Risks amplify in the connected world

The cyber threat land­scape has been large­ly shaped by two major events over the last cou­ple of decades. In the wake of the ‘fourth indus­tri­al rev­o­lu­tion,’ dig­i­tal trans­for­ma­tion pushed com­pa­nies to auto­mate and opti­mise their process­es. More recent­ly, the Covid pan­dem­ic not only accel­er­at­ed digi­ti­sa­tion but also forced busi­ness­es to embrace remote work­ing. Staff and third-par­ties now access sites remote­ly. The result of both events is an enlarged attack sur­face which has giv­en bad actors more entry points, increas­ing the fre­quen­cy and impact of attacks.

Despite cyber­crim­i­nals becom­ing more sophis­ti­cat­ed in the tech­nolo­gies they use to attack com­pa­nies, ran­somware large­ly remains the weapon of choice. Some of the biggest crit­i­cal infra­struc­ture shut­downs last year, includ­ing the Colo­nial Pipeline, JBS Foods and Ireland’s Health Ser­vice, were ran­somware attacks, and a study by Claroty found that 80% of crit­i­cal infra­struc­ture organ­i­sa­tions have expe­ri­enced a ran­somware attack in the last year. ​​

Among those com­pa­nies, 47% report­ed an impact to their indus­tri­al con­trol sys­tem (ICS) envi­ron­ment and over 60% paid the ran­som, more than half of which cost $500,000 or more. The major­i­ty of respon­dents esti­mat­ed a loss in rev­enue per hour of down­time to their oper­a­tions equal to or greater than the pay­out. And even among those who did pay the ran­som, 28% still expe­ri­enced sub­stan­tial impact to oper­a­tions for more than a week. It is per­haps unsur­pris­ing that man­u­fac­tur­ing is the most tar­get­ed sec­tor of all, with some 23% of ran­somware attacks on man­u­fac­tur­ing com­pa­nies, accord­ing to IBM.

“Indus­try 4.0 is a major dri­ver of this, and we’ve seen a rapid accel­er­a­tion of the con­nect­ed envi­ron­ment,” says Simon Chas­sar, chief rev­enue offi­cer at indus­tri­al cyber­se­cu­ri­ty firm Claroty. “Ten years ago, there were few­er than a bil­lion devices con­nect­ed. Today, there are almost 15 bil­lion devices, and by 2025 we are talk­ing more like 75 bil­lion devices con­nect­ed.”

“Com­pa­nies are try­ing to be more com­pet­i­tive, so they’re adding more and more smart devices, which gen­er­ate more data to fuel insights, automa­tion and improve effi­cien­cy and pro­duc­tiv­i­ty. The CEO of every com­pa­ny, par­tic­u­lar­ly in man­u­fac­tur­ing and health­care, wants to push their top-line rev­enues and they know dig­i­tal trans­for­ma­tion, adding these con­nect­ed assets, will help them to pro­duce more and reduce costs. But this is also cre­at­ing huge risks.”

Cyber-phys­i­cal sys­tems are espe­cial­ly at risk – the con­nect­ed devices that con­trol the pro­duc­tion process in man­u­fac­tur­ing or that keep health­care oper­a­tions run­ning effi­cient­ly. These sys­tems are all inter­con­nect­ed, and if just one major sup­ply goes down as a result of a cyber­at­tack, there can be a vast impact on crit­i­cal pro­duc­tion lines – as well as, in some cas­es, the phys­i­cal safe­ty of pro­duc­tion staff. The risk posed by these attack vec­tors means com­pa­nies need to be selec­tive on how to progress with dig­i­tal trans­for­ma­tion.

Ana­lyst firm Gart­ner iden­ti­fied six steps in the matu­ri­ty of the cus­tomer jour­ney when look­ing at how to secure cyber-phys­i­cal sys­tems, start­ing with aware­ness. Organ­i­sa­tions must under­stand the need to pro­tect not just their IT, but also their cyber-phys­i­cal sys­tems in terms of their oper­a­tional tech­nol­o­gy. Accord­ing to Gart­ner, most organ­i­sa­tions (60%) are in this aware­ness step and have secured a direc­tive from the board to do some­thing about it.

