Connect with us

Market Research

Fortinet Global Survey Uncovers Critical OT Security Challenges

Published

on

Fortinet has released its global 2022 State of Operational Technology and Cybersecurity Report. While industrial control environments continue to be a target for cybercriminals – with 93% of Operational Technology (OT) organizations experiencing an intrusion in the past 12 months – the report uncovered widespread gaps in industrial security and indicated opportunities for improvements.

John Maddison, EVP of Products and CMO at Fortinet said, “This year’s global State of OT and Cybersecurity Report demonstrates that while OT security has the attention of organizational leaders, critical security gaps remain. PLCs designed without security, continued intrusions, a lack of centralized visibility across OT activities, and growing connectivity to OT are some of the critical challenges these organizations need to address. Security converged into the OT networking infrastructure, including switches and access points, and firewalls is essential to segment the environment. This combined with a platform that spans OT converged OT/IT and IT provides end-to-end visibility and control.”

Key findings of the report include:

  • OT activities lack centralized visibility, increasing security risks. The Fortinet report found that only 13% of respondents have achieved centralized visibility of all OT activities. Additionally, only 52% of organizations are able to track all OT activities from the security operations center (SOC). At the same time, 97% of global organizations consider OT a moderate or significant factor in their overall security risk. The report findings indicate that the lack of centralized visibility contributes to organizations’ OT security risks and weakened security posture.
  • OT security intrusions significantly impact organizations’ productivity and their bottom line. The Fortinet report found that 93% of OT organizations experienced at least one intrusion in the past 12 months and 78% had more than three intrusions. As a result of these intrusions, nearly 50% of organizations suffered an operation outage that affected productivity with 90% of intrusions requiring hours or longer to restore service. Additionally, one-third of respondents saw revenue, data loss, compliance, and brand value impacted as a result of security intrusions.
  • Ownership of OT security is not consistent across organizations. According to the Fortinet report, OT security management falls within a range of primarily director or manager roles, ranging from the Director of Plant Operations to the Manager of Manufacturing Operations. Only 15% of survey respondents say that the CISO holds the responsibility for OT security at their organization.
  • OT security is gradually improving, but security gaps still exist in many organizations. When asked about the maturity of their organization’s OT security posture, only 21% of organizations have reached level 4, which includes leveraging orchestration and management. Notably, a larger proportion of Latin America and APAC respondents have reached level 4 compared to other regions. More than 70% of organizations are in the middle levels toward having a mature OT security posture. At the same time, organizations face challenges with using multiple OT security tools, further creating gaps in their security posture. The report found that a vast majority of organizations use between two and eight different vendors for their industrial devices and have between 100 and 10,000 devices in operation, adding complexity.

OT Security is a Corporate-Level Concern
As OT systems increasingly become targets for cybercriminals, C-level leaders recognize the importance of securing these environments to mitigate risks to their organizations. Industrial systems have become a significant risk factor since these environments were traditionally air-gapped from IT and corporate networks, but now these two infrastructures are becoming universally integrated. With industrial systems now being connected to the internet and more accessible from anywhere, organizations’ attack surface is increasing significantly.

With the IT threat landscape becoming more sophisticated, connected OT systems have also become vulnerable to these growing threats. This combination of factors is moving industrial security upward in many organizations’ risk portfolios. OT security is a growing concern for executive leaders, increasing the need for organizations to move toward full protection of their industrial control system (ICS) and supervisory control and data acquisition (SCADA) systems.

Best Practices to Overcome OT Security Challenges
Fortinet’s global 2022 State of Operational Technology and Cybersecurity Report indicated ways organizations can address OT systems’ vulnerabilities and strengthen their overall security posture. Organizations can address their OT security challenges by:

