Internet-connected systems are at greatest risk

[rakhirhif8963]

While attacks via removable media and email are common, the largest number of attackers use widespread scanning of internet-facing systems to establish a foothold in a vulnerable network, Kaspersky Lab says. In the first half of 2018, over 27% of attacks came from internet sources, compared to 20.6% in the same period in 2017.

“Contrary to popular belief about the isolation of control networks, in recent years the Internet has become the main source of infection of computers in industrial networks of organizations,” says Kaspersky Lab.

But Digital Bond's Peterson stressed that the attacks seen by security firms are likely to be those targeting smaller firms whose systems are not as well protected as critical infrastructure in Western countries. "What the research does tell us is that there are still a lot of soft victims," ​​he said. "I don't see a lot of high-value critical infrastructure that has Windows servers directly connected to the Internet."

Managers think systems are better protected than their operators believe
There's another disconnect in the ICS world: Senior hungary mobile database think their systems are more secure than the operations engineers and others who work directly with those systems believe, says Barbara Filkins, a senior analyst at the SANS Institute.

The latest report, The 2018 SANS Industrial IoT Security Survey: Shaping IIoT Security Concerns, shows that nearly three-quarters of companies are confident or somewhat confident in their ability to secure their Industrial IoT systems. CEOs and business unit managers are significantly more optimistic about their security posture than those in operations.

“Those who are most directly exposed to risk are less confident in their ability to protect the operational network,” Filkins said. “Management is, in fact, more confident than it should be and should listen to those lower down the food chain.”

Companies need to improve visibility, train employees on security operations and better segment their networks to limit attackers' ability to come in from the side once a foothold has been established, the SANS Institute report said.

SealSend to Telegram