The sec­ond step is vis­i­bil­i­ty, which presents the biggest chal­lenge. Most com­pa­nies have almost no vis­i­bil­i­ty as to what assets are con­nect­ed in the net­work, leav­ing them blind in under­stand­ing what they actu­al­ly have to pro­tect. The third step is assess­ment of the vul­ner­a­bil­i­ties and risks. A fur­ther 30% of organ­i­sa­tions are between these two steps.

“That means 90% of busi­ness­es are caught between aware­ness, vis­i­bil­i­ty and assess­ments. They basi­cal­ly haven’t even start­ed to pro­tect their busi­ness,” says Chas­sar. “They urgent­ly need to be able to progress to the next steps.

Next is fire­fight­ing, pri­ori­tis­ing the risks and start­ing to deploy solu­tions. The fifth step is the actu­al inte­gra­tion with the stock as well as the dif­fer­ent tools in their secu­ri­ty infra­struc­ture. Then the final step is opti­mi­sa­tion.”

Claroty empow­ers organ­i­sa­tions to advance faster and more con­fi­dent­ly through these steps. The company’s uni­fied plat­form, secures cyber-phys­i­cal sys­tems across indus­tri­al, health­care and enter­prise, inte­grat­ing with organ­i­sa­tions’ exist­ing infra­struc­ture to pro­vide a full range of con­trols for vis­i­bil­i­ty, risk and vul­ner­a­bil­i­ty man­age­ment, threat detec­tion and secure remote access.

Through its research and engi­neer­ing teams and thou­sands of sites deployed glob­al­ly, as well as its part­ner ecosys­tem, which includes indus­tri­al giants such as Siemens, Schnei­der Elec­tric and Rock­well, Claroty has the domain exper­tise to help organ­i­sa­tions secure their cyber-phys­i­cal sys­tems. The com­pa­ny focus­es on three major areas in pro­tect­ing busi­ness­es. First, and per­haps most impor­tant­ly, is under­stand­ing their risks, which means get­ting bet­ter vis­i­bil­i­ty.

“That’s num­ber one, because most organ­i­sa­tions don’t under­stand the vul­ner­a­bil­i­ties and the risks asso­ci­at­ed with the assets they have,” says Chas­sar. “Sec­ond is con­trol­ling the access. In our plat­form, we fol­low a holis­tic approach by act­ing like a one-stop-shop, and the con­trol comes from secure remote access. When busi­ness­es changed their oper­a­tions to remote access dur­ing the pan­dem­ic, it pre­sent­ed a lot of new risk, so this is an essen­tial step.

“The third area is to detect and respond to threats. To do this, we have con­tin­u­ous threat detec­tion in real time with alerts and reports, ensur­ing com­pa­nies under­stand if some­thing is going on that needs to be addressed and mit­i­gat­ed. The com­bi­na­tion between our domain exper­tise and holis­tic approach is crit­i­cal for organ­i­sa­tions to be suc­cess­ful.

For more infor­ma­tion, vis­it claroty.com

Q&A: Securing the Extended Internet of Things

The extend­ed inter­net of things (XIoT) is expos­ing busi­ness­es to new cyber threats. Yaniv Var­di, CEO at Claroty, dis­cuss­es the key vul­ner­a­bil­i­ties and how CISOs can bet­ter pre­pare

What do you mean when you refer to the XIoT?
Think about every­thing con­nect­ed with­in the four walls of a man­u­fac­tur­ing site. You’ve got oper­a­tional tech­nol­o­gy (OT), which which con­sists of the actu­al assets that are part of the pro­duc­tion line; the con­trollers and human machine inter­faces (HMIs); the tem­per­a­ture sen­sors and oth­er sen­sors that are part of the pro­duc­tion process. Or in a health­care set­ting, there are the med­ical devices, the clin­i­cal assets, the MRIs and imag­ing devices. But then also think about enter­prise IoT, such as smart print­ers, build­ing man­age­ment sys­tems and humid­i­ty sen­sors. All of it is now con­nect­ed, and you can­not over­look any ele­ment from a secu­ri­ty per­spec­tive.

