  • Vigilant monitoring of network automation and control systems
  • Sharing information about threats and attacks through the industry Information Sharing and Analysis Centers (ISACs) such as the electricity sector ISAC and up the chain of command within organizations
  • Taking an enterprise approach that includes both information technology and operations technology environments
  • Thinking beyond regulatory compliance.





Spotlight

The synergy of hackers and tools at the Black Hat Arsenal

Posted on 27 August 2014.  |  Tucked away from the glamour of the vendor booths and the large presentation rooms filled with rockstar sessions, was the Arsenal - a place where developers were able to present their security tools and grow their community.


Weekly newsletter

Reading our newsletter every Monday will keep you up-to-date with security news.
  



Daily digest

Receive a daily digest of the latest security news.
  

DON'T
MISS

Mon, Sep 1st
    COPYRIGHT 1998-2014 BY HELP NET SECURITY.   // READ OUR PRIVACY POLICY // ABOUT US // ADVERTISE //