A new report by Symantec underscores the threat facing critical infrastructure networks around the world.
The statistics tell the tale. In its August Critical Infrastructure Protection Study, (PDF) covering 1,580 responses from businesses in “six industries categorized as critical infrastructure providers,” Symantec found that 53 percent had experienced what was perceived as a politically motivated cyber-attack, and 48 percent expect attacks in the next year. Businesses that had been attacked had been victimized by attackers an average of 10 times in the past five years at a cost of $850,000.
“I think what’s happened is that there’s a very heightened awareness of the threat,” said Symantec CTO Mark Bregman.
The survey’s responses came from businesses across six verticals: emergency services, energy, IT, banking, health care and communications.
Only about a third of critical infrastructure providers reported feeling “extremely” prepared for all types of attacks and 31 percent felt less than “somewhat” prepared. According to the respondents, the areas that need the most improvement include “security training, awareness and comprehension of threats by executive management,” and “security audits.”
Securing critical infrastructures is no small effort, and Symantec recommended that governments get more involved. For example, “Governments should partner with industry associations to develop and disseminate information” about government programs and best practices.
“It’s important to recognize that even [though] we tend to think of critical infrastructure and large companies as being synonymous that’s not always the case,” Bregman said. “There are some sectors where small companies play a pretty critical role. One example would be emergency services, where at least in the United States a lot of the emergency services are provided by local small businesses, like ambulance services that need to be available in case of emergency-yet them being small businesses, they are not as well connected yet with these critical infrastructure protection programs.”
Critical infrastructure security has been in the news heavily recently due to the emergence of the Stuxnet worm, which targets industrial control systems.
No security is perfect, Bregman said.
“Despite best efforts, there will be things that get through,” he said. “So it’s equally important to have a focus on resiliency and the ability to recover in the situation where a system does get taken down, or data does get corrupted or a breach does occur. It is not enough to build the best defenses and hope, ‘Now that I have great defenses nothing will ever get through.'”