Thursday, October 6 2022

A report on critical infrastructure in the UK reveals a disparity between perceived threats to critical infrastructure security and the reality of cyber risks.

Bridewell Consulting engaged market research firm Censuswide to survey 250 security leaders across critical infrastructure sectors, referred to in the UK as critical national infrastructure. The survey examined the aviation, chemicals, energy, transport and water sectors.

The study sheds light on the widespread use of older systems lacking security support, which allow attackers to access and manipulate operational technology systems. The majority of organizations surveyed said they rely on aging systems; 79% of the organizations reported systems that were over five years old, and 34% over ten years old.

The survey results point to environments that are often reliant on Internet-connected technologies in critical industrial operations, with 84% of the environments reported as accessible from corporate networks and 58% accessible from the Internet. The report emphasizes that defined layers of network segregation are critical in minimizing an attacker’s movement within a network.

The participating organizations demonstrated a willingness to take advantage of cloud advantages such as reductions in operational expenses, greater scalability, and potentially improved physical resilience; 98% of the organizations surveyed have either migrated elements of their operational technology environments to the cloud or are planning to do so. Misconfigured cloud systems are among the largest attack vectors, as a study of third-party cloud services recently demonstrated.

In addition to the risks posed by an aging yet increasingly connected infrastructure and the potential for human error, decision-makers have also identified these threats to be among the most dangerous to their critical infrastructure organization: cyber attacks (39%), malware (34%), and physical security risks (28%).

Only 20% of respondents selected attacks from nation-states as a major risk, and only 18% chose threats from third-party suppliers, which could indicate some complacency around supply chain risks despite recognition by the National Cyber Security Centre as an area of vulnerability.

The researchers urge decision-makers to qualify and quantify all supply chain risks and threats before undertaking adaptive risk management procedures, as the consequences of successful cyberattacks can include financial penalties, downtime, dismissal of employees, reputational damage, and loss of revenue.

Previous

Supreme Court Limits Scope of Federal Anti-Hacking Law

Next

Cybersecurity M&A and Funding Update: June 11

Check Also

Widget

Don’t Miss

Cyber Deals: Spin Technology, CyberArk, Mesh Security

James Hu

Cybersecurity Venture Funding and Mergers: This week’s deals involved cloud security services, data privacy, and industrial cybersecurity companies. Funding Cloud cybersecurity firm Mesh Security has secured $4.5 million in venture funding. The round was led by Booster Ventures with participation from other investors. Spin Technology, a firm providing SaaS security solutions, raised $16 million in […]

Cyber Deals: Cybrary, Ping Identity, Axio Global

James Hu

Cybersecurity Venture Funding and Mergers: Key investments were made in cybersecurity training, secure enterprise browser, and risk management companies. M&A activity this week involved identity security, zero trust, and threat intelligence firms. Funding Cybrary, a cybersecurity training platform, raised $25 million in a Series C funding round. The round was led by BuildGroup and Gula […]

Cybrary Secures $25 Million in Series C Funding Round

James Hu

Cybrary, a Maryland-based cybersecurity training platform provider, raised $25 million in a Series C funding round. The round was led by BuildGroup and Gula Tech Adventures, two of its current investors. Following its $15 million Series B round announced in November 2019, this latest investment brings Cybrary’s total funding to date to $48 million. Cybrary […]

Cyber Deals: Exterro, Naoris Protocol, Cybit Sec

James Hu

Cybersecurity Venture Funding and Mergers: This week, notable funding and M&A activity involved compliance, enterprise security, and vulnerability assessment firms. Funding Exterro, a legal governance, risk, and compliance software provider, completed a strategic recapitalization valuing the firm at over $1 billion. The company, currently owned by Leeds Equity Partners, is targeting a potential 2023 initial […]

Cyber Deals: Halborn, Irideos, Anvilogic

James Hu

Cybersecurity Venture Funding and Mergers: This week, cybersecurity venture funding and M&A activity involved blockchain, artificial Intelligence, and SaaS solution providers. Many of these deals will also be funding the future of cloud security. Funding Halborn, a blockchain cybersecurity firm, raised $90 million in a Series A funding round led by Summit Partners with participation […]

Huntress acquires Curricula for $22 million

James Hu

Huntress, a cybersecurity firm providing a security management platform to small and medium sized businesses, has acquired Curricula, a security awareness training service provider, for $22 million. Curricula is a freemium SaaS company offering solutions for employee cybersecurity training. Their methods incorporate behavioral learning techniques and engaging storytelling to maximize employee engagement. Small and medium […]