Industry Defence Insights

Old Systems, New Threats: Navigating the Industrial Cybersecurity Landscape

• Jarek Sordyl • Season 3 • Episode 6

Share episode

Ransomware attacks targeting industrial systems have surged a staggering 87% in 2024, with manufacturing bearing the brunt of these assaults. When cybercriminals strike critical infrastructure, the consequences go far beyond data theft—25% of these incidents caused complete operational shutdowns, with 75% resulting in significant disruptions to essential services.

We explore the rapidly evolving threat landscape where specialized attack groups have increased by 60%, now tracking 23 distinct threat actors like BIOS and Graphite who specifically target industrial control systems. The rise of "hybrid threats" combining hacktivism with ransomware illustrates how the motives behind these attacks are becoming increasingly complex.

The technological double-edge sword emerges clearly through our analysis. AI and machine learning offer unprecedented capabilities for predictive threat detection but are simultaneously weaponized by adversaries to create evasive malware like Frosty Goop. Similarly, cloud migration delivers operational benefits while expanding the attack surface—particularly concerning when 65% of OT sites maintain insecure remote access configurations. Legacy systems not designed with security in mind further compound these vulnerabilities.

Proven defensive strategies provide a path forward: network segmentation can cut ransomware recovery time by 50%, while zero trust models, proper vendor risk management, and strategic AI deployment for anomaly detection offer multi-layered protection. As Robert Lee from Dragos notes, "OT isn't niche anymore, it's a mainstream target," underscoring why security foundations must accompany technological advancement.

What societal risks emerge when our critical infrastructure becomes increasingly vulnerable, and what role can you play in raising security awareness? Join us in this essential conversation about protecting the systems that power our world.

Support the show

Speaker 1:

In today's podcast, we are going to talk about the OT, cybersecurity and disruptive technologies.

Speaker 2:

Welcome to the Deep Dive. Today we're looking at the future of cybersecurity for industrial control systems, ot.

Speaker 1:

basically, that's right. We've got some well, pretty interesting findings on how newer tech like AI and the cloud are changing the security game for critical infrastructure.

Speaker 2:

And this is really for you, the learner we want to break down these big shifts. You know what they mean for keeping essential systems safe, without getting totally bogged down in jargon.

Speaker 1:

Exactly Highlighting the key changes, the risks, maybe some surprising connections there.

Speaker 2:

Okay, let's jump right in the threat level. It sounds like it's really spiking.

Speaker 1:

Oh, definitely. We're seeing a huge surge, I mean an 87% increase, in ransomware-hitting industrial organizations just this year 2024.

Speaker 2:

87% Wow. And specific sectors are getting head-harder.

Speaker 1:

Yeah, manufacturing is really the main target. Something like 69 percent of attacks are aimed there. The pace is concerning.

Speaker 2:

And it's not just random attacks. Right More groups are specifically going after these OT systems.

Speaker 1:

Precisely the number of known threat groups, focusing on OT and ICS specifically. That's jumped by 60 percent 60 percent. We're tracking 23 distinct groups now, yeah, and some are new, like BIOSes. They seem linked to Iranian operations, and another called Graphite, focusing on energy infrastructure in Eastern Europe. Yeah, so yeah, more specialized threats.

Speaker 2:

And the impact isn't just data loss, is it? It's hitting actual operations.

Speaker 1:

Absolutely A full quarter. 25% of these ransomware attacks led to complete OT shutdowns. Imagine like a factory floor just stopping.

Speaker 2:

That's serious.

Speaker 1:

And even when it wasn't a full shutdown, 75% still caused major operational disruptions. So yeah, real world consequences.

Speaker 2:

So how does this new tech wave, ai, cloud automation, fit into this picture, both good and bad, I imagine. Let's start with AI.

Speaker 1:

Right, ai and machine learning. It's definitely a double-edged sword here. On the plus side you've got things like predictive threat detection, so AI can analyze tiny deviations in how a wind turbine is running and maybe predict a bearing failure before it actually happens Stuff humans might miss.

Speaker 2:

That sounds incredibly useful, proactive, but the downside.

Speaker 1:

Well, the flip side is, adversaries are using AI, too, to build smarter malware. We've seen examples like Frosty Goop. Ai helps generate malware that's really good at dodging traditional security.

Speaker 2:

So it forces defenses to get smarter too. What about moving OT functions to the cloud? Good or bad?

Speaker 1:

Again, both Benefits are clear remote monitoring, scalable data storage Think oil and gas tracking, pipeline conditions from anywhere.

Speaker 2:

Makes sense.

Speaker 1:

But it massively expands the attack surface. And the scary part about 65% of OT sites have insecure remote access. Things like unpatched VPNs, even just default passwords, still being used.

Speaker 2:

Oof 65%. That's a lot of open doors.

Speaker 1:

It really is. And then you have automation like SR security orchestration, automation and response. Faster responses sound good.

Speaker 2:

But there's always a but, isn't there.

Speaker 1:

Huh, Seems like it. Well. Sr is great for known threats, automating the routine stuff.

Speaker 2:

Yeah.

Speaker 1:

But it can sometimes miss more nuanced attacks Like what, like spear phishing campaigns, maybe like the ones the Graphite Group uses. They rely on tricking people, social engineering, an automated system.

Speaker 2:

Looking purely at technical finds might just overlook that. So beyond the new tech, are the old problems still around, like legacy systems.

Speaker 1:

Oh, absolutely Huge issue. So many industrial sites run on older equipment that just wasn't built with modern cybersecurity in mind, no basic features sometimes.

Speaker 2:

And supply chain risks. We all remember solar winds.

Speaker 1:

Exactly that kind of thing A compromise that a trusted vendor can ripple through countless OT environments. Plus, we're seeing this weird mix now of hacktivism and ransomware Groups like Hundala or CyberVolk. They might have an ideology, but they also want the payout.

Speaker 2:

Okay. So, faced with all this, what are the essential defenses, what actually works?

Speaker 1:

Well, some fundamentals are crucial network segmentation, keeping IT and OT networks separate. That's huge data shows it can cut ransomware recovery time by half 50% faster recovery just from segmentation Okay then adopting a zero trust model for any remote access. Basically trust nothing, verify everything always and Makes sense and basics like regular offline backups and testing them. Vendor risk management is vital too. Check your supplier security. Demand things like multi-factor authentication, mfa, yeah, and finally actually using AI defensively for spotting anomalies in that SCADA and ICS traffic. It can give you that early warning.

Speaker 2:

It really paints a picture of well technology being both the problem or part of the solution.

Speaker 1:

That sums it up pretty well. As Robert Lee from Dragos often says, ot isn't niche anymore, it's a mainstream target. Innovation's great, but you need those security foundations, segmentation, visibility they're non-negotiable now.

Speaker 2:

So it's clear this convergence creates huge opportunities, but also really significant challenges. The key takeaway seems to be innovate, yes, but don't neglect the security basics. They're more critical than ever.

Speaker 1:

Absolutely, which leads to maybe a final thought for our listeners, as everything gets more connected what are the bigger societal risks if our critical infrastructure is vulnerable like this, and what part can individuals play in just raising security awareness? Something to think about.

Speaker 2:

This podcast is supported by OTCert EU cohort.