Industrial control systems need to be protected in a world where automation opens avenues for criminals to exploit them. Air gapped SCADA systems will become more and more difficult to stick to in the era where the Internet of Things is striving to connect and automate industrial control systems. There is just no escaping the fact that networks will have to be connected to a cloud-based solution that could enable cyber criminals.
Last year, only 24 percent of engineers who took part in a survey by SANS Information Security believed that there were moderate to severe attacks on industrial control systems. This year, 67 percent of the engineers agree that the situation is becoming dire.
Derek Harp, the director of industrial control systems global programs at Bethesda said: "It's a trend driven by a problem that's been getting worse. There are more incidents being reported, and more awareness at the senior levels of the companies about what their exposures are."
Bengt Gregory-Brown, a SANS Information Security analyst said: "Control systems are increasingly integrated with IT networks and assets, offering more breach opportunities and attack surfaces in the ICS environment. Unfortunately, we are not seeing a commensurate improvement in the efforts or outcomes of ICS and SCADA security."
Now, industrial security professionals are saying that there is no information sharing across the industry concerning the safeguarding of industrial control systems. Respondents to a study pertaining to information-sharing partnerships have revealed that
"Knowledge is a big problem here. There are a lot of undetected problems. It's widely held that most systems have had some sort of probing, but it's really hard to know if someone was there," Harp said.
These sorts of probings are now the interest of private cybersecurity firms that will attempt to prevent attacks by cyber-criminals who are trying to brute force access to control industrial control systems.
Harp says that their study data indicates that there is a lot of misunderstanding in the industry in terms of ignorance of underlying software being targeted by cybercriminals. He said: "We find the lack of concern with this ubiquitous communication mechanism connecting IT and ICS assets troubling, as it is often targeted by bad actors. Attackers use it to pivot from the business network into the ICS."
