News
7/10/2014
05:15 PM
Connect Directly
Google+
Twitter
RSS
E-Mail
100%
0%

Study: Most Critical Infrastructure Firms Have Been Breached

A new Ponemon Institute study finds 70% of critical infrastructure companies have been hit by security breaches in the last year, but cyber security programs are still a low priority.

Uptime still trumps proactive cyber security measures in most critical infrastructure organizations worldwide, a new Ponemon Institute study shows.

Though 60% of global IT and IT security executives at critical infrastructure organizations say minimizing downtime is a top security objective, just 32% say improving their security posture is a priority. On top of that, 67% say they suffered at least one security breach in the past 12 months that resulted in confidential data loss or disruption to operations. Nearly one-fourth of those attacks were due to insiders or privileged IT users being negligent, the respondents said.

"Security as a priority… that didn't make the top five list," says Larry Ponemon, chairman and founder of the Ponemon Institute. "Availability and uptime" are top priorities.

Preventing and quickly detecting advanced persistent threats (APTs) was a priority for 55% of companies, followed by preventing cyber attacks (44%), compliance (40%), securing the national critical infrastructure (35%), and then, with 32%, improving the organization's security posture.

The perspective of prioritizing availability over improving security is "short-sighted," says Dave Frymier, CISO at Unisys, which commissioned the study. "If you have a cyber security event, it's probably going to affect the availability of your service."

Meanwhile, critical infrastructure firms remain conflicted about patching their software with security or other updates. Fifty-four percent say their organization can't upgrade legacy systems to more secure systems cost-effectively without "sacrificing mission-critical security," the report says.

The full report, "Critical Infrastructure: Security Preparedness and Maturity," is available here for download.

Kelly Jackson Higgins is Executive Editor at DarkReading.com. She is an award-winning veteran technology and business journalist with more than two decades of experience in reporting and editing for various publications, including Network Computing, Secure Enterprise ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Kelly Jackson Higgins
50%
50%
Kelly Jackson Higgins,
User Rank: Strategist
7/11/2014 | 2:16:54 PM
Re: same as it ever was
That's right! Thanks for the reminder, @Marilyn.

Things tend to move kinda slooooowly when it comes to security in the ICS/SCADA critical infrastructure world.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
7/11/2014 | 1:41:40 PM
Re: same as it ever was
Dave Frymier blogged about the lax security around IT infrastructure in airports, utilities, and other critical areas for Dark Readong back in April in 'Baby Teeth' In Infrastructure Cyber Security Framework. Sadly it looks like nothing much has changed. But it's a good read if anyone wants to dive deeper into the subject.   

 

Kelly Jackson Higgins
100%
0%
Kelly Jackson Higgins,
User Rank: Strategist
7/11/2014 | 12:14:55 PM
same as it ever was
No surprise here that operations/uptime trumps shoring up cyber security for ICS/SCADA folks, but Frymier's point that an attack could cause an outage is the bottom line here. And the data indicating that patching is still not common practice is interesting, especially now that more (but not enough) ICS/SCADA vendors are actually issuing security updates. 
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading Tech Digest, Dec. 19, 2014
Software-defined networking can be a net plus for security. The key: Work with the network team to implement gradually, test as you go, and take the opportunity to overhaul your security strategy.
Flash Poll
10 Recommendations for Outsourcing Security
10 Recommendations for Outsourcing Security
Enterprises today have a wide range of third-party options to help improve their defenses, including MSSPs, auditing and penetration testing, and DDoS protection. But are there situations in which a service provider might actually increase risk?
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-2188
Published: 2015-02-26
The Authentication Proxy feature in Cisco IOS does not properly handle invalid AAA return codes from RADIUS and TACACS+ servers, which allows remote attackers to bypass authentication in opportunistic circumstances via a connection attempt that triggers an invalid code, as demonstrated by a connecti...

CVE-2015-0594
Published: 2015-02-26
Multiple cross-site scripting (XSS) vulnerabilities in the help pages in Cisco Common Services, as used in Cisco Prime LAN Management Solution (LMS) and Cisco Security Manager, allow remote attackers to inject arbitrary web script or HTML via unspecified parameters, aka Bug IDs CSCuq54654 and CSCun1...

CVE-2015-0632
Published: 2015-02-26
Race condition in the Neighbor Discovery (ND) protocol implementation in Cisco IOS and IOS XE allows remote attackers to cause a denial of service via a flood of Router Solicitation messages on the local network, aka Bug ID CSCuo67770.

CVE-2015-0651
Published: 2015-02-26
Cross-site request forgery (CSRF) vulnerability in the web GUI in Cisco Application Networking Manager (ANM), and Device Manager (DM) on Cisco 4710 Application Control Engine (ACE) appliances, allows remote attackers to hijack the authentication of arbitrary users, aka Bug ID CSCuo99753.

CVE-2015-0882
Published: 2015-02-26
Multiple cross-site scripting (XSS) vulnerabilities in zencart-ja (aka Zen Cart Japanese edition) 1.3 jp through 1.3.0.2 jp8 and 1.5 ja through 1.5.1 ja allow remote attackers to inject arbitrary web script or HTML via a crafted parameter, related to admin/includes/init_includes/init_sanitize.php an...

Dark Reading Radio
Archived Dark Reading Radio
How can security professionals better engage with their peers, both in person and online? In this Dark Reading Radio show, we will talk to leaders at some of the security industry’s professional organizations about how security pros can get more involved – with their colleagues in the same industry, with their peers in other industries, and with the IT security community as a whole.