As critical infrastructure organizations converge their IT, OT, IoT and physical systems to improve overall performance, employees are the biggest threat to cyber and physical security, a new survey found.
The new report, entitled “Weathering the Perfect Storm: Securing the Cyber-Physical Systems of Critical Infrastructure,” found:
- 52 percent said employees are the biggest threat to operational security
- Cyber incursion into IT data systems accounted for 53 percent of attacks in the last 12 months
- 85 percent of security incursions made their way into OT networks – of those, 36 percent started in IT/data systems and 32 percent involved physical incursion into OT
- 64 percent said it took a cyber or physical security breach to motivate them to move toward a more holistic approach to cyber-physical security
- A quarter believe their existing security is adequate
The survey, conducted by Newsweek Vantage in partnership with Nozomi Networks, Siemens and Yubico, polled over 400 C-level executives from critical infrastructure organizations across North America, Europe and Asia/Pacific.
“The perfect storm of increasing cyber threats, digital transformation and IT/OT convergence means organizations must move swiftly to gain visibility and enhance cybersecurity into their OT and IoT networks,” said Nozomi Networks CMO Kim Legelis. “It’s a board issue and an employee issue. We are encouraged that organizations recognize both the threats and the opportunities of modernizing critical infrastructure. We know from working with thousands of industrial installations, that it’s possible to monitor and mitigate these risks, whether they stem from cybercriminals, nation-states or employees.”
Other findings from the report include:
Integration of IT, OT and physical systems has gone mainstream: 88 percent of critical infrastructure executives surveyed have either already integrated their systems or said the integration process is underway. However, 68 percent said some of their OT and/or physical systems are isolated from IT, but that the integration process is ongoing. Also, 20 percent said all their systems are fully integrated with externally accessible systems, and even fewer (11 percent) said that none are.
Threat landscape is changing – and so are security postures: Almost nine in 10 executives said their organization has experienced a security incident in the previous 12 months and more than half have suffered two or more. In addition, 85 percent of security incidents involved OT – of those, 36 percent started in IT/data systems and 32 percent involved physical incursion into OT. Also, 47 percent said cybercriminals pose the biggest risk. However, 52 percent believe former and current employees are the greatest threat. In a bit of good news, 70 percent of respondents are taking steps to address the new vulnerabilities created by the integration of cyber/digital and OT/physical systems, though the specific nature of those steps varies.
Challenges and obstacles to a holistic approach to cyber-physical security: Nearly half of respondent organizations (49 percent) struggle with differences in risk tolerances between IT and OT in an environment that has traditionally associated those two areas with very different goals. Differences between IT and OT operating environments (43 percent) and cyber/IT skills requirements (40 percent) are the top two technical obstacles. In addition, 30 percent face employee resistance to cultural change.
Motivating change: 32 percent say clear directives regarding risk tolerance or performance either from IT/OT executives or from the CEO or Board is driving change
Click here to register to download the report.
Click here for an additional blog post on the report.