Digital attackers are targeting organizations in the energy sector like never before. For example, just a few weeks ago, the FBI and Department of Homeland Security issued a joint report describing a massive Russian hacking campaign to infiltrate America’s critical infrastructure. In a first, the US government publicly blamed Russia’s government for attacks on energy infrastructure.

News like this and recent threats like Triton and Industroyer beg two questions: how concerned are energy security professionals concerned about digital threats, and what do they think will happen at their organization if a digital attack is successful?

To find out, Tripwire commissioned Dimensional Research to examine the security of industrial control systems (ICS) in the energy industry. It did so by surveying 151 IT and operational technology (OT) security professionals at energy and oil and gas companies in March 2018.

A majority of respondents to Tripwire’s study said they were concerned about the potential impacts a digital attack might have on their organization. Close to all participants said they feared operational shutdowns and threats to their employees’ safety at 97 percent and 96 percent, respectively. Additionally, 70 percent of these security professionals feared more dire consequences like an explosion and other “catastrophic failures.”

Tim Erlin, vice president of product management and strategy at Tripwire, says these concerns reflect the types of threats confronting organizations in energy and other critical infrastructure:

Energy companies have accepted the reality that digital threats can have tangible consequences. This perception is perhaps heightened by recent attacks that were specifically designed to affect physical operations and have proven capable of doing so.

In December 2017, FireEye disclosed its discovery of TRITON, an attack framework which is capable of shutting down plant operations as well as producing more serious outcomes. Just six months before that, ESET shed light on Win32/Industroyer, modular malware which can take down ICS systems by speaking to industrial communication protocols and deploying wiper malware.

In the survey, 59 percent said their companies increased security investments because of ICS-targeted attacks like Trisis/Triton, Industroyer/CrashOverride and Stuxnet. However, many feel they still don’t have the proper level of investment to meet ICS security goals.

More than half (56 percent) of respondents to Tripwire’s survey felt it would take a significant attack to get their companies to invest in security properly. This may be why just 35 percent of participants are taking a multilayered approach to ICS security – widely recognized as a best practice. Thirty-four percent said they were focusing primarily on network security and 14 percent on ICS device security.

Erlin is troubled by these findings:

It’s concerning that more than half would wait for an attack to happen before investing properly given what’s at stake with critical infrastructure. The energy industry should invest in establishing more robust cybersecurity strategies with a proper foundation of critical security controls and layers of defense.

via:  tripwire