Story image

Report: Industrial sector must make security top priority in digital transformation

06 May 18

The industrial sector cannot afford to wait until they refresh their entire asset fleet before they secure operations – in fact, they must start today.

Research conducted by Honeywell and LNS Research says that despite many organisations’ plans to explore digital transformation projects, the adoption of cybersecurity capabilities and technology are still low.

The research polled 1004 respondents, of which 130 completed a more detailed IIoT survey. From the detailed survey, the research firm discovered that 40% of companies have started an IIoT initiative.

The report says that digital transformation is a long-term business initiative, not a short-term solution. The top issue that respondents face is the implementation of industrial cybersecurity.

“Industrial cybersecurity is now central to business strategy, not an afterthought. Security at every level should be a prerequisite for the deployment of new technologies,” the report says.

Although 53% of respondents say their organisations has experienced a cybersecurity breach, the report says attack sources can come from different directions. Some can be IT-focused, some on OT, some malicious, and others can be accidental.

Out of the 130 detailed responses, 9% said they have experienced a denial of service attack; 8% were hit by a malware attack from another part of enterprise; 5% had been hacked for malicious purposes; 4% had been hacked for non-malicious purposes; 2% had been targeted by government-sponsored attacks and only 1% had experienced a direct attack on control systems.

“Even though direct attacks on control systems are rare, a company is fooling itself if it believes its control system is inherently secure,” the report says.

Although firewalls and access control were the main ways organisations secure their plants, malicious attacks don’t necessarily need the internet as part of an infection chain. 19% say they have experienced a breach through removable media.

“Organizations should also note that within a plant network, many IT assets also have known vulnerabilities. According to LNS Research survey data, Microsoft is the market share leader providing software for the plant floor. With so many plants relying on Microsoft technology, when there are major IT security events, they undoubtedly impact the industrial sector,” the report says.

The research further reveals that 45% of the 130 respondents have a chief of cybersecurity in their organisation, and 51% don’t have a head of cybersecurity for manufacturing.

Industrial firms are lacking in the areas of documentation and policy management, particularly when they are managed by OT. Only 38% of the 130 respondents say they have a definitive list of connections to their plant and what data can flow through them.

Furthermore, 20% said they don’t conduct regular risk assessments; 25% never conduct penetration testing on their firewalls; and 38% don’t continually monitor plant systems and networks for unusual behaviour.

The report says that CEOs must understand that any industrial cybersecurity event could affect the success of any digital transformation initiatives.

“For this reason it is important to realize that success in digital transformation depends on success with industrial cybersecurity,” the report says.

The research polled 1004 respondents from industrial companies in Asia Pacific, North America, South America, Europe, the Middle East and Asia. 130 respondents completed the detailed survey.

Respondents worked in sectors including industrial equipment; oil and gas; automotive; life sciences; aerospace and defense; food and beverage; chemicals; electronics; utilities; consumer packages, and others.

How to stay safe when shopping online
Online shopping is a great way to avoid the crowds – but there are risks.
Dell EMC embeds security in latest servers
Dell EMC's 14th generation of PowerEdge servers has comprehensive management tools to provide security across hardware and firmware.
Why data backups should be a part of daily operations
"Disaster recovery needs to address complete system failure and provide a set of security policies to govern disaster incidents."
Businesses focusing on threats from within - survey
Over 50% of respondents reported that 100 days of dwell time or more was representative of their organisation.
Corelight and Exabeam partner to improve network monitoring
The combination of lateral movement and siloed usage of point security products leaves many security teams vulnerable to compromise.
SailPoint releases first identity annual report
SailPoint’s research found that many organisations are lacking maturity in their governance processes over identities.
Disruption in the supply chain: Why IT resilience is a collective responsibility
"A truly resilient organisation will invest in building strong relationships while the sun shines so they can draw on goodwill when it rains."
Businesses too slow on attack detection – CrowdStrike
The 2018 CrowdStrike Services Cyber Intrusion Casebook reveals IR strategies, lessons learned, and trends derived from more than 200 cases.