Cyber attacks could cause catastrophic failure say 70 percent of energy security pros
A new study looking at industrial control systems (ICS) security in the energy industry reveals a majority of respondents are worried about potentially catastrophic effects from a successful cyber attack.
The study carried out for security and compliance specialist Tripwire by Dimensional Research included 151 IT and operational technology (OT) security professionals at energy and oil and gas companies.
It finds 70 percent of respondents are concerned that a successful cyberattack could cause a catastrophic failure, such as an explosion. With widespread recognition of the physical threat cyber attacks present against the energy and oil and gas industry, 97 percent are concerned that attacks could cause operational shutdowns, and 96 percent believe they could impact the safety of their employees.
"Energy companies have accepted the reality that digital threats can have tangible consequences," says Tim Erlin, vice president of product management and strategy at Tripwire. "This perception is perhaps heightened by recent attacks that were specifically designed to affect physical operations and have proven capable of doing so."
There's worry about lack of investment in security, with 62 percent saying that lack of budget and investment continues to be the biggest barrier in meeting ICS security goals. Of those who say their company does not invest sufficiently, 56 percent believe it would take a significant attack to get their companies to make a proper level of investment.
A large majority, 91 percent, are worried about attacks on their ICS, and 59 percent say their companies have increased security investments because of ICS-targeted attacks like Trisis/Triton, Industroyer/CrashOverride and Stuxnet.
Ransomware remains a major issue too, with 45 percent saying it has had the most significant impact in increasing their security investment, compared to 44 percent who said Trisis/Triton and Industroyer/Crashoverride and 11 percent who said Stuxnet.
"It's encouraging to see that companies have increased their security investment somewhat," Erlin adds. "However, it’s concerning that more than half would wait for an attack to happen before investing properly, given what's at stake with critical infrastructure. The energy industry should invest in establishing more robust cybersecurity strategies, with a proper foundation of critical security controls and layers of defense."
You can read more about the findings on the Tripwire website.
Image Credit: Meryll / Shutterstock