Oct 4, 2019

A third of industrial plants have no response plan for cyberattacks

An employee works on a Volkswagen e-Golf automobile in Dresden in 2018. Photo: Jens Schlueter/Getty Image

35% of global industrial plants have no response plan in case of cyberattacks, according to a survey conducted by Siemens and the Ponemon Institute.

Why it matters: The consensus among cybersecurity experts is to treat breaches as inevitable and plan ahead for resiliency. That can be particularly important in industrial systems, where physical safety and plant operations can hinge on the uptime of single systems.

The report sampled 1,726 employees of industrial companies scattered around the globe.

By the numbers: Only 42% of respondents rated their readiness for cyber attacks as "high."

  • While that number might be off since people aren't always the best judges of their own work, Siemens head of industrial cybersecurity Leo Simonovich told Axios that a low number actually speaks well of a community waking up to its vulnerability.
  • "We’ve seen a real awareness of the problem," he said. "The first step is identifying the threat."

From the survey, and confirmed by most experts' on-the-ground experience, Simonovich said there were three key problems that appear to plague industrial cybersecurity.

  • Experts aren't in charge. At the majority of plants, it's plant managers or industrial engineers, rather than cybersecurity experts, who run cybersecurity.
  • Low visibility. Unlike with traditional business networks, industrial networks often lack the tools to see what's going on in a network, which is critical in catching hackers. That, too, is getting better.
  • Staffing. This, said Simonovich, goes beyond the well-publicized global shortage of cybersecurity talent. Just as plant managers don't know the ins and outs of cybersecurity, cybersecurity talent often does not understand industrial machines that can frequently shut down when subjected to traditional cybersecurity processes.
  • "There's a lack of people who understand industrial controls, networking, security, and heavy machinery," he said. "One person needs at least 2-3 out of the four. "

Go deeper

China's upgraded cybersecurity law could take a toll

Illustration: Aïda Amer/Axios

China is applying tougher cybersecurity standards more widely as of Dec. 1, requiring companies to open their networks and deploy government-approved equipment. The changes worry international organizations and underscore the difference between U.S. and Chinese approaches to cybersecurity.

The big picture: China already has a law, applying to the most secure networks, that allows the government to audit private business networks and mandates the use of government-approved security equipment. That law will now apply to all networks.

Go deeperArrowOct 17, 2019

Scoop: Cyber memo warns of new risks to White House network

Photo: Saul Loeb/AFP via Getty Images

An internal memo on cybersecurity, obtained by Axios, warns that "the White House is posturing itself to be electronically compromised once again."

The state of play: That's after at least a dozen top- or high-level officials have resigned or been pushed out of a cybersecurity mission that was established under Barack Obama to protect the White House from Russian hacking and other threats, according to conversations with several current and former officials.

Go deeperArrowOct 23, 2019

2020 may be cybersecurity's "year of the platform"

Illustration: Aïda Amer/Axios

Vendors and cybersecurity pros anticipate businesses may finally pivot from using dozens of independently working products to using integrated platforms built with coordination in mind.

Why it matters: It’s a small-seeming tweak with the power to completely reshape the industry. Business users currently layer sometimes dozens of unconnected security products on top of each other, creating overlaps and gaps in coverage. It's like building a pile of loose string when what you really want is a net.

Go deeperArrowOct 24, 2019