Only a fifth of organisations surveyed for a report on industrial cybersecurity have prioritised incidents that take advantage of Internet of Things (IoT) vulnerabilities, reports Kaspersky.
“For 20% of companies, or one in five, attacks on the industrial IoT (IIoT) have already become one of their main cybersecurity concerns, bypassing such serious threats as data breaches (15%) or attacks on the supply chain (15%),” Kaspersky says.
“Addressing them increasingly requires security professionals’ involvement, not just IT teams.”
McKinsey research has previously found that 90% of manufacturing and supply chain professionals plan to invest in digital skills — but the needs of Industry 4.0 and the IoT suggest companies could have a long way to go on this, the security vendor suggests.
Kaspersky’s State of Industrial Cybersecurity 2020 report also found that only 19% of respondents have implemented active network and traffic monitoring, and just 14% have adopted network anomaly detection. Forty-four percent of enterprises surveyed said IT security personnel are working on initiatives to protect digitalised operations technology (OT) systems.
Kaspersky believes that industrial enterprises need to strive to secure IIoT components, including certificated traffic protection and security for gateways, smart meters, controllers and other equipment. Security audits and threat intelligence updates should be part of the overall mix.
Device security status should be assessed before implementation, and analyses integrated into the enterprise network security system.
In light of these requirements, Kaspersky provides secure IoT-focused gateways based on its own OS, threat intelligence reporting services, and machine learning for anomaly detection which analyse telemetry to help identify suspicious activity.
In October, Kaspersky researchers uncovered a new advanced persistent threat (APT) toolset targeting industrial applications, including a series of specific attacks dating back to 2018.
The MT3 ‘MontysThree’ toolset hosts its communications with control servers on public cloud services and uses steganography to hide its main malicious payload as a bitmap (.bmp). If the right command is entered, the loader uses a custom-made algorithm to decrypt content from the pixel array and run the malicious payload, according to Kaspersky.
Denis Legezo, senior security researcher at Kaspersky, said MT3 attacks combine sophisticated and less sophisticated approaches to target industrial holdings.
“They use strong cryptographic standards and some tech-savvy decisions, including custom steganography. Perhaps most importantly, it’s clear that the attackers have put significant effort into developing the MontysThree toolset, suggesting they are determined in their aims, and that this is not meant to be a short-lived campaign,” Legezo said in the announcement.
(Photo by Remy Gieling on Unsplash)
