Story image

Report: Industrial sector must make security top priority in digital transformation

06 May 18

The industrial sector cannot afford to wait until they refresh their entire asset fleet before they secure operations – in fact, they must start today.

Research conducted by Honeywell and LNS Research says that despite many organisations’ plans to explore digital transformation projects, the adoption of cybersecurity capabilities and technology are still low.

The research polled 1004 respondents, of which 130 completed a more detailed IIoT survey. From the detailed survey, the research firm discovered that 40% of companies have started an IIoT initiative.

The report says that digital transformation is a long-term business initiative, not a short-term solution. The top issue that respondents face is the implementation of industrial cybersecurity.

“Industrial cybersecurity is now central to business strategy, not an afterthought. Security at every level should be a prerequisite for the deployment of new technologies,” the report says.

Although 53% of respondents say their organisations has experienced a cybersecurity breach, the report says attack sources can come from different directions. Some can be IT-focused, some on OT, some malicious, and others can be accidental.

Out of the 130 detailed responses, 9% said they have experienced a denial of service attack; 8% were hit by a malware attack from another part of enterprise; 5% had been hacked for malicious purposes; 4% had been hacked for non-malicious purposes; 2% had been targeted by government-sponsored attacks and only 1% had experienced a direct attack on control systems.

“Even though direct attacks on control systems are rare, a company is fooling itself if it believes its control system is inherently secure,” the report says.

Although firewalls and access control were the main ways organisations secure their plants, malicious attacks don’t necessarily need the internet as part of an infection chain. 19% say they have experienced a breach through removable media.

“Organizations should also note that within a plant network, many IT assets also have known vulnerabilities. According to LNS Research survey data, Microsoft is the market share leader providing software for the plant floor. With so many plants relying on Microsoft technology, when there are major IT security events, they undoubtedly impact the industrial sector,” the report says.

The research further reveals that 45% of the 130 respondents have a chief of cybersecurity in their organisation, and 51% don’t have a head of cybersecurity for manufacturing.

Industrial firms are lacking in the areas of documentation and policy management, particularly when they are managed by OT. Only 38% of the 130 respondents say they have a definitive list of connections to their plant and what data can flow through them.

Furthermore, 20% said they don’t conduct regular risk assessments; 25% never conduct penetration testing on their firewalls; and 38% don’t continually monitor plant systems and networks for unusual behaviour.

The report says that CEOs must understand that any industrial cybersecurity event could affect the success of any digital transformation initiatives.

“For this reason it is important to realize that success in digital transformation depends on success with industrial cybersecurity,” the report says.

The research polled 1004 respondents from industrial companies in Asia Pacific, North America, South America, Europe, the Middle East and Asia. 130 respondents completed the detailed survey.

Respondents worked in sectors including industrial equipment; oil and gas; automotive; life sciences; aerospace and defense; food and beverage; chemicals; electronics; utilities; consumer packages, and others.

Disruption in the supply chain: Why IT resilience is a collective responsibility
"A truly resilient organisation will invest in building strong relationships while the sun shines so they can draw on goodwill when it rains."
Businesses too slow on attack detection – CrowdStrike
The 2018 CrowdStrike Services Cyber Intrusion Casebook reveals IR strategies, lessons learned, and trends derived from more than 200 cases.
Proofpoint launches feature to identify most targeted users
“One of the largest security industry misconceptions is that most cyberattacks target top executives and management.”
McAfee named Leader in Magic Quadrant an eighth time
The company has been once again named as a Leader in the Gartner Magic Quadrant for Security Information and Event Management.
Symantec and Fortinet partner for integration
The partnership will deliver essential security controls across endpoint, network, and cloud environments.
Is Supermicro innocent? 3rd party test finds no malicious hardware
One of the larger scandals within IT circles took place this year with Bloomberg firing shots at Supermicro - now Supermicro is firing back.
25% of malicious emails still make it through to recipients
Popular email security programmes may fail to detect as much as 25% of all emails with malicious or dangerous attachments, a study from Mimecast says.
Google Cloud, Palo Alto Networks extend partnership
Google Cloud and Palo Alto Networks have extended their partnership to include more security features and customer support for all major public clouds.