SCADA/ICS Dangers & Cybersecurity Strategies
Nearly 60% of surveyed organizations using SCADA or ICS reported they experienced a breach in those systems in the last year. Here are four tips for making these systems safer.
A large number of government agencies and private organizations have SCADA (supervisory control and data acquisition) or industrial control systems (ICS). The benefits of these technologies come with significant security challenges. In a recent survey by Forrester commissioned by Fortinet, nearly six in 10 surveyed organizations using SCADA or ICS indicate that they experienced a breach in those systems in the past year.
Part of the challenge is that these systems are being used to manage not only their traditional OT (operational technology) infrastructures but also a host of new Industrial Internet of Things (IIoT) devices. What’s more, many of those organizations are adding to their risk by providing new technologies and partners with a high level of access into their systems. In addition, most organizations now report developing connections between their traditional IT systems and their SCADA/ICS, introducing the potential for outside hackers to penetrate into these control systems.
Rapid Adoption, Access, and Security
Though SCADA/ICS systems were once primarily used by electric and water utilities, many organizations in recent years have begun using these technologies to automate data collection and related equipment. Transparency Market Research predicts the global ICS market alone will grow from $58 billion in 2014 to $81 billion in 2021. Industrial control systems, for example, have become widely used in manufacturing, at seaports, in water treatment plans, in oil pipelines, in energy companies, and in building environmental control systems. At the same time, SCADA systems, which serve as the graphical user interface into ICS, are growing at an annual growth rate of 6.6%.
Consequently, SCADA/ICS technologies and related IIoT devices have become high-value targets for hackers looking to disrupt business operations, collect ransom, or compromise a rival nation’s critical infrastructure. Per the Forrester study, while a staggering 56% of organizations using SCADA/ICS reported a breach in the past year, even more astonishing is that only 11% indicate that they have never been breached.
Easy access to SCADA/ICS by third parties is a major part of the problem. Many organizations place a lot of trust in the security of their technology vendors and other outside organizations by giving them wide access to their internal systems. More than six in 10 organizations surveyed by Forrester give either complete or high-level access to partner or government organizations. Thus, SCADA/ICS operators face serious risks, many of their own design.
Threats and Breaches
The Forrester survey asked organizations operating SCADA/ICS about their most serious security threats. More than three-quarters of organizations acknowledge being very or extremely concerned about outside malware. Seven in 10 are very or extremely concerned about internal hackers, the leakage of sensitive data and external hackers.
Not only are SCADA/ICS breaches common, but they also have serious repercussions. Unlike traditional IT networks, OT networks often manage and control systems where a compromise can have potentially devastating consequences. A compromised IoT device that monitors inventory represents a very different threat than an IIoT device monitoring or managing a temperature control system on a 50,000-gallon boiler at a chemical plant.
As a result, 63% of organizations say the safety of their employees was highly or critically affected by a SCADA/ICS security breach. Another 58% report major impacts to their organization’s financial stability, and 63% note a serious drag on their ability to operate at a sufficient level.
Peter Newton is the Senior Director of Product Marketing for Fortinet.
More | darkreading