In recent years, there have been a significant surge in cyber threats targeting industrial control systems (ICS) and associated control networks. Industry reports reveal an 87% increase in ransomware attacks on industrial organisations, coupled with a 35% rise in the number of ransomware groups targeting industrial control and operational technology (OT) systems.[1]
Operational Technology (OT) is defined as hardware and software used to interact with or affect physical processes such as manufacturing.
Examples of OT include PLC and SCADA systems, sensors, scientific equipment and connected medical devices. Many OT environments incorporate a combination of fit for purpose hardware and software solutions from automation vendors with commodity IT systems and Internet of things (IoT) devices. Whilst this connectivity provides benefits, they also introduce new avenues of cyber risk.
Financial gain and industrial espionage are the main motives behind cyber-attacks on the Manufacturing, Energy and Natural Resources industries, with one third of breaches involving theft of intellectual property.[2]
The net effect of cyber events can extend beyond loss of revenue and reputation. OT transcends the traditional triad of information security imperatives of confidentiality, integrity and availability; it places health and safety at its core. Malfunction due to cyber-incidents has the very real risk of causing interruption to operations, injury or worse.
Risks faced by industry
The nature of OT creates complex cybersecurity risks for organisations.
Some of the challenges that could be faced include:Â
- Senior leadership awareness of cyber risk in their environments, leading to disjointed focus and insufficient investment
- OT cyber-hygiene practices by employees
- Interconnected industrial and corporate networks exposes a critical risk in allowing threats such as malware and remote attackers to move laterally between networks. Strong perimeter firewalling, as well as internal network segmentation with threat detection capabilities are crucial to mitigate this risk
- Software and hardware compatibility concerns inherent with OT devices result in challenges to ensure devices are sufficiently patched and configured in line with good practice, which is further compounded by legacy systems
- Privileged access management, including remote access for support personnel (including third party vendors) remain a blind spot for many organisations
Critical questions to ask
Leaders are encouraged to gain insights into the current state of cybersecurity in their OT environment.
Some of the questions that they should reflect on include:
Have you identified the cyber-related risks to which your…
 |
 |
|
Marcelo Vieira | Partner | |
Gustav D’Assonville | Senior Manager | |
The full article is reserved for our subscribers!
Read the full article by Marcelo Vieira, Partner and Gustav D’Assonville, Senior Manager, KPMG South Africa, as well as a host of other topical management articles written by professionals, consultants and academics in the February/March 2024 edition of BusinessBrief.
admin@bbrief.co.za | +27 (0)11 788 0880 |