  • Establish Zero Trust Access to prevent breaches. With more industrial systems being connected to the network, Zero Trust Access solutions ensure that any user, device, or application without proper credentials and permissions is denied access to critical assets. To advance OT security efforts, Zero Trust Access solutions can further defend against both internal and external threats.
  • Implementing solutions that provide centralized visibility of OT activities. Centralized, end-to-end visibility of all OT activities is key to ensuring organizations strengthen their security posture. According to Fortinet’s report, top-tier organizations – which make up the 6% of respondents who reported no intrusions in the past year – were more than three times as likely to have achieved centralized visibility than their counterparts who suffered intrusions.
  • Consolidating security tools and vendors to integrate across environments. To remove complexity and help achieve centralized visibility of all devices, organizations should look to integrate their OT and IT technology across a smaller number of vendors. By implementing integrated security solutions, organizations can reduce their attack surface and improve their security posture.
  • Deploying network access control (NAC) technology. Organizations that avoided intrusions in the past year were more likely to have role-based NAC in place, ensuring that only authorized individuals can access specific systems critical for securing digital assets.

Securing OT Environments with the Fortinet Security Fabric
For more than a decade, Fortinet has protected OT environments in critical infrastructure sectors such as energy, defense, manufacturing, food, and transportation. By designing security into complex infrastructure via the Fortinet Security Fabric, organizations have an efficient, non-disruptive way to ensure that their OT environment is protected and compliant. With full integration and shared threat intelligence, industrial organizations gain fast, automated responses to attacks in any vector. Fortinet’s Security Fabric covers the entire converged IT-OT network to close OT security gaps, deliver full visibility and provide simplified management.

This year’s State of Operational Technology and Cybersecurity Report is based on a survey of more than 500 global OT professionals conducted in March 2022. The survey targeted people holding leadership positions responsible for OT and OT security, from managers to C-level executives. Respondents represent a range of industries that are heavy users of OT, including manufacturing, transportation and logistics, and healthcare.

Cyber Security

New Hacktivism Model Trends Worldwide

Published

on

Check Point Research (CPR) outlines a new model of hacktivism now trending worldwide. Five characteristics mark today’s form of hacktivism, according to researchers: political ideology, leadership hierarchy, formal recruiting, advanced tools, and public relations. CPR gives the hacktivist group Killnet an example of the latest model, detailing its attacks by country and attack timeline. CPR warns that hacktivism that originates in conflict-related geographies has the potential to scale worldwide.

  • Before, hacktivism was mostly focused on a few individuals carrying small-scale DDoS and defacement attacks
  • Now, hacktivism is better organized, structured, and sophisticated
  • CPR believes the new model of hacktivism began in conflict areas in the Middle East and Eastern Europe and proliferated to other areas during 2022

Check Point Research outlines a new model of hacktivism now trending worldwide. The hacktivism of the new model is better organized, structured and sophisticated, compared to the past. Hacktivist groups no longer consist of a few random individuals who carry out small DDoS or defacement attacks on low-tier websites. These are coordinated organizations with distinct characteristics previously unseen.

Key Characteristics:

  • Consistent political ideology (manifestos and/or sets of rules)
  • Hierarchy of leadership (Smaller groups relay attack orders to “commanders)
  • Formal recruitment process (Based on minimum requirements)
  • Tools that the groups provide to their members (Advanced tools for notoriety)
  • Robust public relations functions (Presences on major websites)

Why now?
CPR suspects the shift in the hacktivism model began roughly two years ago, with several hacktivist groups like Hackers of Savior, Black Shadow, and Moses Staff that focused exclusively on attacking Israel. CPR believes the Russian-Ukrainian war has proliferated the new model of hacktivism significantly. For example, The IT Army of Ukraine was publicly mobilized by the Ukrainian government to attack Russia. The new hacktivism also saw groups that supported the Russian geopolitical narrative, with groups like Killnet, Xaknet, From Russia with Love (FRwL), NoName057(16), and more.


Case Study: Killnet, from East to West
In April of this year, the group completely shifted its focus to support Russian geopolitical interests all over the world. The group claimed to have executed more than 550 attacks, between late February and September. Only 45 of them were against Ukraine, less than 10% of the total number of attacks.

