Story image

Report: Industrial sector must make security top priority in digital transformation

06 May 18

The industrial sector cannot afford to wait until they refresh their entire asset fleet before they secure operations – in fact, they must start today.

Research conducted by Honeywell and LNS Research says that despite many organisations’ plans to explore digital transformation projects, the adoption of cybersecurity capabilities and technology are still low.

The research polled 1004 respondents, of which 130 completed a more detailed IIoT survey. From the detailed survey, the research firm discovered that 40% of companies have started an IIoT initiative.

The report says that digital transformation is a long-term business initiative, not a short-term solution. The top issue that respondents face is the implementation of industrial cybersecurity.

“Industrial cybersecurity is now central to business strategy, not an afterthought. Security at every level should be a prerequisite for the deployment of new technologies,” the report says.

Although 53% of respondents say their organisations has experienced a cybersecurity breach, the report says attack sources can come from different directions. Some can be IT-focused, some on OT, some malicious, and others can be accidental.

Out of the 130 detailed responses, 9% said they have experienced a denial of service attack; 8% were hit by a malware attack from another part of enterprise; 5% had been hacked for malicious purposes; 4% had been hacked for non-malicious purposes; 2% had been targeted by government-sponsored attacks and only 1% had experienced a direct attack on control systems.

“Even though direct attacks on control systems are rare, a company is fooling itself if it believes its control system is inherently secure,” the report says.

Although firewalls and access control were the main ways organisations secure their plants, malicious attacks don’t necessarily need the internet as part of an infection chain. 19% say they have experienced a breach through removable media.

“Organizations should also note that within a plant network, many IT assets also have known vulnerabilities. According to LNS Research survey data, Microsoft is the market share leader providing software for the plant floor. With so many plants relying on Microsoft technology, when there are major IT security events, they undoubtedly impact the industrial sector,” the report says.

The research further reveals that 45% of the 130 respondents have a chief of cybersecurity in their organisation, and 51% don’t have a head of cybersecurity for manufacturing.

Industrial firms are lacking in the areas of documentation and policy management, particularly when they are managed by OT. Only 38% of the 130 respondents say they have a definitive list of connections to their plant and what data can flow through them.

Furthermore, 20% said they don’t conduct regular risk assessments; 25% never conduct penetration testing on their firewalls; and 38% don’t continually monitor plant systems and networks for unusual behaviour.

The report says that CEOs must understand that any industrial cybersecurity event could affect the success of any digital transformation initiatives.

“For this reason it is important to realize that success in digital transformation depends on success with industrial cybersecurity,” the report says.

The research polled 1004 respondents from industrial companies in Asia Pacific, North America, South America, Europe, the Middle East and Asia. 130 respondents completed the detailed survey.

Respondents worked in sectors including industrial equipment; oil and gas; automotive; life sciences; aerospace and defense; food and beverage; chemicals; electronics; utilities; consumer packages, and others.

A10 aims to secure Kubernetes container environments
The solution aims to provide teams deploying microservices applications with an automated way to integrate enterprise-grade security with comprehensive application visibility and analytics.
DigiCert conquers Google's distrust of Symantec certs
“This could have been an extremely disruptive event to online commerce," comments DigiCert CEO John Merrill. 
One Identity a Visionary in Magic Quad for PAM
One Identity was recognised in the Gartner Magic Quadrant for Privileged Access Management for completeness of vision and ability to execute.
How to keep network infrastructure secure and available
Two OVH executives have weighed in on how network infrastructure and the challenges in that space will be evolving in the coming year.
Gartner names newcomer Exabeam a leader in SIEM
The vendor landscape for SIEM is evolving, with recent entrants bringing technologies optimised for analytics use cases.
52mil users affected by Google+’s second data breach
Google+ APIs will be shut down within the next 90 days, and the consumer platform will be disabled in April 2019 instead of August 2019 as originally planned.
Symantec releases neural network-integrated USB scanning station
Symantec Industrial Control System Protection Neural helps defend against USB-borne cyber attacks on operational technology.
Ramping up security with next-gen firewalls
The classic firewall lacked the ability to distinguish between different kinds of web traffic.