Latin America has one of world’s fastest growing Internet populations. While this is bringing great social and economic benefits to the region, it has also heralded a more unwelcome trend: cyberattacks. The critical national infrastructure (CNI) industry is particularly vulnerable here, with IT managers historically relying too much on “security by obscurity” to keep legacy systems safe. But before we can craft a response, we need to know the scale of the problem and how prepared the region is to defend itself.
That’s why the Organization of American States has teamed up with Trend Micro to produce its Report on Cybersecurity and Critical Infrastructure in the Americas. With it, we hope to gain greater understanding of the threats facing critical infrastructure organizations in the region, in order to mount a more effective fightback.
A tempting target
It’s no surprise that cyber attackers are focusing in on Latin American countries. The trend was documented in our joint report with the OAS in 2013. But as Trend Micro has explained in the past, CNI is particularly vulnerable because of under-investment in security and the increasing volume of at-risk systems now connected to the internet. This isn’t just energy and water companies we’re talking about either, but everything from banks to hospitals, telcos and even food producers. As such, cyber attacks have the potential to wreak huge financial and reputational damage on CNI providers, but in so doing can cause serious economic and social harm to the affected country.
As most critical infrastructure are run by private firms, government-private partnerships on things like information sharing an incident detection are vital to successful cyber security strategies. Governments need to get better at talking to each other too, in order to share best practice. This is especially important given the relative immaturity of the information security industry in this region and the limited budgets available.
The hard facts
The new report canvassed the opinion of heads of security working in critical infrastructure sectors all over the Americas. It found over half (53%) said CNI attacks had increased since the previous year, while 76% said they had gotten more sophisticated. Government (51%) and Energy (47%) were the most targeted sectors followed by Communications (44%) and Finance (42%).
The majority of Latin American countries including Argentina, Brazil, Chile, Mexico and Peru said attacks had specifically targeted industrial ICS/SCADA equipment. These attacks will only increase as organizations get better at detecting them and more and more systems are connected to the internet – increasing their risk exposure. More worrying still, only one country in Latin America, Chile, said it felt fully prepared for a cyber incident, and just three said budgets had definitely increased over the past year.
Reducing SCADA risk
Organizations in Latin America are being targeted with the same array of worms, Trojans, browser exploits, hacking tools and more as their counterparts in other regions. But unpatched systems, poor removable device security and reckless user behavior are making the bad guys’ job even easier.
Not every critical infrastructure attack will be aimed at ICS/SCADA systems. In fact, information stealing (60%) was experienced by more respondents than control system attacks (54%). However, industrial control systems are particularly vulnerable.
With that in mind, here’s a brief security check list for CNI firms running ICS/SCADA:
|
|
For more information, please visit our website here.