  1. March: the group executed a DDoS attack on Bradley International Airport in Connecticut (US)
  2. April: websites belonging to the Romanian Government, such as the Ministry of Defense, Border Police, National Railway Transport Company and a commercial bank, were rendered unreachable for several hours.
  3. May: massive DDOS attacks were executed against two major EU countries, Germany and Italy
  4. June: Two very significant waves of attacks were executed against Lithuania and Norway in response to severe geopolitical developments between those countries and Russia
  5. July: Killnet focused their efforts on Poland and caused several government websites to be unavailable.
  6. August: Cyber-attacks were deployed on Latvia, Estonia and USA institutions
  7. September: the group targeted Asia for the first time and focused its efforts on Japan, due to Japan’s support for Ukraine

Sergey Shykevich, Threat Intelligence Group Manager at Check Point Software, said, “Hacktivism now has a whole new meaning. Before, the term meant a few random folks launching small DDoS attacks. Hacktivism is no longer just about social groups with fluid agendas. Now, hacktivism is better organized, structured and more sophisticated. I believe everything changed within the past year, especially with the start of the Ukraine-Russia war.”

“There are some key characteristics that mark the new model of hacktivism, including a consistent political ideology, a clear hierarchy of leadership, formal recruiting processes, sophisticated tool set, and robust PR capabilities. Though the change began in specific conflict-related geographical regions, it has now spread west and even further. Major corporations and governments in Europe and the US are being heavily targeted by this emerging type of hacktivism. All this allows the new hacktivism groups to be mobilized to governmental narratives and achieve strategic and broad-based goals with higher success levels – and much wider public impact – than ever before,” he said.

Continue Reading

Cyber Security

Global Cyber Security Revenue to Reach $334 Billion in 2026: GlobalData

Published

on

Cyber security has emerged as a top priority for organizations and consumers alike, especially following the spread of the COVID-19 pandemic, which led to new ways of living and working with a huge reliance on digital infrastructure that remains vulnerable to cyberattacks. Against this backdrop, the global cyber security revenue is expected to register a compound annual growth rate (CAGR) of 8.7% from $220 billion in 2021 to $334 billion in 2026, forecasts GlobalData, a leading data, and analytics company.

The surge in the volume and sophistication of cyber-attacks across organizations is expected to favor the enterprise cyber security market revenue growth over the forecast period. Madhumita Chaudhary, Practice Head at GlobalData, comments: “Despite the continued investments and growth in the cyber security space, the frequency of attacks and breaches have shown no signs of abatement. More than billions of records containing critical information were compromised since the pandemic. As such, enterprise cyber security will continue to dominate the overall cyber security demand in terms of market share, capturing a sizeable revenue share exceeding 90% in 2021.”

GlobalData’s latest report, “Cyber Security Market Size, Share and Trends Analysis Report by Type (Enterprise, Consumer), Product (Security Consulting, Managed Service Providers, Identity and Access Management), Vertical, Enterprise Size, Region, and Segment Forecasts, 2021-2026,” reveals that the consumer cyber security market too will register a healthy CAGR, exceeding 10% during 2021-2026. Chaudhary explains: “The rapid emergence of connected devices and associated security risks with no baseline security upgrades will favor the segment growth over the forecast period.”

In addition to the rising frequency of attacks, ransomware is also gaining prominence, and has been used in several high-profile attacks. It is the most concerning type of cyberattack for business leaders. Chaudhary continues: “Cyber security should be at the forefront of all digital transformation strategies. A lapse in focus could mean hefty repercussions in form of accelerated ransomware attacks.”

Asia-Pacific (APAC) is more vulnerable to cyber threats owing to the critical infrastructure and growing financial sector in the region. Furthermore, an increase in digital transformation initiatives, penetration of internet connectivity, and susceptibility stemming from IoT connectivity is likely to increase the adoption of cyber security solutions.

Chaudhary concludes: “Emerging countries in the APAC region like India, Singapore, Japan, Australia, the Philippines, Thailand, and Taiwan are facing increasing cyber-crimes in terms of ransomware, phishing, and network attacks, and are projected to witness strong demand for cyber security products & services.”

Continue Reading

Cyber Security

Trellix Study Claims 53% of UAE Cybersecurity Professionals Are Fighting a Losing Battle Against Cybercriminals

Published

on

The majority of UAE-based cybersecurity professionals are feeling overwhelmed by the rapid escalation of cyber threats despite increased commitments from senior management and access to bigger budgets. This was one of the key findings in a global study commissioned by Trellix, the cybersecurity company at the forefront of extended detection and response (XDR).

