Barracuda Networks Inc. (Barracuda), a partner and provider of cloud-enabled security solutions, releases findings today in a report titled The State of Industrial Security in 2022. Commissioned by Barracuda, the research surveyed 800 senior IT managers, senior IT security managers and project managers responsible for the industrial internet of things (IIoT)/operational technology (OT) in their organization to get their perspectives on IIoT/OT security projects, implementation challenges, security incidents, technology investments and a variety of issues related to cybersecurity risks.
Overall, the research shows critical infrastructure is under attack, and despite agreement that IIoT and OT security is critical, businesses face challenges as the geopolitical landscape becomes increasingly tense.
Security breaches have had impacts beyond monetary losses resulting in significant downtime with a long-lasting breach impact. The research found:
- Attacks are widespread – 94 percent of organizations surveyed acknowledged experiencing a security incident in the last 12 months.
- Geopolitical concerns – 89 percent of respondents are very or fairly concerned about the impact that the current threat landscape and the geopolitical situation will have on their organizations.
- Breaches are impacting operations – 87 percent of organizations that experienced an incident were impacted for more than one day.
“In the current threat landscape, critical infrastructure is an attractive target for cybercriminals, but unfortunately IIoT/OT security projects often take a backseat to other security initiatives or fail due to cost or complexity, leaving organizations at risk,” said Tim Jefferson, SVP, Engineering for Data, Networks and Application Security, Barracuda. “Issues such as the lack of network segmentation and the number of organizations that aren’t requiring multifactor authentication leave networks open to attack and require immediate attention.”
Organizations across the board have acknowledged the importance of investing more in IIoT and OT security, with 96 percent of business leaders noting their organization needs to increase their investment in industrial security. A full 72 percent of organizations signaled they have either already implemented or are in the process of implementing IIoT/OT security projects, but many face significant challenges when it comes to implementation, including basic cyber hygiene.
Other findings include:
- Manufacturing and health care lag behind – Critical infrastructure organizations lead with implementation, and 50 percent of oil and gas have completed projects. Only 24 percent in manufacturing and 17 percent in health care have completed projects.
- Businesses are experiencing failures – 93 percent have failed in their IIoT/OT security projects.
- Effective IIoT security implementations are making an impact – For organizations with completed IIoT and OT security projects, 75 percent have experienced no impact at all from a major incident.
- Multifactor authentication (MFA) use is low – Only 18 percent of companies surveyed restrict network access and enforce multifactor authentication when it comes to remote access to OT networks.
- Low MFA use is prevalent even in critical industries – Critical verticals like energy (47 percent) allow full remote access without MFA for external users.
- Skills have an impact – Less than half of organizations surveyed can handle applying security updates themselves (49 percent).
- Manual updates are cumbersome – Organizations are hit the worst when security updates are not automatic.
IIoT and OT security continue to be major targets for attackers, but there is hope for businesses that take a proactive approach. Businesses may want to implement tools to combat these challenges, including the use of secure endpoint connectivity devices and ruggedized network firewalls, all centrally deployed and managed via a secure cloud service that can enable effective network segmentation and advanced threat protection, provide multifactor authentication and implement Zero Trust Access.
“IIoT attacks go beyond the digital realm and can have real-world implications,” said Klaus Gheri, VP of Network Security, Barracuda. “As attacks continue to rise across industries, taking a proactive security approach when it comes to industrial security is critical for businesses to avoid being the next victim of an attack.”
To download the full report, go here: https://barracuda.com/iiot-2022-report
