Are IT pros overconfident in their ability to deflect attacks?
IT executives within critical infrastructure organizations see a need for public-private threat intelligence sharing partnerships (86% of respondents) to keep pace with escalating cybersecurity threats, according to a survey by The Aspen Institute and Intel Security.
A majority (76%) of survey respondents also indicated they believe a national defense force should respond when a cyber attack damages a critical infastructure company within national borders. Additionally, although most respondents agree that threats to their organizations are on the rise, they maintain a high degree of confidence in existing security.
The survey reveals that the critical infrastructure providers surveyed are pleased with the results of their efforts to improve cybersecurity over the last three years, but at the same time many (72%) said that the threat level of attacks was escalating. Almost half of all respondents (48%) believe it is likely that a cyberattack on critical infrastructure, with the potential to result in the loss of human life, could happen within the next three years.
Survey results suggest there may be a disconnect between critical infrastructure providers and the current threat landscape:
Perceived improvements: Respondents believe their own vulnerability to cyberattacks has decreased over the last three years. When asked to evaluate their security posture in retrospect, 50% reported that they would have considered their organizations “very or extremely” vulnerable three years ago; by comparison, only 27% believe that their organizations are currently “very or extremely” vulnerable.
“We have identified five key findings within the report; and the number one finding was related to this particular statistic,” Raj Samani, VP and CTO at Intel Security, told Help Net Security. Is this overconfidence or actual based on reality? Based on the hourly breach cycle, and the fact that 1 in 3 had encountered an incident impact availability it would suggest a degree of overconfidence in the perceived vulnerability. This of course is a concern as the potential impact of an incident can go well beyond the organization itself and to broader society.”
Government involvement encouraged: Private industry is often hesitant when it comes to government’s involvement in private sector business; however, 86% of respondents believe that cooperation between the public and private sectors on infrastructure protection is critical to successful cyber defense. Furthermore, 68% of respondents believe their own government can be a valuable and respectful partner in cybersecurity.
Confidence in current solutions: Sixty-four percent believe an attack resulting in fatalities has not happened yet because good IT security is already in place. Correspondingly, more than four in five are satisfied or extremely satisfied with the performance of their own security tools such as endpoint protection (84%), network firewalls (84%), and secure web gateways (85%).
Disruptions increasing: More than 70% of respondents think the cybersecurity threat level in their organization is escalating. Around nine in ten (89%) respondents experienced at least one attack on a system within their organization, which they deemed secure, over the past three years, with a median of close to 20 attacks per year. Fifty-nine percent of respondents stated that at least one of these attacks resulted in physical damage.
Loss of life?: Forty-eight percent of respondents believe it is likely that a cyberattack that will take down critical infrastructure with potential loss of life will occur within the next three years, although there were no additional survey questions to determine the circumstances under which respondents believed the loss of life could occur. More US respondents thought this scenario was “extremely likely” to occur than did their European counterparts.
User error still #1 issue: Respondents believe user error is the greatest cause of successful attacks on critical infrastructure. Organizations may strengthen their security postures, but individual employees can still fall victim to phishing emails, social engineering and drive-by browser downloads that successfully infect their organizations’ networks.
Government response: Seventy-six percent of respondents believe a national defense force should respond when a cyber attack damages a critical infastructure company within national borders.
Different country perspectives: US respondents believe the likelihood of a catastrophic cyberattack on critical infrastrucutre that could result in loss of life is more certain than do their European counterparts. While 18% of US sources consider this scenario “extremely likely” to occur in the next three years, only 2% in Germany and 3% in the UK think it extremely likely.