The recently published SANS 2021 OT/ICS Cybersecurity Report, sponsored by Nozomi Networks Inc., finds ICS cybersecurity threats remain high and are growing in severity. In response, a growing majority of organizations have significantly matured their security postures since the last SANS OT/ICS survey in 2019. In spite of the progress, almost half (48%) don't know whether their organizations had been compromised. The survey echoes Nozomi Networks' own experiences with customers worldwide.

"It's concerning to see that nearly half of this year's survey respondents don't know if they've been attacked when visibility and detection solutions are readily available to provide that awareness," said Nozomi Networks Co-founder and CPO Andrea Carcano. "Threats may be increasing in severity, but new technologies and frameworks for defeating them are available and the survey found that more organizations are proactively using them. Still, there's work to be done. We encourage others to adopt a post-breach mindset pre-breach and strengthen their security and operational resiliency before an attack."

ICS Cybersecurity Risks are Rising in Number and Severity

Cyber threats to OT environments continue to rise and threat severity is at an all-time high.

• Most respondents (69.8%) rated the risk to their OT environment as high or severe (up from 51.2% in 2019).
• Ransomware and financially motivated cybercrimes topped the list of threat vectors (54.2%) followed by nation-state sponsored cyberattacks (43.1%). Unprotected devices and things added to the network came in third (cited by 31.3% of survey respondents).
• Of the 15% of survey respondents who indicated they had experienced a breach in the last 12 months, a concerning 18.4% said the engineering workstation was an initial infection vector.
• Nearly half of all respondents (48%) did not know whether their organizations had been compromised and only 12% were confident that they hadn't had an incident.
• In general, external connections are the dominant access vector (49%) with remote access services identified as the most prevalent reported initial access vector for incidents (36.7%).

ICS Cybersecurity Postures and Technologies have Matured and are Evolving

This year's survey found most organizations are taking ICS threats seriously and making solid progress in maturing their security postures to address them. Over the last two years organizations have improved monitoring and threat intelligence capabilities. They are moving away from traditional indicator-based defense capabilities and moving toward threat hunting and hypothesis-based security models. They're also focusing on data loss prevention.

• 47% say their control system security budget increased over the past two years.
• Almost 70% have a monitoring program in place for OT security.
• 51% say they are now detecting compromises within the first 24 hours of an incident. The majority say they move from detection to containment within 6 to 24 hours.
• 75.9% have conducted a security audit of their OT/control systems or networks in the past year and almost a third (29.5%) have now implemented a continual assessment program.
• 50% say they have vendor-provided ICS-specific threat intelligence feeds and there is less reliance (36%) on IT threat intelligence providers.
• OT SOC adoption is up by a sharp 11% from 2019 to 2021, re-emphasizing the focus away from traditional indicator-based defense capabilities and more toward a threat hunting and hypothesis-based security model.
• Data loss prevention technologies also saw a sharp increase in deployment (11%).
• As process reliability becomes a top concern, 34% say they're implementing zero-trust principles and an additional 31% say they plan to.

ICS is Getting Cloudy

Adoption of cloud-native technologies and services transformed the IT industry. This year's survey found similar impacts are also beginning to be felt in the OT environment.

• 40.1% of all survey respondents indicate they are using some cloud-based services for OT/ICS systems.
• Almost all (91%) are using cloud technologies to directly support ICS operations (combining remote monitoring configuration and analysis; cloud services supporting OT; and remote control/logic).
• All respondents using cloud technologies are using cloud services for at least one type of cybersecurity function (company NOC/SOC, business continuity and MSSP support).
• Respondents consider cloud assets relatively secure, with only 13% of responses classifying them as risky.

To download "A SANS 2021 Survey: OT/ICS Cybersecurity", click here.

Source: Nozomi Networks Inc.