US-based SANS Institute’s annual survey of industrial control systems (ICS) has revealed that the introduction of unprotected devices into sensitive ICS networks and ransomware are now among the top threats that organisations face in securing critical infrastructure.

SANS Institute is a leading company that specialises in information security and cybersecurity training.

In addition, 69 per cent of respondents stated that the level of threats to control systems is now high or severely critical, said a statement from the company.

Ned Baltagi, managing director, Middle East and Africa (MEA), SANS, said: “Industrial plants and critical infrastructure have become prime targets for politically and financially motivated cybercriminals in the Middle East.”

“Traditionally, these systems have been less frequently updated and the teams operating them lack dedicated cyber security professionals. This places some of the most critical systems we have in the Middle East at risk of cyber-attack,” he said.

The survey also found that some basic security practices are still not being implemented and identifying attacks remains challenging; 40 per cent of ICS security practitioners lack visibility or sufficient supporting intelligence into their ICS networks and this is one of the primary impediments to securing these systems.

Despite the high-profile news coverage of recent attacks against unpatched systems, SANS found that only 46 per cent of respondents regularly apply vendor-validated patches. An astounding 12 per cent neither patch nor layer controls around critical control system assets.

Baltagi continued: “The importance of patching systems and keeping them up to date cannot be emphasised enough.”

“Consider WannaCry which as a ransomware attack was no doubt a top concern for ISC security practitioners. It spread by exploiting a known Microsoft vulnerability which is why unpatched systems played a key role in the spread of the malicious code,” he said.

“Once again, the lack of skilled cyber security professionals or appropriately trained IT staff in the field is impacting the ability of ICS organisations to adequately patch their systems, exacerbating this issue,” he added.
 
Bengt Gregory-Brown, survey author, said: “Changes in ICS/SCADA environments have historically come at a pretty slow pace, but this pace is accelerating with IT/OT convergence, and the speed of change is challenging everyone working with these systems to keep up, or accept growing levels of risk.”

Now in its fourth consecutive year, the survey noted some improvements in protecting critical assets and infrastructure, and respondents acknowledged that their ICS security budgets have increased over the fiscal year 2016.

“With higher budgets becoming available to ISC professionals, it is imperative that they are aware of the key issues that the industry faces so they can allocate time and resources to the most pressing issues,” concluded Baltagi. – TradeArabia News Service