Industrial Cyber Threats: Processes & Protection for Industrial Control Systems highlights the vulnerability of OT networks in critical infrastructure and industrial applications such as manufacturing.
Donal Bourke, manager new business & advanced solutions at Yokogawa UK & Ireland, says digital transformation and IIoT, while having enormous benefits, can simultaneously create an acute danger if not appropriately designed and managed. “Digitalisation and the adoption of new technologies that facilitate interoperability, information flow and data insight can create an OT blind spot that can be exploited by state-sponsored action or by highly sophisticated lone-wolf hackers. They are increasingly targeting critical infrastructure with attacks that have the potential to disrupt the normal functioning of a society, such as power generation.”
Unlike cyber-attacks on IT systems, attacks on OT networks are of significantly higher concern and can have much graver implications.
Bourke continues: “At one time, industrial environments were considered immune to cyber-attack due to employing techniques such as air-gapping which is the physical isolation of networks. This is no longer the case, as digitalisation which has facilitated the convergence of IT and OT, has created a larger threat attack surface for bad actors to gain access to a facility’s integrated control and safety systems. Today’s hackers recognise the vulnerabilities of OT systems and are actively looking for ways to compromise them.”
The report highlights the fact that OT security is in its infancy compared to IT security, despite the magnified risk, and urges government and industry to take a holistic approach.
“There is no technology magic bullet that will mitigate the cyber security risk of increasing IT and OT convergence, the threat to control systems and human fallibility. The solution lies in taking a more holistic approach that involves awareness training, risk assessments, the development of OT appropriate policies and procedures, and architecting a system which provides an organisation with a comprehensive cyber-security management system.”
The report is available for download via the link below.