Article content
For a few hours in early February, the sheriffs attending to an incident at a water treatment facility in Florida were concerned that the entire town’s water supply had been poisoned.
In a series of events that made international news, hackers targeted ageing computer systems in an attempt to pump a potentially lethal amount of sodium hydroxide into the pipes.
Luckily, the hack was unsuccessful, although it was only foiled after being detected by a plant employee, who corrected the changes and immediately called his supervisor. Reiterating the important fact that our employees - sometimes referred to as the weakest link - can also be the strongest.
Making matters worse, the attack was completely avoidable if basic security guidance had been followed. Hackers exploited off-the-shelf remote management software that was left unsecured and exposed to the internet, with no administrative notification or authorisation allowing undetected connectivity to be established.
The hack is far from a one off, as cyber-attacks have increasingly targeted a wider range of businesses and government agencies over the last few years, from private finance companies to public utilities. In fact, the UK government has recently announced that securing critical national infrastructure (CNI) would be one of its top priorities this year.
The threat landscape has only become more complicated and sophisticated since the start of the pandemic. COVID-19 has influenced threat actors to become more strategic, targeting sectors in ways that were previously unheard of.
This has been reflected in a new study from Telstra, in association with Vanson Bourne, which indicates that 65% of IT and business decision makers in Europe – across a range of sectors – have experienced an increase in attacks since the start of the pandemic.
A look at verticals and attack vectors
The regulatory focus on critical infrastructure is timely.
Cybercriminals escalated their efforts indiscriminately over the past year, with no surveyed sector coming through completely untouched. However, the oil, gas and utilities sector fared the worst in our study, with 80% of respondents indicating they had experienced an increase in attacks.
Although it isn’t just utilities that have experienced an uptick in attacks over the past year. Healthcare is another sector that has been targeted heavily since the outbreak, with several high-profile attacks making waves internationally. The European Union Agency for Cybersecurity issued a warning in May detailing this rise in attacks, saying cybercriminals had “jumped on the bandwagon” and were taking advantage of a weakened healthcare sector.
Attacks on supply chains have also been rising quite sharply. Our study shows that more than four in ten (45%) of organisations experienced a rise in supply chain attacks. This makes it the most commonly cited attack vector, followed by phishing (44%), fake contact tracing apps and calls (43%), and ransomware (43%).
Which countries are faring better?
While a majority of respondents in each country we surveyed said they experienced an uptick in attacks during COVID, there are some interesting distinctions worth noting.
Organisations in Nordic countries are particularly valuable targets, with an elevated proportion of 79% saying they experienced more attacks, followed by Germany (69%) and the Netherlands (63%).
Unfortunately, 63% of total respondents have noted that their IT security strategies require improvement. The UK and Ireland were the worst performers in this category, with an overwhelming 78% of respondents indicating their IT security strategies needed at least a bit of work.
In more positive news, 46% of total respondents reported that improving cybersecurity, including improving culture/hygiene, is among the areas being prioritised as part of their COVID-19 recovery strategies. This is important, as we have seen how investment in culture and hygiene can improve a company’s ability to identify cyber-attacks during the pandemic.
Of course, organisations shouldn’t forget about making investments in digital innovation, as this will be key to thriving in a post-pandemic world. As businesses adapt to new hybrid ways of working, investing in new digital technologies with security-centric, intelligent IT architecture will be crucial for driving a competitive advantage.
However, cybersecurity needs to remain a core component throughout these investments. As the threat landscape increases in scope and sophistication, ensuring cyber resilience is built into every aspect is vital. Otherwise, organisations risk a whole lot more than just financial loss, as reputation or even safety can be jeopardised.
Are we going to see a period of remediation, where organisations haven’t implemented cybersecurity controls into their digitally transformation strategies to weather the pandemic over the coming year? Or will security loopholes be addressed?
To get the full story of how organisations in Europe are managing digitisation, supply chain management and cybersecurity in 2021, download Telstra’s report here.
