Critical Infrastructure Is Under Worldwide Attack

Cyber-attacks on critical infrastructure using focused malware  like Triton and GoldenEye have significantly increased recently. In the last two years, hackers have continued attacking different crucial infrastructure networks around the globe with significant negative impact. 
 
Every minute of the day, there are cyber-attacks that are causing severe problems, by disrupting and taking down different parts of the technology system. 
 
A new report by the Ponemon Institute, based on an anonymous poll of more than 700 security professionals who are employed as guardians of critical electronic infrastructure in the UK, Germany, US, Japan, Mexico and Australia reveals that 90% say they had to deal with a number of different cyber-attacks.  For security reasons the professionals often refused to explain some of the details of the attacks and they said that they didn’t have the means to analyse some of the detailed information about attacks. 
 
"These are multiple, successful attacks on the physical world using cyber-technologies," Eitan Goldstein, from security firm Tenable, which commissioned the report, told the BBC.
 
"That is a really big change and that's why the risk isn't just theoretical any more. We believe the reason behind it is increased connectivity to industrial control systems. 
 
“Today we want to be able to do analytics and predictive maintenance in our power plants, but the proliferation of smart devices and sensors and IoT is really increasing our cyber-exposure to attack. In many cases, organisations don't even know what is connected to the Internet and what can be accessed by hackers."
 
In 2015, Stuxnet, which was probably created by the US and Israel, attacked Iranian nuclear power plant facilities, knocking them offline and causing both the plants, and the country itself, serious damage. Some of the media said Stuxnet was the globes first digital weapon. 
 
Here are Seven key findings about Cyber-Attacks: 
1. Cyber-attacks are non-stop and frequently against Online Technology (OT) environments. Most organisations in the OT sector have experienced multiple cyberattacks causing data breaches and/or significant disruption and downtime to business operations, plants and operational equipment. Many have suffered from nation-state attacks. 
2. The C-level is heavily involved in the evaluation of cyber risk. C-level technology, security and risk officers are most involved in the evaluation of cyber risk as part of their organisation’s business risk management. 
3. Nearly fifty percent of organisations attempt to quantify risk from cyber events. 48% of organisations in the OT sector (vs 38% in the non-OT sector) attempt to quantify the damage a cyber event could have on their business, and they’re most likely to quantify the impact based on downtime of OT systems. 
4. OT sector organisations expect significant threats in 2019. Concerns about third parties misusing or sharing information and OT attacks resulting in downtime to plant and/or operational equipment increase when looking at 2019. Worries about nation-state attacks continue at a significant level. 
5. 2019 governance priorities vary. Increasing communication with the C-suite and board of directors about cybersecurity threats facing the organization and ensuring third parties have appropriate security practices to protect sensitive data are top priorities for 2019. 
6. 2019 security priorities address sophisticated threats. The top 2019 security priority is to improve the ability to keep up with the sophistication and stealth of attackers. This isn’t surprising given the significant number of OT sector organisations that have suffered a nation-state attack in the past 24 months. 
7. Organisations are challenged to improve cybersecurity. Few organisations have sufficient visibility into their attack surface. Gaining required visibility will continue to be a challenge due to a combination of staff shortages and heavy reliance on manual processes. 
 
Conclusions 
Organisations in the OT sector are aligning their 2019 security priorities to address their most significant worries in 2019. The survey results suggest multiple recommendations for improving security in 2019 and beyond: 
Improve communication with the C-suite and board of directors about the cyber threats facing the organisation. This will help identify and address gaps among the organisation’s risk appetite and actual risk exposure. 
Improve visibility into the attack surface. Blind spots can result in unmanaged and unsecured IT and OT systems. Complete visibility is required for organisations to assess their risk. 
Increase the use of automated processes to compensate for the security staff shortage. 
Continue to recognise the security impact of interdependencies between IT and OT systems. Vulnerabilities and 
other weaknesses in IT systems can put interconnected OT systems at risk, and vice versa. 
 
Please contact Cyber Security Intelligence for a Cyber Audit and Cyber Training Recommendations.
 
Tenable Ponemon Report:         ITProPortal:       ITProPortal: 
 
You Might Also Read:
 
Cyber Attacks On Critical Infrastructure – A New Frontier In Global Conflict:
 
« Facebook Is Hosting Multiple Cybercrime Marketplaces
Websites To Be Fined Over 'online harms' Under New UK Law »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

FT Cyber Resilience Summit: Europe

FT Cyber Resilience Summit: Europe

27 November 2024 | In-Person & Digital | 22 Bishopsgate, London. Business leaders, Innovators & Experts address evolving cybersecurity risks.

Clayden Law

Clayden Law

Clayden Law advise global businesses that buy and sell technology products and services. We are experts in information technology, data privacy and cybersecurity law.

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

Celestix Networks

Celestix Networks

Celestix is a global provider of secure network solutions that enable the simple deployment of secure remote access connectivity.

Seagate Technology

Seagate Technology

Seagate data storage systems are purpose-built for enterprise and data centre performance, scalability, reliability and security.

CybelAngel

CybelAngel

CybelAngel is a leading digital risk protection platform that detects and resolves external threats before these wreak havoc.

Wavestone

Wavestone

Wavestone is a strategy and technology consulting company with areas of expertise including digital transformation and cybersecurity.

Deutsche Cyber-Sicherheitsorganisation (DCSO)

Deutsche Cyber-Sicherheitsorganisation (DCSO)

DCSO was founded in 2015 with the aim of counteracting the threats posed by globally organized cybercrime and state-controlled industrial espionage.

Sift

Sift

The Sift Digital Trust Platform protects your business and customers from all vectors of fraud and abuse through our Live Machine Learning, global trust network and automation technologies.

Data Storage Corp (DSC)

Data Storage Corp (DSC)

Data Storage Corporation is a provider of data recovery and business continuity services that help organizations protect their data, minimize downtime and recover and restore data.

Accurics

Accurics

Accurics enables self-healing cloud native infrastructure by codifying security throughout your development lifecycle.

ST Engineering Antycip

ST Engineering Antycip

ST Engineering Antycip (formerly Antycip Simulation) is Europe’s leading provider of professional grade COTS simulation software, projection & display systems, and related engineering services.

BIRD Cyber

BIRD Cyber

BIRD Cyber is a program to promote collaboration on cybersecurity and emerging technologies aimed at enhancing the cyber resilience of critical infrastructure.

Secfix

Secfix

Secfix helps companies get secure and compliant in weeks instead of months. We are on a mission to automate security and compliance for small and medium-sized businesses.

Access Venture Partners

Access Venture Partners

Access Venture Partners are an early stage VC firm investing in bold founders and helping every step of the way. Areas we give special focus to include cybersecurity.

RapidSpike

RapidSpike

RapidSpike is the only website monitoring solution that focuses all three key aspects of website health: performance, reliability AND security.

Miggo Security

Miggo Security

Miggo is the first Application Detection and Response (ADR) platform on a mission to stop application breaches.

Standard Notes

Standard Notes

Standard Notes is a secure digital notes app that protects your notes and files with audited, industry-leading end-to-end encryption.

Merkle Science

Merkle Science

Merkle Science provides next generation risk mitigation, compliance and forensics for crypto-native businesses, DeFi participants, financial institutions & government agencies.