Critical infrastructure under attack, businesses slow to respond

Barracuda Networks has released key findings from a report titled The State of Industrial Security in 2022, finding that critical infrastructure is under attack, and despite agreement that IIoT and OT security is critical, businesses are facing significant challenges as the geopolitical landscape becomes increasingly tense.

The research surveyed 800 senior IT managers, senior IT security managers and project managers globally, including 100 in Australia, responsible for industrial internet of things (IIoT)/operational technology (OT) in their organisation. The aim was to get their perspectives on IIoT/OT security projects, implementation challenges, security incidents, technology investments and a variety of issues related to cybersecurity risks.

The research finds that security breaches have shown to have impacts beyond monetary losses as well, resulting in significant downtime with long-lasting breach impact.

The Australian research found:

• Attacks are widespread: 90% of organisations surveyed acknowledged experiencing a security incident in the last 12 months.
• Geopolitical concerns: 96% of respondents are very or fairly concerned about the impact that the current threat landscape and geopolitical situation will have on their organisations.
• Breaches are impacting operations: 84% of organisations that experienced an incident were impacted for more than one day.

Tim Jefferson, SVP, engineering for data, networks and application security at Barracuda, says, "In the current threat landscape, critical infrastructure is an attractive target for cybercriminals, but unfortunately IIoT/OT security projects often take a backseat to other security initiatives or fail due to cost or complexity, leaving organisations at risk.

"Issues such as the lack of network segmentation and the number of organisations that aren't requiring multi-factor authentication leave networks open to attack and require immediate attention.

Organisations across the board have acknowledged the importance of investing even further in IIoT and OT security, with 96% of Australian business leaders noting that their organisation needs to increase their investment in industrial security.

A full 74% of Australian organisations signalled that they have either already implemented or are in the process of implementing IIoT/OT security projects, but many are facing significant challenges when it comes to implementation, including basic cyber hygiene.

Overall the research revealed:

• Manufacturing and healthcare lag behind: Australian retail organisations are leading with implementation with 73% having completed projects compared to 56% in oil and gas having completed projects. Only 29% in manufacturing and none of those surveyed in healthcare have completed projects.
• Businesses are experiencing failures: 90% of Australian organisations surveyed have failed in their IIoT/OT security projects.
• Effective IIoT security implementations are making an impact: For Australian organisations with completed IIoT and OT security projects, 100% have experienced no impact at all from a major incident.
• Multi-factor authentication (MFA) use is low: Only 12% of Australian companies surveyed restrict network access and enforce multi-factor authentication when it comes to remote access to OT networks.
• Low MFA use is prevalent even in critical industries: Critical verticals like energy (38%) allow full remote access without MFA for external users.
• Skills have an impact: Less than half of Australian organisations surveyed can handle applying security updates themselves (44%).
• Manual updates are cumbersome: Organisations are hit the worst when security updates are not automatic.

IIoT and OT security continue to be a major target for attackers, but there is hope for businesses that take a proactive approach, the researchers state.

Businesses should implement tools to combat these challenges, including the use of secure endpoint connectivity devices and ruggedised network firewalls, all centrally deployed and managed via a secure cloud service that can enable effective network segmentation and advanced threat protection, provide multi-factor authentication, and even implement zero trust access.

Klaus Gheri, VP network security at Barracuda, concludes, "IIoT attacks go beyond the digital realm and can have real-world implications. As attacks continue to rise across industries, taking a proactive security approach when it comes to industrial security is critical for businesses to avoid being the next victim of an attack.