Security for the industrial internet of things (IIoT) and operational technology (OT) is in its infancy in many organizations. Several factors — including security incidents — are driving awareness and improvements. There’s certainly plenty of room for both, considering more than 90% of organizations surveyed acknowledged experiencing a security incident in the last 12 months.
From web application attacks to distributed denial-of-service (DDoS)attacks and everything in between, global businesses are dealing with a wide range of potential cybersecurity risks. In addition, respondents are also concerned about the impact that the current threat landscape and geopolitical situation could have on their organizations. While that largely sits outside an organization’s control, it impacts them in some shape or form and is a concern.
Barracuda examines this and other key findings in the new report, The state of industrial security in 2022. To capture perspectives on industrial internet of things (IIoT)/ operational technology (OT) security projects, implementation challenges, security incidents, technology investments, and a variety of issues related to cybersecurity risks, Barracuda commissioned independent market research firm Vanson Bourne to survey IT decision makers. The results of that research were published today in the new report.
The survey includes responses from 800 senior IT managers, senior IT security managers, and project managers responsible for IIoT/OT in their organization. They came from organizations with more than 500 employees in the U.S., EMEA, and Australia.
Critical infrastructure is under attack
Overall, the research shows that critical infrastructure is under attack, and despite agreement that IIoT and OT security is critical, businesses are facing some significant challenges as the geopolitical landscape becomes increasingly tense. Security breaches have shown to have impacts beyond monetary losses as well, resulting in significant downtime with long-lasting breach impact. The research found:
- Attacks are widespread: 94% of organizations surveyed acknowledged experiencing a security incident in the last 12 months.
- Geopolitical concerns: 89% of respondents are very or fairly concerned about the impact that the current threat landscape and geopolitical situation will have on their organizations.
- Breaches are impacting operations: 87% of organizations that experienced an incident were impacted for more than one day.
Investing in IIoT security
Organizations across the board have acknowledged the importance of investing even further in IIoT and OT security, with 96% of business leaders noting that their organization needs to increase their investment in industrial security. A full 72% of organizations signaled that they have either already implemented or are in the process of implementing IIoT/OT security projects, but many are facing significant challenges when it comes to implementation, including basic cyber hygiene.
- Manufacturing and healthcare lag behind: Critical infrastructure organizations are leading with implementation, and 50% in oil and gas having completed projects. Only 24% in manufacturing and just 17% in healthcare have completed projects.
- Businesses are experiencing failures: 93% have failed in their IIoT/OT security projects.
- Effective IIoT security implementations are making an impact: For organizations with completed IIoT and OT security projects, 75% have experienced no impact at all from a major incident.
- Multifactor authentication (MFA) use is low: Only 18% of companies surveyed restrict network access and enforce multifactor authentication when it comes to remote access to OT networks.
- Low MFA use is prevalent even in critical industries: Critical verticals like energy (47%) allow full remote access without MFA for external users.
- Skills have an impact: Less than half of organizations surveyed can handle applying security updates themselves (49%).
- Manual updates are cumbersome: Organizations are hit the worst when security updates are not automatic.
