ISAF ISAF : Security – Cyber Security – Smart Life – Safety Health – Fire Rescue
Half of the cyber security incidents in industrial networks are caused by employee errors.
Despite automation, the human factor can still put industrial processes at risk. Employee errors or unintentional actions accounted for 52% of incidents that affected operational technology and industrial control system (OT / ICS) networks last year. According to the Kaspersky’s report “The State of Industrial Cyber Security 2019” [1], this problem is part of a much wider and more complicated circumstance. The ever increasing complexity of industrial infrastructures requires more advanced protection methods and skills. However, organizations are having difficulties in finding professionals who can handle with these new threats, and employees have low awareness of the issue.
Many industrial companies are planning to digitalize their industrial networks and implement the Industry 4.0 standards. Four out of five organization (81%) consider the digitalization of operational networks as an important or very important task needed to be completed this year. However, there are benefits of connected infrastructures as well as cyber security risks.
The good news is that OT/ICS cyber security is becoming one of the most important priorities for the industrial companies, as also confirmed by the participants (87%) of a survey. However, in order to achieve the necessary level of security, they should invest in dedicated measures and hire qualified professionals who have the ability to implement them efficiently. Even if companies state that they give priority to the cyber security, only half (57%) of them are allocating budget for the industrial cyber security.
In addition to budgetary constraints, there is also a lack of competent staff. Organizations are not only having difficulties to find a cyber security expert with the ability to manage the security of industrial networks, but also think that their OT/ICS network operators do not know what behavior is likely to cause cyber security breaches. These challenges generate the two major concerns regarding the cyber security management. In addition, it also explains why half of ICS incidents, such as malware infection and more serious targeted attacks, are caused by employee errors.
In about half of the companies (45%), the employees responsible for IT infrastructure security, also control OT/ICS networks in addition to their core responsibilities. Such an approach also brings the security risks. Although operational and corporate networks are becoming increasingly connected, their experts have different approaches (37%) and different targets (18%) in terms of cyber security.
“This year’s research shows that companies are seeking to increase the security of their industrial networks. This can only be achieved when risks such as lack of qualified staff and employee errors are resolved. You can ensure that the networks are protected against threats and have up-to-date skills by taking a multi-layered approach which combines regular training of IT security specialists and industrial network operators with technical protection.” Said Georgy Shebuldaev, Brand Manager, Kaspersky Industrial Cyber Security.
In addition to making technical progress and awareness for the industrial cyber security, organizations need to consider establishing a special protection system for Industrial IoT (IIoT), which can be firmly connected externally. Almost half (41%) of companies are ready to connect their OT/ICS networks to the cloud by using preventive maintenance or digital twins.
“This survey, conducted by the ARC Advisory Group on behalf of Kaspersky, shows that the increasing interconnection between IIoT edge devices and cloud services remains a security challenge. This challenge was the major reason behind the creation of best practices for the IIC Industrial IoT Security Framework and the IoT Mature Security Model.” Stated Dr. Jesus Molina, Director of Business Development and Chair of IIC Security Working Group, Waterfall Security Solutions.
Kaspersky has a dedicated portfolio of solutions and services to address the challenges facing industrial organizations. By combining protection for industrial endpoints and networks, Kaspersky Industrial CyberSecurity is able to handle with threats at operator and network-level in ICS environments with advanced threat intelligence and case response services. The solution also includes a training and awareness program, specifically designed for cyber security experts and OT managers/ICS operators.
Source: Chip Online