Nozomi Networks-Sponsored SANS Survey Finds Security Defences Are Getting Stronger

Nozomi Networks Inc., the leader in operational technology (OT) and IoT security, today announced the SANS 2022 OT/ICS Cybersecurity Report finds industrial control systems (ICS) cybersecurity threats remain high as adversaries set their sights on control system components. In response, organisations have significantly matured their security postures since last year. In spite of the progress, more than a third (35%) don’t know whether their organisations had been compromised and attacks on engineering workstations doubled in the last 12 months.

“In the last year, Nozomi Networks researchers and the ICS cybersecurity community have witnessed attacks like Incontroller move beyond traditional targets on enterprise networks, to directly targeting OT,” said Nozomi Networks Co-founder and CPO Andrea Carcano. “While threat actors are honing their ICS skills, the specialised technologies and frameworks for a solid defence are available. The survey found that more organisations are proactively using them. Still, there’s work to be done. We encourage others to take steps now to minimise risk and maximise resilience.”

ICS Cybersecurity Risks Remain High

• 62% of respondents rated the risk to their OT environment as high or severe (down slightly from 69.8% in 2021).
• Ransomware and financially motivated cybercrimes topped the list of threat vectors (39.7%) followed by nation-state sponsored attacks (38.8%). Non-ransomware criminal attacks came in third (cited by 32.1%), followed closely by hardware/software supply chain risks (30.4%).
• While the number of respondents who said they had experienced a breach in the last 12 months dropped to 10.5% (down from 15% in 2021), 35% of those said the engineering workstation was an initial infection vector (doubling from 18.4% last year).
• 35% did not know whether their organisations had been compromised (down from 48%) and 24% were confident that they hadn’t had an incident, a 2x improvement over the previous year.
• In general, IT compromises remain the dominant access vector (41%) followed by replication through removable media (37%).

ICS Cybersecurity Postures are Maturing

• 66% say their control system security budget increased over the past two years (up from 47% last year).
• 56% say they are now detecting compromises within the first 24 hours of an incident (up from 51% in 2021). The majority (69%) say they move from detection to containment within 6 to 24 hours.
• 87.5% have conducted a security audit of their OT/control systems or networks in the past year (up from 75.9% last year) – one-third (29%) have now implemented a continual assessment program.
• The overwhelming majority (83%) monitor their OT system security. Of those, 41% used a dedicated OT SOC
• Organisations are investing in ICS training and certification: 83% of respondents are professional control system certification holders – a significant jump from 54% in the last 12 months.
• Nearly 80% have roles that emphasise ICS operations up from 50% in 2021.

###

To learn more about the latest trends in OT/ICS cybersecurity:

• Download: The State of OT/ICS Cybersecurity in 2022 and Beyond

About Nozomi Networks
Nozomi Networks is accelerating the pace of digital transformation by pioneering innovation for industrial cyber security and operational control. Leading the industry, we make it possible to tackle escalating cyber risks to operational networks. In a single solution, Nozomi Networks delivers OT visibility, threat detection and insight to thousands of the largest critical infrastructure, energy, manufacturing, mining, transportation and other industrial sites around the world. www.nozominetworks.com

About SANS Institute

The SANS Institute was established in 1989 as a cooperative research and education organisation. SANS is the most trusted and, by far, the largest provider of training and certification to professionals at governments and commercial institutions world-wide. Renowned SANS instructors teach over 50 different courses at more than 200 live cyber security training events as well as online. GIAC, an affiliate of the SANS Institute, validates employee qualifications via 30 hands-on, technical certifications in information security. The SANS Technology Institute, a regionally accredited independent subsidiary, offers master's degrees in cyber security. SANS offers a myriad of free resources to the InfoSec community including consensus projects, research reports, and newsletters; it also operates the Internet's early warning system--the Internet Storm Centre. At the heart of SANS are the many security practitioners, representing varied global organisations from corporations to universities, working together to help the entire information security community. (www.SANS.org)

© Scoop Media