Three’s a Crowd: Understaffing, Underinvestment and Human Errors put ICS Security in Key Verticals at Risk

According to Kaspersky Lab’s ‘State of Industrial Cybersecurity 2018’ survey, industrial and energy enterprises, as well as transport and logistics companies, have different opinions regarding the negative effects of cyber attacks on their industrial networks. But, when it comes to the issues affecting their ability to keep networks secure there are three key concerns they can agree on; under staffing, under investment by senior management and the human factor. And with almost 40% of ICS computers facing attacks every 6 months, these cybersecurity gaps in critical infrastructure can significantly increase the risks for organizations.

Different fears

Depending on the industry, organizations have different assessments concerning the damage caused to their business by cyber threats. For transport and logistics companies that build their business based on a service model, the most negative impact is losing customer confidence (75%). But for the majority of manufacturing enterprises (66%) and energy companies (73%), their biggest concern is compromising the quality of production due to a cyber attack.

… same tears

Our research found that despite the frequency and debilitating impact of ICS network attacks, only 52% of companies have dedicated response measures in place to deal with such an incident. This is compared to the protection afforded to corporate networks, which is at a more mature level: the majority (77%) have implemented response measures in the case of incidents affecting corporate IT.

There are several common reasons why this might be the case, which unite industrial organizations as they struggle to keep ICS networks secure.

Under-resourced and under-skilled

The task of protecting industrial networks often falls to those providing corporate information security. In 40% of manufacturing organizations, ICS protection is the responsibility of corporate IT security officers. Within transport and logistics companies, over half of those surveyed (58%) confirm that ICS safety is provided by a dedicated team working full-time to combat threats.

Industrial organizations, especially those with complex technological processes, need highly specialized, qualified employees to fill the gap. For example, in the energy sector, where national critical infrastructure is managed with the help of ICS, the main challenge when it comes to security management (61%) is hiring employees with the relevant skills.

The human factor is an evergreen problem in ICS security

The consequences of employee errors pose a critical threat to half of all organizations in all sectors (49%). This is not surprising, given that after malware and ransomware, it is the most common reason for security incidents in ICS (27%). Fortunately, companies are aware of this problem and are trying to solve it by training personnel and creating rules of behavior on critical infrastructure objects. 82% of organizations have already implemented training for employees, contractors and vendors.