Yesterday I posted a review of the recent SANS State of Industrial Control Systems Survey. You can find that posting here.
Today I'd like to tell you about another interesting and equally disconcerting survey about the status of today's industrial control system security posture.
Each year Control Engineering Magazine conducts a survey of its readers to evaluate cyber security implementation, resources and training for industrial control systems. Their 2015 Cyber Security report was issued this June. A summary of the study posted by Control Engineering is located here.
The Control Engineering report is essentially in presentation format and has a collection of graphs and data relative to the data collected. It is a pretty easy and quick read and offers similar data to the SANS Survey.
Statistics and Findings
The Control Engineering analysis included data collected from 284 respondents in the first quarter of 2015. The report includes the following summary findings:
1. Threat Levels: 47% of respondents perceive their control systems to be "moderately" threatened by cyber attacks. 25% say theirs is "highly" threatened and 8% are at the "severe" threat level.
2. Most Concerning Threat: Their responses included:
Today I'd like to tell you about another interesting and equally disconcerting survey about the status of today's industrial control system security posture.
Each year Control Engineering Magazine conducts a survey of its readers to evaluate cyber security implementation, resources and training for industrial control systems. Their 2015 Cyber Security report was issued this June. A summary of the study posted by Control Engineering is located here.
The Control Engineering report is essentially in presentation format and has a collection of graphs and data relative to the data collected. It is a pretty easy and quick read and offers similar data to the SANS Survey.
Statistics and Findings
The Control Engineering analysis included data collected from 284 respondents in the first quarter of 2015. The report includes the following summary findings:
1. Threat Levels: 47% of respondents perceive their control systems to be "moderately" threatened by cyber attacks. 25% say theirs is "highly" threatened and 8% are at the "severe" threat level.
2. Most Concerning Threat: Their responses included:
- 35% view the most concerning threat is malware from a random source
- 18% worried about loss of intellectual property
- 8% fear attacks from "hacktivists" with political or environmental agendas.
3. Most Vulnerable System Components: The components of most concern include:
- Connections to other internal systems (SANS is similar)
- Computer assets running commercial operating systems (Same as SANS)
- Network devices
- Wireless communication devices and protocols
- Connections to the field SCADA networks
4. Vulnerability Assessments: 39% of those surveyed said their last vulnerability assessment was performed within the last six months (Good!); while 16% have never executed one (Not So Good).
5. Publicly Reporting Incidents: 66% of those surveyed say publicly reporting cyber-related incidents would benefit the industry. 36% agree that the biggest problem with public reporting is the fear of losing consumer confidence.
6. Resources Used to Monitor Control System Cyber Security Events:
- Anti-virus software (99%)
- Network logs (89%)
- Firewall logs (89%)
- Intrusion Detection/Prevention (84%)
- Whitelisting (76%)
Overall....
Overall this is a useful survey to examine and as I noted for the SANS ICS Security Survey, these reports should be reviewed and digested by security professionals responsible for ICS security and shared with their executive management to show them that security is a concern and should be theirs, too.
###