The study polled 9,000 cybersecurity professionals across 15 countries, including the UAE, in organizations with 500 or more employees. Some 70% of UAE respondents said their organization’s cybersecurity investments had increased in the past 12 months and two-thirds (67%) reported regular meetings on cybersecurity and compliance with senior executives. But most (56%) also admitted that threats evolve so rapidly they still struggle to keep up.

There was widespread acknowledgment among UAE respondents of the need for change. Some 57% said their current security model needed to be updated to successfully predict, detect, and respond to attacks as they happened. Among those expressing such concerns, 13% described the necessary updates as “major”.

Amid these capability gaps, 53% of UAE cybersecurity specialists say they are “fighting a losing battle against cybercriminals”. Beyond taking a toll on the cybersecurity professionals — 54% of respondents cited being held back by the limitations of their cybersecurity infrastructure as one of their biggest work frustrations — this gap in cybersecurity is impacting UAE organizations’ bottom lines, with 80% of respondents acknowledging that their organization lost up to 10% of revenue in the previous year because of security breaches.

According to the findings, 60% of UAE SecOps teams are hampered by the patchwork of security solutions that have few, if any, integration options. Only one in nine (11%) have managed to eliminate silos and little more than a fifth (22%) are working towards this end. Some 59% are working with more than 10 separate security solutions and 60% decried the lack of efficiency this causes. To make matters worse, one-third (67%) of organizations have no plans to rid themselves of silos.

“Siloed security systems hand easy victories to threat actors and make life harder for SecOps teams everywhere,” said Vibin Shaju, General Manager, UAE at Trellix. “And yet many businesses seem prepared to accept siloed security rather than updating their security architecture to connect the dots and enable adaptive security. Nothing changes if nothing changes. Organizations that do not move purposefully towards a more integrated security model are painting a target on their back as an open invitation to cybercriminals.”

In the UAE, 69% of cybersecurity professionals reported dealing with up to 50 cybersecurity incidents per day and 42% characterize their daily routine as being “inundated by a never-ending stream of cyberattacks”. Respondents are plagued by blind spots within their infrastructure, with 27% citing such visibility gaps. Moreover, just over a third (36%) say their security ecosystem does meet their current needs but expressed concerns about their future capabilities if they continue to use the same security suite.

Against this backdrop, one technology that has come to the fore is Extended Detection & Response (XDR). In particular, an open, cloud-native XDR architecture that constantly learns from and adapts to the ever-changing threat landscape, can help organizations eliminate silos and identify threats before they can do harm. More than a fifth (22%) of UAE respondents said they had already implemented XDR, with an additional 41% saying they were exploring the technology for likely implementation in the next 12 to 18 months.

Among XDR implementors in the UAE, 78% ranked the ability to automate processes and prioritize critical concerns among the most important benefits of the technology. Not only was this the top priority for UAE organizations, but the proportion of respondents that cited it was significantly higher than the global average, suggesting that automation and alert triage are of specific interest to UAE enterprises — an understandable finding given the region’s extant cybersecurity skills gaps.

Among other important factors that compelled UAE companies to implement XDR was its capability to detect threats in real-time (76%), and the ability to deliver operational efficiency by freeing human analysts to pursue higher-value cyber work (37%). A quarter of UAE XDR implementors were drawn to the technology by its capability to learn from incidents and adapt to threats; and 38% were impressed by the reduction in response times. Some 46% said that because of the benefits they had witnessed, they were likely to recommend that their organization allocate budgets this year to advanced programs that include XDR.

“This research reveals how unsustainable the situation is for cybersecurity professionals today,” said Aparna Rayasam, chief product officer, Trellix. “Instead of relying on traditional siloed solutions that add complexity, businesses can reshape SecOps with a flexible, intelligent security architecture that consolidates security tools, so teams can work smarter and quickly remediate threats.”

Continue Reading
Advertisement

Follow Us

Trending

Copyright © 2021 Security Review Magazine. Rysha Media LLC. All Rights Reserved.