Most Industrial Cyber Incidents Down To Human Error – Kaspersky

Cyber security incidents in industrial systems are mostly down to employee error, Kaspersky has warned in a new report.

The report, “State of Industrial Cybersecurity 2019”, found that employee errors or unintentional actions were behind 52% of incidents affecting operational technology and industrial control system (OT/ICS) networks in 2018.

Last month a number of large blue chip industrial firms in Germany confirmed they have been subjected to cyber-attack. BASF and Henkel are chemical giants, Siemens makes power generating kit among other things, and Roche is a drug company.

Industrial cyber incidents

Part of the problem for industrial entities is the shortage of professionals to handle modern cyber risks, coupled with low awareness among employees.

The problem is getting worse as more industrial groups change from manual processes to computer systems, some of which can be highly complex.

In March for example large Norwegian manufacturing firm Norsk Hydro admitted it had lost more than $40m, in the week following a devastating ransomware attack.

The Kaspersky report confirmed that industrial groups are increasingly recognising the importance of securing their systems, with 87 percent of respondents agreeing that cybersecurity is becoming a top priority for industrial companies.

Fine sentiment, but the Kaspersky study also found that only just over half of companies (57 percent) have the allocated budget for industrial cybersecurity.

Matters are not helped by a shortage of skilled staff.

“Organisations are not only experiencing a lack of cybersecurity experts with the right skills to manage protection for industrial networks, but are worried that their OT/ICS network operators are not fully aware of the behaviour that can cause cybersecurity breaches,” the security experts said.

“These challenges make up the top two major concerns relating to cybersecurity management and go some way to explaining why employee errors cause half of all ICS incidents – such as malware infections – and also more serious targeted attacks,” it added.

Kaspersky said that in almost half of companies (45 percent), the employees responsible for IT infrastructure security also oversee the security of OT/ ICS networks. It said this approach may carry security risks: although operational and corporate networks are becoming increasingly connected, specialists on each side can have different approaches (37 percent) and goals (18 percent) when it comes to cybersecurity.

“This year’s study shows that companies are seeking to improve protection for industrial networks,” said Georgy Shebuldaev, brand manager at Kaspersky Industrial Cybersecurity.

“However, this can only be achieved if they address the risks related to the lack of qualified staff and employee errors,” Shebuldaev added. “Taking a comprehensive, multi-layered approach – which combines technical protection with regular training of IT security specialists and industrial network operators – will ensure networks remain protected from threats and skills stay up to date.”

IoT protection

Kaspersky also warns organisations to consider specific protection for Industrial IoT which can become highly connected externally.

In April this year security officials at the German multinational pharmaceutical and life sciences giant Bayer AG reported that they detected and then contained a cyber attack.

The hackers using the Winnti malware, had apparently gained access to Bayer’s network in early 2018 by using malware to spy on the company.

But security teams at Bayer reportedly detected the intrusion and covertly monitored it for over a year.

Do you know all about security? Try our quiz!