A recent study looking at the Industrial Control System in the energy industry found out that, majority of the respondents are worried that a successful cyber-attack may lead up to a catastrophic outcome.
Security and compliance specialist Tripware carried out a study by Dimensional Research which included 151 IT and operational technology (OT) security professionals from energy, gas and oil companies.
The study found that 70% of respondents are concerned that a successful cyber-attack would lead to a huge catastrophe such as an explosion. With the well-known recognition of the physical threat these cyber-attacks hold against the oil, gas and energy industry, 97 percent are concerned that these attacks could lead to operational shutdowns and 96 percent believe that these attacks could affect the safety of their employees.
The vice president of product management and strategy at Tripwire says that, “Energy companies have accepted the reality that digital threats can have tangible consequences.”
He further adds, “This perception is perhaps heightened by recent attacks that were specifically designed to affect physical operations and have proven capable of doing so.”
There is also a worry regarding lack of investment in security – 62 percent claim that the lack of investment and budget is one of the biggest barriers in meeting Industrial Control Systems security goals. Out of those who claim that their company does not invest enough money, 57 percent believe that the only way to make them invest money in cyber-security would be a catastrophic event.
A large majority of people are worried about the attacks on the Industrial Control Systems (ICS) and 59 percent say that their companies have increased the security due to the ICS targeted attacks, which include Trisis/Triton, CrashOverride and Stuxnet.
Ransomware is a major issue too and 45 percent claim that ransomware has a very significant impact in increasing the security investment. Tim Erlin says that, “It’s encouraging to see that companies have increased their security investment somewhat.”
He further adds saying, “However, it’s concerning that more than half would wait for an attack to happen before investing properly, given what’s at stake with critical infrastructure. The energy industry should invest in establishing more robust cyber security strategies, with a proper foundation of critical security controls and layers of defense.”
Source: BetaNews