Proactive Cybersecurity: Increased Safety Measures Make All the Difference

The infrastructure of the United States is under attack, as foreign criminals use advanced skills and exploit company vulnerabilities to cripple operations, disrupt industrial control systems, and ultimately inflict significant damage, both monetarily and economically. 

First, there are multiple ways of attacking companies, both resulting in tangible and intangible losses. Take the hacking organization, Darkside, which launched a major ransomware assault against the Colonial Pipeline leading it to close operations and freeze its IT systems. This remained in place until they ultimately paid a ransom of $4.4 million.

In February, hackers attempted to boost the amount of sodium hydroxide scheduled to go into the water supply at a Florida plant nearly 100 times the usually allocated amount. Thankfully, a plant operator caught the anomaly in real time and adjusted the chemical levels before any serious harm inflicted to its population.

Then there was the 2020 SolarWinds attack, when hackers tied to Russia’s foreign intelligence service added malicious code to the company’s Orion IT monitoring platform. This allowed hackers to infiltrate all Orion software networks, influencing Fortune 500 companies, large U.S.-based telecommunications companies, and hundreds of educational institutions, as well as the military, the Pentagon and the State Department. Overall, estimates show total damage from the assault exceeded $100 million.

Ultimately, the immense cost of such intrusive invasions is just a fraction of the impact and it can happen to any organization. The ultimate goal of these cybercriminals is to disrupt normal business operations and everyday life by targeting the critical infrastructure that keeps companies afloat. Despite these warnings and examples of attacks that have inflicted devastating damage, both economically and financially, many institutions remain unprepared. The best way to combat these cybercriminals is to have the best preventative measures in place before an attack happens. Addressing vulnerabilities and risks within industrial control systems and operational technology remains critical in the continued fight against these potential cybercrimes.

Look in the Mirror
There are a number of areas that can leave you exposed to cybercriminals, including legacy software, a lack of network segmentation, the use of default configurations, and a lack of encryption, weak remote-access procedures, and no threat-detection capabilities. To start, companies need to ask themselves: What can I do to protect myself from a cyberattack if I am at risk?  They also need to consider that by becoming complacent in such areas, they could be introducing even more risks. 

Most Common Mistakes
Organizations make mistakes that leave them and their systems vulnerable and unprotected. One example is when security technologies are deployed to meet compliance requirements, rather than to reduce risks. Another is when there is no risk strategy or framework to prioritize security-related tasks. Entities often underestimate the scope of work and resources required to realize returns on security investments, which is another common issue. Other examples include:

  1. A nonexistent or incomplete inventory of the assets and applications that need protection.
  2. A lack of visibility into the assets and applications communicating within networks.
  3. No network segmentation.
  4. No integration between and among systems.
  5. A failure to identify or fully understand the vulnerabilities and attack vectors that exist within the enterprise.

Take Action
As enterprise leaders, it is critical to take action to address the weak spots within your security plans. You must move the risk needle in a positive direction to protect your critical infrastructure. How this starts is by reviewing your security strategy and protocols. Clearly identify risks and vulnerabilities, as well as any technologies, policies, and procedures needed to mitigate them. 

Create a roadmap to implement the missing mitigation components, along with the metrics needed to determine efficiency. Keep in mind your security ecosystem should have multidirectional information sharing between and among your intrusion detection and intrusion prevention systems, the security information and event management system, the asset management system, your privileged access management system and any other security technology deployed within your environment. 

Your strategic plan should also address staffing requirements to ensure internal resources are properly trained and available to implement security measures and rapidly respond to threats. It should also identify which external resources, such as benchmarking standards, are leveraged to reduce risk and increase efficiency so that your security program delivers robust protection to your industrial control systems, operational technology, and IT systems.

Featured

  • Mall of America Deploys AI-Powered Analytics to Enhance Parking Intelligence

    Mall of America®, the largest shopping and entertainment complex in North America, announced an expansion of its ongoing partnership with Axis Communications to deploy cutting-edge car-counting video analytics across more than a dozen locations. With this expansion, Mall of America (MOA) has boosted operational efficiency, improved safety and security, and enabled more informed decision-making around employee scheduling and streamlining transportation for large events. Read Now

  • Security Industry Association Launches New “askSIA” AI Tool

    The Security Industry Association (SIA) has unveiled a brand-new SIA member benefit – askSIA, a conversational AI agent designed to help users get the most out of their SIA membership, easily access SIA resources and find the latest information on SIA’s training and courses, reports and publications, events, certification offerings and more. SIA members can easily find askSIA by visiting the SIA homepage or looking for the askSIA icon in the top left of webpages. Read Now

    • Industry Events
  • Industry Embraces Mobile Access, Biometrics and AI

    A combination of evolving workplace dynamics, technology innovation and new user expectations is changing how people enter and interact with physical spaces. Access control is at the heart of these changes. Combined with biometrics and AI, mobile access control has become increasingly crucial for deploying entry solutions that are seamless, secure and adaptive to user needs. Read Now

  • Sustainable Video Solution Delivered for Landmark City of London Office Development

    An advanced, end-to-end video solution from IDIS, with a focus on reducing waste and costs, has helped a major office development in the City of London align its security with sustainability objectives. Read Now

  • DHS to End ‘Shoes-Off’ Travel Policy

    Homeland Security Secretary Kristi Noem announced a new policy today which will allow passengers traveling through domestic airports to keep their shoes on while passing through security screening at TSA checkpoints. Read Now

New Products

  • Automatic Systems V07

    Automatic Systems V07

    Automatic Systems, an industry-leading manufacturer of pedestrian and vehicle secure entrance control access systems, is pleased to announce the release of its groundbreaking V07 software. The V07 software update is designed specifically to address cybersecurity concerns and will ensure the integrity and confidentiality of Automatic Systems applications. With the new V07 software, updates will be delivered by means of an encrypted file.

  • EasyGate SPT and SPD

    EasyGate SPT SPD

    Security solutions do not have to be ordinary, let alone unattractive. Having renewed their best-selling speed gates, Cominfo has once again demonstrated their Art of Security philosophy in practice — and confirmed their position as an industry-leading manufacturers of premium speed gates and turnstiles.

  • FEP GameChanger

    FEP GameChanger

    Paige Datacom Solutions Introduces Important and Innovative Cabling Products GameChanger Cable, a proven and patented solution that significantly exceeds the reach of traditional category cable will now have a FEP/FEP construction.