Attacks On UK Critical Infrastructure Will Double

The UK’s critical infrastructure faces an increase in cyber-attacks of up to 100% over the next two years at the same time as it faces a critical shortage of security analysts, cyber security expert Huntsman Security has warned.

With critical infrastructure systems increasingly connected to the Internet and customers’ homes, the opportunity to compromise them has also grown; with consequences ranging from critical services being held for ransom, to service outages, economic chaos and even disruption, injury or death to citizens.

This year alone has seen high-profile attacks on power plants in the Ukraine and USA, and significant threats to UK and European transport infrastructure. The risk for critical infrastructure businesses is compounded by the upcoming NIS Directive, as companies that fail to meet security standards will face fines in the tens of millions of pounds. 

“With the ISACA predicting a global shortage of two million cyber security jobs by 2019, there simply aren’t enough security analysts in the UK, or even the world, to cope with the growing threat that critical infrastructure faces,” said Peter Woollacott, CEO of Huntsman Security.

“National agencies are already reporting a significant increase in reported attacks, let alone those that pass undetected. 
“As more elements of services move online, so there are many more opportunities for attackers of any size or capability to try their luck. As a result, our critical infrastructure faces a blizzard of attacks of varying sophistication, any one of which could be as damaging as WanaCry or Stuxnet. 

“Even a simple DDoS attack has brought services such as Sweden’s trains to their knees recently. There’s no way to block all of these potential attacks at the walls of an organisation, and security analysts will soon be overwhelmed by the sheer volume they face. If organisations can’t address these challenges, the danger to the public, and the harm to the organisation itself, will be unacceptable.”

Attacks on national infrastructure have been increasing steadily. In the US, reported cyber incidents against critical infrastructure increased by 49% between 2012 and 2015, with a potentially larger number of unreported or unnoticed incidents yet to be discovered.

In the UK, the introduction of the EU Directive on Security of Network and Information Systems NIS Directive in May 2018 will place additional pressure on critical infrastructure organisations. Under NIS, companies could face fines of up to 4% of turnover or £20 million, whichever is greater, if they can’t prove they have taken sufficient steps to “prevent and minimise” the impact of security incidents.  To date energy, transport, health, drinking water supply and distribution and digital infrastructure have been proposed as the industries NIS covers.

Regardless of industry, the greatest challenge to organisations will be the volume and diversity of potential and actual attacks they face. In this environment, it will be critical to be able to identify, triage and respond to potential threats before they have an opportunity to cause damage. 

Ideally these tasks should be automated, so that security teams only need to take action on those attacks which present the highest risk, instead of being distracted by false alarms.

 “The fact that NIS is making organisations think about these dangers is important, but these thoughts have to be matched with the right action,” continued Woollacott. “When connections were entirely physical, it was relatively simple to prevent and stop attacks, in the online world, this is nowhere near enough. 
“Without the ability to automatically triage potential threats and take the appropriate action, whether that’s simply logging the incident, alerting security teams, or quarantining the danger, organisations will find themselves overwhelmed and the odds of being victim to a major attack with serious consequences will increase accordingly. 
“The Internet as a means of communication is here to stay, meaning organisations will ultimately be judged by how they react to it. By accepting that they can’t stop every attack at the walls, critical infrastructure organisations are safeguarding not only themselves, but the UK as a whole.”

Information Age

Britain Bombarded With High Level Cyber Attacks:

Which Countries Are Ready For Cyberwar?:

Some Observations On Britain's New Cyber Security Strategy:

 

« Cisco & INTERPOL: Working Against Cybercrime
10 Things About The Network and Information Security Directive (NIS) »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

Cyber Security Supplier Directory

Cyber Security Supplier Directory

Our Supplier Directory lists 6,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

Perimeter 81 / How to Select the Right ZTNA Solution

Perimeter 81 / How to Select the Right ZTNA Solution

Gartner insights into How to Select the Right ZTNA offering. Download this FREE report for a limited time only.

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

Code Dx

Code Dx

Code Dx is a software application vulnerability correlation and management system.

NATO Communications and Information Agency (NCIA)

NATO Communications and Information Agency (NCIA)

The NCIA Cyber Security Service Line is responsible for planning and executing all life cycle management activities for cyber security.

Intensity Analytics

Intensity Analytics

Intensity Analytics is a software firm that develops next-generation, physical user and entity behavioral authentication ("physical UEBA") security software technology.

CSI

CSI

CSI is a Managed Service Provider (MSP) delivering Hybrid Multi-Cloud, Data Protection, and Cyber Security solutions to highly regulated industries.

Sensible Vision

Sensible Vision

SensibleVision helps organizations transparently protect data and prevent costly security breaches by constantly verifying the identities of people who use computers or mobile devices.

Lumen Technologies

Lumen Technologies

Lumen is an enterprise technology platform that enables companies to capitalize on emerging applications and power the 4th Industrial Revolution (4IR).

Vuntie

Vuntie

Vuntie blend European craftsmanship, performance and open-source technology to deliver cybersecurity services including penetration testing, incident response, training and consultancy.

GitGuardian

GitGuardian

Enable developers, ops, security and compliance professionals to enforce security policies across public and private code, and other data sources as well

Future Technology Systems Company (FutureTEC)

Future Technology Systems Company (FutureTEC)

FutureTEC is a leading Information Technology Solutions Provider, delivering world-class Information Security, Information Management, and Business Solutions.

Redpoint Security

Redpoint Security

Redpoint Security is an application security consulting firm that is focused on all aspects of code security.

Board of Cyber

Board of Cyber

Board of Cyber offers Security Rating: a fast, non-intrusive, continuous, 100% automated solution to evaluate the cyber performance of an organization.

Leostream

Leostream

Leostream's Remote Desktop Access Platform enables seamless work-from-anywhere flexibility while maintaining security and constant visibility of users.

Turngate

Turngate

Turngate simplify security investigations so you can see employee activities and entitlements in your enterprise in seconds.

Attestiv

Attestiv

Attestiv puts authenticity into photos, videos and documents by utilizing advanced technologies in AI and tamper-proofing.

Alcatel-Lucent Enterprise (ALE)

Alcatel-Lucent Enterprise (ALE)

We are Alcatel-Lucent Enterprise. Our mission is to make everything connect with digital age networking, communications and cloud solutions.

Zyxel Networks

Zyxel Networks

Zyxel Networks is a leading provider of secure, AI-powered networking solutions for small to medium businesses (SMBs) and the enterprise edge.