This reminds me of other technologies I’ve seen transition from few users to industry standard seemingly overnight. This latest survey from Nozomi Networks and SANS Institute finds industrial organizations are leveraging the cloud as they mature cybersecurity defenses and prioritize control system reliability. However, threats remain high and are growing in severity. In response, a growing majority of organizations have significantly matured their security postures since the last SANS OT/ICS survey in 2019. From the report: In spite of the progress, almost half (48%) don’t know whether their organizations had been compromised. The Nozomi Networks-sponsored survey echoes Nozomi Networks’ own experiences with customers worldwide.
“It’s concerning to see that nearly half of this year’s survey respondents don’t know if they’ve been attacked when visibility and detection solutions are readily available to provide that awareness,” said Nozomi Networks Co-founder and CPO Andrea Carcano. “Threats may be increasing in severity, but new technologies and frameworks for defeating them are available and the survey found that more organizations are proactively using them. Still, there’s work to be done. We encourage others to adopt a post-breach mindset pre-breach and strengthen their security and operational resiliency before an attack.”
Cyber threats to OT environments continue to rise and threat severity is at an all-time high.
- Most respondents (69.8%) rated the risk to their OT environment as high or severe (up from 51.2% in 2019).
- Ransomware and financially motivated cybercrimes topped the list of threat vectors (54.2%) followed by nation-state sponsored cyberattacks (43.1%). Unprotected devices and things added to the network came in third (cited by 31.3% of survey respondents).
- Of the 15% of survey respondents who indicated they had experienced a breach in the last 12 months, a concerning 18.4% said the engineering workstation was an initial infection vector.
- Nearly half of all respondents (48%) did not know whether their organizations had been compromised and only 12% were confident that they hadn’t had an incident.
- In general, external connections are the dominant access vector (49%) with remote access services identified as the most prevalent reported initial access vector for incidents (36.7%).
This year’s survey found most organizations are taking ICS threats seriously and making solid progress in maturing their security postures to address them. Over the last two years organizations have improved monitoring and threat intelligence capabilities. They are moving away from traditional indicator-based defense capabilities and moving toward threat hunting and hypothesis-based security models. They’re also focusing on data loss prevention.
- 47% say their control system security budget increased over the past two years.
- Almost 70% have a monitoring program in place for OT security.
- 51% say they are now detecting compromises within the first 24 hours of an incident. The majority say they move from detection to containment within 6 to 24 hours.
- 9% have conducted a security audit of their OT/control systems or networks in the past year and almost a third (29.5%) have now implemented a continual assessment program.
- 50% say they have vendor-provided ICS-specific threat intelligence feeds and there is less reliance (36%) on IT threat intelligence providers.
- OT SOC adoption is up by a sharp 11% from 2019 to 2021, re-emphasizing the focus away from traditional indicator-based defense capabilities and more toward a threat hunting and hypothesis-based security model.
- Data loss prevention technologies also saw a sharp increase in deployment (11%).
- As process reliability becomes a top concern, 34% say they’re implementing zero-trust principles and an additional 31% say they plan to.
ICS is Getting Cloudy
Adoption of cloud-native technologies and services transformed the IT industry. This year’s survey found similar impacts are also beginning to be felt in the OT environment.
- 1% of all survey respondents indicate they are using some cloud-based services for OT/ICS systems.
- Almost all (91%) are using cloud technologies to directly support ICS operations (combining remote monitoring configuration and analysis; cloud services supporting OT; and remote control/logic).
- All respondents using cloud technologies are using cloud services for at least one type of cybersecurity function (company NOC/SOC, business continuity and MSSP support).
- Respondents consider cloud assets relatively secure, with only 13% of responses classifying them as risky.
