Successful cyber attacks against critical infrastructure have been steadily increasing in frequency and complexity over the last ten years. In our 2015 “Cyber Security of Critical Infrastructures in Americas” report, more than 575 public and private owner operators from 20 countries were surveyed, and the results were beyond eye-opening. Fifty-three percent said critical infrastructure (CI) cyber attacks have increased over the previous year, and 76 percent claimed they had grown in sophistication. Even more telling was that 44 percent said they were victims of malicious “delete and destroy” attacks.
CI cyber attacks reached a significant milestone in 2015 with the December 23 outage at two of Ukraine’s top energy distributors where destructive malware was used in a broader more sophisticated attack. Through this attack, 80,000 customers lost power for six hours, cutting at least seven 110 kV and 23 35 kV substations.
Stateside, the Dallas Area Rapid Transit’s (DART) computer system was recently hacked, compromising the availability of critical travel information. The mass transit organization has reported no sensitive customer or employee information has been breached; however, the possibility of this information being breached in a future, similar incident is likely. While the attack isn’t catastrophic, it is extensive and highly sophisticated, and serves as another example of cybercriminals targeting critical infrastructure systems.
Today, chief information security officers (CISOs) are unprepared for the increasing convergence of once-isolated industrial control systems (ICS) and corporate networks. According to a 2015 SANS report, “The State of Security of Control Systems Today,” less than half of critical infrastructure CISOs surveyed actually have a strategy for IT-ICS convergence.
Business operations, now more than ever, demand real-time metrics for billing, as well as remote access for support that requires ICS networks to connect to external corporate networks and the Internet. A two-year study completed in 2014, Project SHINE (SHodan INtelligence Extraction) surveyed 2.2 million Internet-facing assets and documented 586,997 ICS devices, 13,475 HVAC (Heating, Ventilation, Air Conditioning) and building automation systems.
Vulnerable and insecure corporate networks that connect to ICS domains open themselves to destructive cyber attacks. Threat actors are able to exploit interdependent and complex networks to island hop from one insecure corporate asset to another before landing on the most vulnerable ICS assets and databases.
Interdependent and complex systems are the enemy of all risk managers. Only by reducing both can you more effectively manage risk and ensure resiliency. The menacing threat of cyber and destructive attacks in today’s rapidly evolving cyber threat landscape requires a comprehensive fortitude across corporate and ICS networks. Resiliency depends on the ability to timely identify threats and vulnerabilities; protect corporate and ICS infrastructure; quickly detect targeted attacks; and swiftly respond to contain damage and recover/restore operations.
Critical infrastructure CISOs have to maintain and routinely test comprehensive business continuity plans and procedures. The following are industry best practices when dealing with destructive attacks:
|
|
To learn more on the state of critical infrastructure in the Americas, visit: http://www.trendmicro.com/us/security-intelligence/research-and-analysis/critical-infrastructures-security.
