About 70% of respondents in a recent survey are concerned that a successful cyber-attack could cause a catastrophic failure, such as an explosion.
According to a Tripwire survey, in which respondents included 151 IT and operational technology (OT) security professionals at energy and oil and gas companies, almost all (97%) are concerned that attacks could cause operational shutdowns, and 96% believe they could impact the safety of their employees.
"Energy companies have accepted the reality that digital threats can have tangible consequences," said Tim Erlin, vice president of product management and strategy at Tripwire. "This perception is perhaps heightened by recent attacks that were specifically designed to affect physical operations and have proven capable of doing so."
There were conflicting perceptions of security readiness among respondents: A full 91% are worried about attacks on their industrial control systems (ICS), yet 65% feel their company invests sufficiently in ICS security. At the same time, 62% said that lack of budget and investment continues to be the biggest barrier in meeting ICS security goals.
Of those who said their company does not invest sufficiently, 56% believe it would take a significant attack to get their companies to a proper level of investment. About 59% said their companies increased security investments because of ICS-targeted attacks; and as far as feared threats, 45% said ransomware has had the most significant impact in increasing their security investment, compared to 44% who said Trisis/Triton and Industroyer/Crashoverride and 11% who said Stuxnet.
While a defense-in-depth, layered approach to security is considered a best practice, only 35% of respondents said they implement a multilayered approach to locking down ICS. About a third (34%) said they focus primarily on network level security, and 14% said ICS device security.
"It's encouraging to see that companies have increased their security investment somewhat,” Erlin said. “However, it’s concerning that more than half would wait for an attack to happen before investing properly, given what's at stake with critical infrastructure. The energy industry should invest in establishing more robust cybersecurity strategies, with a proper foundation of critical security controls and layers of defense."