Thursday, September 23 2021

A report on critical infrastructure in the UK reveals a disparity between perceived threats to critical infrastructure security and the reality of cyber risks.

Bridewell Consulting engaged market research firm Censuswide to survey 250 security leaders across critical infrastructure sectors, referred to in the UK as critical national infrastructure. The survey examined the aviation, chemicals, energy, transport and water sectors.

The study sheds light on the widespread use of older systems lacking security support, which allow attackers to access and manipulate operational technology systems. The majority of organizations surveyed said they rely on aging systems; 79% of the organizations reported systems that were over five years old, and 34% over ten years old.

The survey results point to environments that are often reliant on Internet-connected technologies in critical industrial operations, with 84% of the environments reported as accessible from corporate networks and 58% accessible from the Internet. The report emphasizes that defined layers of network segregation are critical in minimizing an attacker’s movement within a network.

The participating organizations demonstrated a willingness to take advantage of cloud advantages such as reductions in operational expenses, greater scalability, and potentially improved physical resilience; 98% of the organizations surveyed have either migrated elements of their operational technology environments to the cloud or are planning to do so. Misconfigured cloud systems are among the largest attack vectors, as a study of third-party cloud services recently demonstrated.

In addition to the risks posed by an aging yet increasingly connected infrastructure and the potential for human error, decision-makers have also identified these threats to be among the most dangerous to their critical infrastructure organization: cyber attacks (39%), malware (34%), and physical security risks (28%).

Only 20% of respondents selected attacks from nation-states as a major risk, and only 18% chose threats from third-party suppliers, which could indicate some complacency around supply chain risks despite recognition by the National Cyber Security Centre as an area of vulnerability.

The researchers urge decision-makers to qualify and quantify all supply chain risks and threats before undertaking adaptive risk management procedures, as the consequences of successful cyberattacks can include financial penalties, downtime, dismissal of employees, reputational damage, and loss of revenue.

Previous

Supreme Court Limits Scope of Federal Anti-Hacking Law

Next

Cybersecurity M&A and Funding Update: June 11

Check Also

Widget

Don’t Miss

Cyber Deal Update: Upstream Security, Hunters, build.security

Khushi Arora

Upstream Security and Hunters complete Series C and Series A funding rounds, respectively. Elastic NV acquires build.security. Funding Upstream Security, an Israeli provider of automotive cybersecurity and a data analytics platform for connected vehicles, has closed a $62 million Series C funding round led by Mitsui Sumitomo Insurance, along with new investors I.D.I. Insurance, NextGen […]

Cyber Deal Update: Loop Secure, Intelligent Automation, Blumira

Khushi Arora

Tesserent acquires Loop Secure to complement its own services, and BlueHalo merges with Intelligent Automation. Blumira completes a Series A funding round. Mergers and Acquisitions Tesserent, an Australian network security company, has announced its intent to acquire Loop Secure, a provider of managed security services, governance risk and compliance, and offensive security services also based […]

Cyber Deal Update: FHIRBlocks, InfoSum

Khushi Arora

Healthcare cybersecurity company ConsenSys Health acquires FHIRBlocks. InfoSum and Monte Carlo close a Series B and Series C funding round, respectively. Mergers and Acquisitions Otava, a Michigan-headquartered cloud solutions provider, has announced its acquisition of NewCloud Networks, a Colorado-based cloud computing services provider. The acquisition provides Otava a product portfolio that includes security services, cloud […]

Cyber Deal Update: Carve Systems, Baffle, Certik

Khushi Arora

iVision acquires Carve Systems, Baffle closes a Series B funding round, and CertiK closes adds to its Series B funding round announced last month. Mergers and Acquisitions iVision, a Georgia-based provider of IT infrastructure and application solutions, has acquired Carve Systems, a New York-based cybersecurity company that provides security testing, security engineering, and security strategy […]

Cyber Executive Moves: Aegon Asset Management, Tego Cyber

Khushi Arora

Aegon Asset Management hires former COO of MN and Tego Cyber gains a new CISO. Aegon Asset Management, based in The Netherlands, has appointed Nicole Grootveld-Sandig as its chief technology officer. Grootveld-Sandig joins Aegon from the Dutch specialist pensions management company MN NV. Tego Cyber, a Nevada-based developer of cyber threat intelligence solutions, has hired […]

Cyber Deal Update: Appriss Insights, Espagon

Khushi Arora

Equifast acquires data analytics company Appriss Insights, while Cisco acquires observability provider Espagon. Mergers and Acquisitions Equifax, an Atlanta-based global data, analytics and technology company, has announced its acquisition of Appriss Insights, a Kentucky-based information technology company providing customized solutions to enhance security and financial processes for businesses, for $1.825 billion. “We are extending the […]