News
7/10/2014
05:15 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
100%
0%

Study: Most Critical Infrastructure Firms Have Been Breached

A new Ponemon Institute study finds 70% of critical infrastructure companies have been hit by security breaches in the last year, but cyber security programs are still a low priority.

Uptime still trumps proactive cyber security measures in most critical infrastructure organizations worldwide, a new Ponemon Institute study shows.

Though 60% of global IT and IT security executives at critical infrastructure organizations say minimizing downtime is a top security objective, just 32% say improving their security posture is a priority. On top of that, 67% say they suffered at least one security breach in the past 12 months that resulted in confidential data loss or disruption to operations. Nearly one-fourth of those attacks were due to insiders or privileged IT users being negligent, the respondents said.

"Security as a priority… that didn't make the top five list," says Larry Ponemon, chairman and founder of the Ponemon Institute. "Availability and uptime" are top priorities.

Preventing and quickly detecting advanced persistent threats (APTs) was a priority for 55% of companies, followed by preventing cyber attacks (44%), compliance (40%), securing the national critical infrastructure (35%), and then, with 32%, improving the organization's security posture.

The perspective of prioritizing availability over improving security is "short-sighted," says Dave Frymier, CISO at Unisys, which commissioned the study. "If you have a cyber security event, it's probably going to affect the availability of your service."

Meanwhile, critical infrastructure firms remain conflicted about patching their software with security or other updates. Fifty-four percent say their organization can't upgrade legacy systems to more secure systems cost-effectively without "sacrificing mission-critical security," the report says.

The full report, "Critical Infrastructure: Security Preparedness and Maturity," is available here for download.

Kelly Jackson Higgins is Senior Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise Magazine, ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
7/11/2014 | 2:16:54 PM
Re: same as it ever was
That's right! Thanks for the reminder, @Marilyn.

Things tend to move kinda slooooowly when it comes to security in the ICS/SCADA critical infrastructure world.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
7/11/2014 | 1:41:40 PM
Re: same as it ever was
Dave Frymier blogged about the lax security around IT infrastructure in airports, utilities, and other critical areas for Dark Readong back in April in 'Baby Teeth' In Infrastructure Cyber Security Framework. Sadly it looks like nothing much has changed. But it's a good read if anyone wants to dive deeper into the subject.   

 

Kelly Jackson Higgins
100%
0%
Kelly Jackson Higgins,
User Rank: Strategist
7/11/2014 | 12:14:55 PM
same as it ever was
No surprise here that operations/uptime trumps shoring up cyber security for ICS/SCADA folks, but Frymier's point that an attack could cause an outage is the bottom line here. And the data indicating that patching is still not common practice is interesting, especially now that more (but not enough) ICS/SCADA vendors are actually issuing security updates. 
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
DevOps’ Impact on Application Security
DevOps’ Impact on Application Security
Managing the interdependency between software and infrastructure is a thorny challenge. Often, it’s a “developers are from Mars, systems engineers are from Venus” situation.
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2012-6651
Published: 2014-07-31
Multiple directory traversal vulnerabilities in the Vitamin plugin before 1.1.0 for WordPress allow remote attackers to access arbitrary files via a .. (dot dot) in the path parameter to (1) add_headers.php or (2) minify.php.

CVE-2014-2970
Published: 2014-07-31
** REJECT ** DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: CVE-2014-5139. Reason: This candidate is a duplicate of CVE-2014-5139, and has also been used to refer to an unrelated topic that is currently outside the scope of CVE. This unrelated topic is a LibreSSL code change adding functionality ...

CVE-2014-3488
Published: 2014-07-31
The SslHandler in Netty before 3.9.2 allows remote attackers to cause a denial of service (infinite loop and CPU consumption) via a crafted SSLv2Hello message.

CVE-2014-3554
Published: 2014-07-31
Buffer overflow in the ndp_msg_opt_dnssl_domain function in libndp allows remote routers to cause a denial of service (crash) and possibly execute arbitrary code via a crafted DNS Search List (DNSSL) in an IPv6 router advertisement.

CVE-2014-5171
Published: 2014-07-31
SAP HANA Extend Application Services (XS) does not encrypt transmissions for applications that enable form based authentication using SSL, which allows remote attackers to obtain credentials and other sensitive information by sniffing the network.

Best of the Web
Dark Reading Radio