Batten down the hatches

November 11, 2022

Recent cyberattacks and exploits of vulnerabilities have had a profound impact on critical infrastructure and are worth studying to secure systems against future attacks

Critical infrastructure systems like those driving power generation, water treatment, electricity production and other platforms are interconnected to form the energy “grid”. Although beneficial to the public, this grid is vulnerable to cyber-attacks by “hacktivists” or terrorists. Critical infrastructure, like power generation and distribution, is becoming more complex and reliant on networks of connected devices. Just decades ago, power grids and other critical infrastructure operated in isolation. Now they are far more interconnected, both in terms of geography and across sectors.

Recent years have seen growing concern about the vulnerability of industrial control systems (ICS), which are used to monitor or control processes in industrial and manufacturing sectors. An attack against an ICS could result in physical damage, such as a fire or explosion, as well as business interruption, says Nigel Pearson, Global Head of Fidelity, AGCS. “A number of ICS still used by manufacturing and utilities companies today were designed at a time before cyber security became a priority issue,” he explains.

In addition, ICS are also vulnerable to both technical failure and operator error as well, which can be much more frequent and severe in terms of impact and are often not captured in cyber reports, adds Georgi Pachov, Global Practice Group Leader Cyber, CUO Property AGCS.

While ICS are a particular issue for the energy sector, similar cyber-related physical damage and business interruption risks exist in other industries. For example, car manufacturing plants rely on robots to make and assemble vehicles. Should a robot be hacked or suffer a technical fault, a production line could be interrupted for hours or days, at a potential cost of tens of millions of dollars per day. And the potential cost of damages could be even higher from an incident involving security-sensitive facilities such as nuclear power plants, laboratories, water suppliers or large hospitals.

The time to secure critical infrastructure is now. Security Buyer catches up with Maher Jadallah, Senior Director Middle East & North Africa, Tenable to find out why.

Cyberattacks have been grabbing headlines across the Middle East for all the wrong reasons in recent years. Help AG’s Middle East-focused ‘State of the Market Report 2021’ revealed: DDoS attacks have become the norm with a 183% increase in the UAE alone; ransomware incidents were on the rise due to a high rate of success; VPNs were attacked monthly as work from home continued; over 18,343 vulnerabilities were identified per the NIST National Vulnerability Database (NVD). Unfortunately, the increase in attacks isn’t limited to just the Middle East.

What is the current landscape of critical infrastructure?

In the United States, the 2021 Colonial Pipeline ransomware attack showcased how the surge in vulnerabilities in IT systems can severely impact operations, and the US economy at large. The attack is a stark reminder for Middle Eastern organisations to protect their critical infrastructure or risk a similar fate.

Globally, to automate workflows and find efficiencies, organisations are investing in Supervisory Control and Data Acquisition (SCADA) systems. According to the Middle East SCADA Market 2021-2027 report by Research and Markets, the market will reach US$2.68bn by 2027. Operational technology (OT) systems like SCADA offer a number of benefits to businesses but the process of securing them can have an impact on operations. Despite this, they absolutely must be secured against cyberattacks.

Generally speaking, IT and OT systems have common touch points, however each faces a diverse set of challenges. With OT systems, patching vulnerabilities can be challenging because small errors can shut down entire plants and facilities, resulting in loss of time and money. Challenges also arise here because, often, OT involves legacy systems that require specialised knowledge, the absence of which makes working with these systems complicated.

That said, securing these systems is a must because the impact cyberattacks can have on critical infrastructure and the supply chain will be far more challenging and costly to recover from.

Are these cyberattacks a modern precedent?

Attacks against critical infrastructure are not a modern age reality, the first attacks in the 1960s involved phone hacking mechanisms exploiting public phone systems.

To read the full exclusive see our latest issue here.