Cybersecurity Pros Face Significant Challenges with OT Security: Ponemon Report

62% of organizations in industries relying on operational technology experienced two or more business-impacting cyberattacks in the past 24 months, according to a report from Ponemon Institute and Tenable.

If you follow cybersecurity news as avidly as we do, you already know that industrial control systems underlying critical infrastructure are vulnerable, and they are under attack. But, how bad is it? Tenable commissioned Ponemon Institute to answer this question and provide insight into past events, preparedness and future priorities. The data from 701 respondents in industries that have OT infrastructure is presented in the report, "Cybersecurity in Operational Technology: 7 Insights You Need to Know". A few highlights are discussed below.

OT is not well-defended and vulnerabilities abound

Visibility into the attack surface is insufficient. Only 20% of respondents agreed or strongly agreed that they had sufficient visibility into their organization’s attack surface. This is very concerning because all security controls/processes depend on the visibility provided by comprehensive asset inventories. You are unlikely to manage and secure assets if you don’t even know about them.

Inadequate staffing and manual processes limit vulnerability management. The shortage of cybersecurity professionals has been well documented. In 2017, Forbes quoted the IS Audit and Control Association (ISACA) as predicting a global shortage of 2 million cybersecurity professionals by 2019. We are now in 2019, and I haven’t seen any data disprove ISACA’s prediction. The well-publicized cybersecurity skills shortage is exacerbated by reliance on manual processes to assess and remediate vulnerabilities.

Top impediments to effective vulnerability management

Using a five-point scale of strongly agree to strongly disagree, the following percentage of respondents agreed or strongly agreed with the below statements.

Source: title="Cybersecurity in Operational Technology: 7 Insights You Need To Know Ponemon Institute">Cybersecurity in Operational Technology: 7 Insights You Need To Know, Ponemon Institute and Tenable, April 2019.

Vulnerabilities Continue to Proliferate. The ability to assess and remediate vulnerabilities in a timely manner is extremely important. In the first 45 days of 2019, the Industrial Control System-Computer Emergency Response Team (ICS-CERT) issued 45 alerts describing vulnerabilities in industrial control systems¹. These vulnerabilities apply to products from leading control system manufacturers, including ABB, AVEVA, Mitsubishi, Omron, Rockwell, Schneider Electric, Siemens and Yokogawa. That quantity is small compared to the 405 IT vulnerabilities discovered during the same period. However, staff responsible for OT security cannot put blinders on and focus only on OT vulnerabilities because IT/OT convergence means that both ICS and IT vulnerabilities can be exploited to attack critical infrastructure. 450 combined OT and IT vulnerabilities in 45 days is challenging for many organizations to assess and remediate. This velocity may or may not continue throughout the year, but even if it decreases by half, the number is challenging to manage without an automated process.

OT is under attack

According to the Operational Technology Cybersecurity Insights report, manual vulnerability management processes result in inadequate protection against cyber-attacks. The report reveals most organizations in industries that have OT infrastructure have experienced multiple cyber-attacks causing data breaches and significant disruption/downtime to business operations, plant and operational equipment. Over the past 24 months:

• 90% have experienced at least one damaging cyberattack, and 62% have experienced two or more. These data refer to all damaging attacks, not just attacks against OT infrastructure. IT attacks are included because some can result in attackers pivoting from IT into OT.
• 50% experienced an attack against OT infrastructure that resulted in downtime to plant and/or operational equipment.
• 23% experienced a nation-state attack. Nearly one quarter were able to attribute an attack to a nation state. This is a serious concern due to the high level of expertise and funding nation-states can provide. Nation-states attackers are not script kiddies.

How can you move forward?

The survey reveals that 70% of respondents view “Increasing communication with C-level and board of directors about the cyber threats facing our organization” as one of their governance priorities for 2019. If this applies to you, you can reference the survey data in discussions with executive leadership as you discuss your organization’s security posture relative to OT attacks.

About this study

The report is based on a survey of 710 IT and IT security decision-makers in the following industries: energy and utilities; health and pharmaceutical; industrial and manufacturing; and transportation industries. Respondents were from the United States, United Kingdom, Germany, Australia, Mexico and Japan, and all respondents have involvement in the evaluation and/or management of investments in cybersecurity solutions within their organizations. The consolidated global findings are presented in this report.

¹Tenable Research discovered a Remote Code Execution vulnerability in InduSoft Web Studio, an automation tool for human-machine interface and SCADA systems.