To what extent is secu­ri­ty designed into XIoT assets in the first place?
Many if not most of the con­nect­ed assets in the XIoT were not designed with secu­ri­ty in mind. These are lega­cy assets. The con­trollers in pro­duc­tion lines are a good exam­ple. They used to be com­plete­ly iso­lat­ed and air gapped, so there was lit­tle rea­son for the man­u­fac­tur­ers pro­duc­ing them to think much about secu­ri­ty. Those lega­cy assets still exist today. And even though new­er assets in man­u­fac­tur­ers’ prod­uct port­fo­lios have been designed with secu­ri­ty in mind, they are con­tin­u­ous­ly oper­a­tional 24 hours a day, 365 days a year. That makes it real­ly hard to patch or upgrade, which is what makes these assets so vul­ner­a­ble to cyber threats.

What are the biggest chal­lenges fac­ing CISOs in the XIoT?
The biggest chal­lenge, if you speak to CISOs and CIOs, is they have no vis­i­bil­i­ty of these assets in the XIoT. Their view of OT and IT envi­ron­ments is very much sep­a­rat­ed. They know every­thing that’s going on in the IT side, but not the OT side. They’ve had decades of expe­ri­ence man­ag­ing IT, but OT is real­ly the dark side for them because assets were not pre­vi­ous­ly con­nect­ed but sud­den­ly now they are – and how can you pro­tect some­thing you can’t see? It’s a big vis­i­bil­i­ty gap, and these assets are typ­i­cal­ly on the same net­work as your crit­i­cal infra­struc­ture and assets. The con­se­quences of an attack on these assets can be dire.

How alert are cyber­crim­i­nals to these vul­ner­a­bil­i­ties?
Attack­ers will always go for the eas­i­est path to get in and they are very much going after the XIoT as we speak, which is why we are see­ing such a huge increase in ran­somware. Cyber­at­tacks on the soft­ware sup­ply chain, mean­while, are chang­ing the mar­ket. The Solar­Winds attack at the end of 2020 rocked the busi­ness world and brought numer­ous chal­lenges in 2021. The Euro­pean Union Agency for Cyber­se­cu­ri­ty expect­ed there to be four times more soft­ware sup­ply chain attacks in 2021 than there were in 2020. How­ev­er these types of attacks are noth­ing new. The attack on depart­ment store chain Tar­get was near­ly a decade ago now. The Not­Petya ran­somware attacks, which result­ed in $10bn of dam­ages, was back in 2017, though we are still see­ing the impact today. And it’s not just Rus­sia attack­ing Ukraine – the impact spreads far beyond that. The soft­ware sup­ply chain is real­ly a very sig­nif­i­cant risk to busi­ness­es, as it spreads so quick­ly through the glob­al mar­kets.

What will sep­a­rate the win­ners from the losers of busi­ness in the XIoT age?
The win­ners in the years ahead will be those who go through the full jour­ney to secure their cyber-phys­i­cal sys­tems. They will gain vis­i­bil­i­ty, under­stand the net­work, con­trol access to that net­work and mon­i­tor it for threats. If you haven’t already, you need to start that jour­ney today. The win­ners will be those that con­nect secu­ri­ty with the busi­ness to cre­ate real busi­ness con­ti­nu­ity, deploy­ing solu­tions with domain exper­tise. The more crit­i­cal and com­plex the envi­ron­ment is, the more spe­cialised the secu­ri­ty tools need to be. You can­not just have a gener­ic tool to do that. It’s like get­ting new doors and win­dows, smart cam­eras and alarm sys­tems, but then leav­ing your win­dow open. That’s exact­ly what you do when you pro­tect IT but not OT assets. If you have hun­dreds of pro­pri­etary pro­to­cols, you can­not sim­ply think that because you already have a secu­ri­ty solu­tion for enter­prise IoT, fire­walls and the like, that it will pro­tect the indus­tri­al net­works in man­u­fac­tur­ing and health­care set­tings. It won’t. Attacks will hap­pen, no doubt, and there is an enor­mous impact on a busi­ness when they do. You have to do it right.

For more infor­ma­tion, vis­it claroty.com

Pro­mot­ed by Claroty