Tripwire Survey: 70 Percent of Energy Security Professionals Concerned About 'Catastrophic Failure' from Cyberthreats
While recognizing physical consequences of cyberthreats, proper investment lacking
PORTLAND, Ore. – April 18, 2018 – Tripwire, Inc., a leading global provider of security and compliance solutions for enterprises and industrial organizations, today announced the results of a survey conducted by Dimensional Research examining industrial control systems (ICS) security in the energy industry. The survey was conducted in March, and its respondents included 151 IT and operational technology (OT) security professionals at energy and oil and gas companies.
According to the survey, 70 percent of respondents are concerned that a successful cyberattack could cause a catastrophic failure, such as an explosion. With widespread recognition of the physical threat cyberattacks present against the energy and oil and gas industry, 97 percent are concerned that attacks could cause operational shutdowns, and 96 percent believe they could impact the safety of their employees.
"Energy companies have accepted the reality that digital threats can have tangible consequences," said Tim Erlin, vice president of product management and strategy at Tripwire. "This perception is perhaps heightened by recent attacks that were specifically designed to affect physical operations and have proven capable of doing so."
Respondents were also asked about their organizations’ security investments, with the following results:
- While 65 percent feel their company invests sufficiently in ICS security, 62 percent said that lack of budget and investment continues to be the biggest barrier in meeting ICS security goals.
- Of those who said their company does not invest sufficiently, 56 percent believe it would take a significant attack to get their companies to a proper level of investment.
- Ninety-one percent are worried about attacks on their ICS. Fifty-nine percent said their companies increased security investments because of ICS-targeted attacks like Trisis/Triton, Industroyer/CrashOverride and Stuxnet.
- Forty-five percent said ransomware has had the most significant impact in increasing their security investment, compared to 44 percent who said Trisis/Triton and Industroyer/CrashOverride and 11 percent who said Stuxnet.
It is widely recommended that organizations properly secure their critical infrastructure ICS with a layered approach, commonly referred to as Defense in Depth. In the survey, only 35 percent of respondents said they implement a multilayered approach to ICS security. Thirty-four percent said they focus primarily on network level security, and 14 percent said ICS device security.
Erlin added: "It's encouraging to see that companies have increased their security investment somewhat. However, it’s concerning that more than half would wait for an attack to happen before investing properly, given what's at stake with critical infrastructure. The energy industry should invest in establishing more robust cybersecurity strategies, with a proper foundation of critical security controls and layers of defense."
For more information please visit: https://www.tripwire.com/state-of-security/ics-security/70-percent-energy-security-pros-fear-digital-attacks-produce-catastrophic-failure/
Tripwire is the trusted leader for establishing a strong cybersecurity foundation. Partnering with Fortune 500 enterprises, industrial organizations and government agencies, Tripwire protects the integrity of mission-critical systems spanning physical, virtual, cloud and DevOps environments. Tripwire’s award-winning portfolio delivers top critical security controls, including asset discovery, secure configuration management, vulnerability management and log management. As the pioneers of file integrity monitoring (FIM), Tripwire’s expertise is built on a 20+ year history of innovation helping organizations discover, minimize and monitor their attack surfaces.
Learn more at https://www.tripwire.com/, get security news, trends and insights at www.tripwire.com/blog, or connect with us on LinkedIn, Twitter and Facebook.