Industry experts have responded to comments made about cybersecurity risks posed to the UK\u2019s critical infrastructure.<\/p>\n
Speaking with the BBC Today programme, and reported by the Daily Telegraph, General Sir Christopher Deverell, Commander of the UK’s Joint Forces Command, warned that traffic control systems were at risk of cyberattack, with road systems one of several potential points that could be targeted.<\/p>\n
Responding to the comments, Andrea Carcano, Nozomi Networks’ Chief Product Officer, said Sir Christopher\u2019s observations voiced concerns that the security community had been raising for a number of years.<\/p>\n
\u201cThe everyday reality is that the UK\u2019s infrastructure and those in every developed country around the world is being continually poked and probed not just by nation states but equally by criminals, hactivists and even curious hobbyists. A major incident is not just inevitable but potentially imminent,” he said.<\/p>\n
\u201cWe\u2019ve seen the damage that can be done from hacks in the Ukraine where attackers were able to compromise systems and turn the lights out. With each incursion, both successful but also those that are thwarted, the attackers will learn what has worked, what hasn\u2019t and what can be improved for the next try.<\/p>\n
\u201cThe challenge for those charged with protecting our critical infrastructure is visibility as you can\u2019t protect what you don\u2019t know exists.<\/p>\n
\u201cA total of 80% of the industrial facilities we [Nozomi] visit do not have up-to-date lists of assets or network diagrams.<\/p>\n
\u201cIronically, this doesn\u2019t pose a problem to criminals who are using readily available open source tools to query their targets and build a picture of what makes up their network environment and is potentially vulnerable \u2013 be it a power plant, factory assembly line or our transport infrastructure as Sir Deverell suggests.<\/p>\n
\u201cOur [Nozomi] researchers recently embarked on a project to create a security testing and fuzzing tool, using open-source software (OSS), capable of automatically finding vulnerabilities in proprietary protocols used by ICS devices.<\/p>\n
\u201cUsing just this tool, and in a limited time period, they identified eight zero-day vulnerabilities that, if exploited could be used to shut-down the controllers (i.e. DoS attack) to being unable to manage the devices through their software and potentially the corruption of normal processes which could be extremely serious or even fatal.<\/p>\n
\u201cAs the cybersecurity risk to critical infrastructure and manufacturing organisations increases, it is important for enterprises to actively monitor and secure operational technology (OT) networks. An important aspect of this is having complete visibility to OT networks and assets and their cybersecurity and process risks.\u201d<\/p>\n
Also offering his reaction, Sean Newman – Director at Corero Network Security, said there were many good reasons for connecting operational and information networks, including efficiency and effectiveness.<\/p>\n
However, this opens up operational controls to potential attacks from across the internet, where previously they were completely isolated and only accessible from the inside.<\/p>\n
\u201cThere is nothing particularly new in the recent claims from the Joint Forces Command, as the potential for such attacks has been growing for several years now, as more and more systems become \u2018connected\u2019,” he said.<\/p>\n
\u201cThe question now, is more around who is bold enough, rather than capable of, carrying out such attacks, and risking the likely repercussions.\u00a0It\u2019s reasonable to assume it\u2019s more a matter of time than if, so the operators of such systems need to be fully cognisant of the potential risks and deploy all reasonable protection to minimise it.<\/p>\n
\u201cThis includes preventing remote access to such systems, as well as real-time defences against DDoS attacks which could disrupt their operation or prevent legitimate access for operation and control purposes.”<\/p>\n
Meanwhile, Michael Fabian, Principal Consultant at Synopsys, said an increase in connectivity comes with an increase in risk.<\/p>\n
\u201cAny time new pathways to these systems are added, they must be properly secured based on their individual characteristics following a risk-based approach,\u201d he said.<\/p>\n
“With the increase in risk, the opportunity for directed cyberattacks also increases.\u00a0Potential attackers range from hobbyists to nation-states, disrupting infrastructure.\u00a0Now, the actual risk versus the perceived risk is complete speculation and is about as difficult to predict as the next location lightning will strike.\u00a0That said, the precedent for infrastructure disruption as a powerful means of attack has already been set globally.<\/p>\n
“What we can take away as a positive is that officials are aware of the potential risks, and we can hope they are actively pursuing remediation programs to improve the security of their operations, keeping the UK\u2019s core infrastructure safe.”<\/p>\n
<\/p>\n
<\/p>\n","protected":false},"excerpt":{"rendered":"
Industry experts have responded to comments made about cybersecurity risks posed to the UK\u2019s critical infrastructure. Speaking with the BBC Today programme, and reported by the Daily Telegraph, General Sir Christopher Deverell, Commander of the UK’s Joint Forces Command, warned that traffic control systems were at risk of cyberattack, with road systems one of several […]<\/p>\n","protected":false},"author":28,"featured_media":22262,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"_acf_changed":false,"footnotes":""},"categories":[7359,1489,14,2122],"tags":[7456,7457,4969,7458,3520,7459,7460,7461,7462,7463,7464,7465],"class_list":["post-22147","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-industry-expert","category-insights","category-more-news","category-transport","tag-andrea-carcano","tag-critical-infrastructure","tag-cyberattack","tag-daily-telegraph","tag-dos-attack","tag-general-sir-christopher-deverell","tag-joint-forces-command","tag-michael-fabien","tag-nozomi-networks-chief-product-officer","tag-principal-consultant-at-synopsys","tag-sean-newman-director-at-corero-network-security","tag-united-kingdom"],"acf":[],"publishpress_future_workflow_manual_trigger":{"enabledWorkflows":[]},"_links":{"self":[{"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/posts\/22147","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/users\/28"}],"replies":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/comments?post=22147"}],"version-history":[{"count":4,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/posts\/22147\/revisions"}],"predecessor-version":[{"id":22167,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/posts\/22147\/revisions\/22167"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/media\/22262"}],"wp:attachment":[{"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/media?parent=22147"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/categories?post=22147"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.intelligentcio.com\/eu\/wp-json\/wp\/v2\/tags?post=22147"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}