The industrial automation (IA) landscape in India, valued at approximately $11 billion in 2023, is poised for robust growth, projected to reach $23 billion by 2027. As this sector advances, so do the challenges in cybersecurity management, demanding strategic actions to fortify defenses.
Cybersecurity Challenges in IA:
The convergence of Information Technology (IT) and Operational Technology (OT) in IA systems creates a broad cyber-vulnerability space. Unlike traditional IT security challenges, IA enterprises face issues such as IoT security, equipment aging, and security software compatibility in the OT wing. The complex interplay between IT, IoT, and OT systems poses a significant challenge for defenders, as demonstrated by an 86% increase in ransomware attacks against the IA sector in the US from 2022 to 2023.
Modern Threat Landscape:
The threat landscape in IA is evolving, with opportunistic attackers exploiting cyber-security loopholes and highly sophisticated threat groups, including nation-state-driven actors, targeting industrial infrastructure. Ransomware attacks, such as those by groups like Lockbit and Conti, have seen a substantial uptick. Additionally, Advanced Persistent Threats (APTs) are becoming more prevalent, affecting sectors like oil, gas, electricity, manufacturing, transportation, and food and beverage.
Challenges of Incident Response:
Incident response in IA differs significantly from that in traditional IT systems. Cyber-incidents impacting OT systems can have physical consequences, necessitating effective triage without disrupting operations. The lack of visibility into OT environments and the complexity of OT-driven networks further complicates incident response efforts.
The Role of Cyber Insurance:
With cyber-attacks being inevitable, incident response plays a vital role in mitigating the impact. However, the traditional cyber insurance model faces challenges. Cyber-insurance markets are less dense, and small and medium businesses (SMBs) often question the value of cyber insurance, resorting to self-insurance. Cyber-insurers struggle to adopt traditional negotiation approaches, and the high costs of cyber insurance premiums/deductibles push enterprises toward better cybersecurity practices.
Five Managerial Action Items:
To bolster industrial automation cybersecurity, experts propose five key managerial action items:
- Chart an Incident Response Plan for IA Systems:
- Tailor IR plans to the intricacies of OT environments.
- Conduct tabletop exercises aligning threat scenarios with organizational environments.
2. Deploy Defensible Architectures:
- Identify and secure crown jewels within IA sites.
- Segment process networked environments to reduce cyber-risk exposure.
3. Ensure Continuous Network Visibility and Monitoring:
- Adopt a passive monitoring approach.
- Analyze IA networking protocols for effective threat and vulnerability detection.
4. Ensure Secure Remote Access:
- Implement multi-factor authentication and zero-trust solutions.
- Prioritize secure remote access for employees, considering potential cyber-risks.
5. Promote Risk-Based Vulnerability Management:
- Generate a software bill of materials (SBOM) for cyber vulnerability identification.
- Implement cyber-risk-based vulnerability management decisions to mitigate impact.
In conclusion, As India’s IA sector continues to thrive, managing cybersecurity risks becomes imperative. A comprehensive approach, encompassing robust incident response plans, defensible architectures, continuous monitoring, secure remote access, and risk-based vulnerability management, is essential. Moreover, aligning cybersecurity efforts with evolving cyber insurance trends can provide a more resilient defense against the growing threats in the digital landscape.