To learn more about the latest trends in OT/ICS cybersecurity:
• Download A SANS 2021 Survey: OT/ICS Cybersecurity
The SANS Institute was established in 1989 as a cooperative research and education organization. SANS is the most trusted and, by far, the largest provider of training and certification to professionals at governments and commercial institutions world-wide. Renowned SANS instructors teach over 50 different courses at more than 200 live cyber security training events as well as online. GIAC, an affiliate of the SANS Institute, validates employee qualifications via 30 hands-on, technical certifications in information security. The SANS Technology Institute, a regionally accredited independent subsidiary, offers master’s degrees in cyber security. SANS offers a myriad of free resources to the InfoSec community including consensus projects, research reports, and newsletters; it also operates the Internet’s early warning system–the Internet Storm Center. At the heart of SANS are the many security practitioners, representing varied global organizations from corporations to universities, working together to help the entire information security community. (www.SANS.org)
• Here are a few responses to questions about the report:
1 What were the most surprising things you found in the report?
Chris Grove – Technology Evangelist – Nozomi Networks
Positive: It was a pleasant surprise to see that a large group of respondents (40.1%) have embraced cloud-base services. It’s a trend that Nozomi Networks has seen in the field and one that we have responded to with our own cloud-based security offerings. As Industrial and critical infrastructure organizations embrace IoT and converge their OT and IT efforts, they must be able to protect thousands of devices quickly and cost-effectively from threats in real-time and ensure ongoing operational resilience. Cloud-based technologies make that possible. It’s also encouraging to see the majority are confident in the security of their cloud assets. We believe ICS organizations will continue to adopt cloud technologies and the adoption of cloud-base security solutions will grow significantly over the next few years.
Negative: It’s alarming to see that detection and response is still a significant issue for organizations. In fact, the problem seems to have grown since the previous survey (48% of survey participants did not know whether they’d had an incident vs. 42% in 2019). Solutions are available to address this problem and adopting them should be a top priority.
Mark Bristow – Author – A SANS 2021 Survey: OT/ICS Cybersecurity
I found three things particularly striking in the report results.
● The level of adoption of cloud technologies for operational outcomes was striking. Two years ago, cloud adoption was not being seriously discussed and now 49% are using it.
● Incident visibility and confidence is not high. 48% of respondents could not attest that they didn’t have an incident. A further 90% of these incidents had some level of operational impact.
● 18% of incidents involved the engineering workstation. This is a critical piece of equipment and having this involved in so many incidents is troubling.
2 What are three things you think ICS operators need to focus on moving forward to protect themselves?
Chris Grove, Nozomi Networks: Considering Ransomware is such a pervasive issue; it might be a first concern for many operators. Starting off with some tabletop exercises, operators would be able to identify areas where improvements can be made. Typically, one area that gets highlighted is the need for a systematic risk assessment that details likely points of entry and identifies ways to harden the target. Sometimes this is in the form of patching, network segmentation, policies, procedures, etc. In almost all cases, increased visibility makes everything easier to manage. From having a detailed asset inventory, to monitoring network traffic patterns, to inspecting traffic for attacks or operational anomalies…. visibility is a crucial component of successfully defending operations. Finally, the third and final thing that operators should consider is Consequence Reduction. As part of a post-Breach mindset, operators should consider the fact that eventually the attackers will breach the perimeter, and one should be prepared for that day. How do we limit the blast radius of the attack? How do we hold them at bay, and subsequently eradicate them from the system? How do we carefully maintain, safely shutdown, or restore operations potentially affected by the breach? These are tough questions to be asked before that day comes.
Mark Bristow, SANS:
· It’s great that we now have monitoring programs in place, but we are still mostly looking at the IT aspects of our OT environments. We need to be correlating our IT and OT security telemetry as well as process data to truly understand potential impacts to safety and operations.
· Focus on fundamentals. Too many respondents do not have a formal program for asset identification and inventory. Without this foundational step, further security investments may be invalid or misplaced.
· Ransomware is a huge risk, but it’s not one that is specifically targeting ICS. A malicious actor who is specifically targeting your ICS environment will not be as blunt or noisy as ransomware is, and we are struggling to defend against ransomware.
