30% of Critical Infrastructure Organizations Will Experience a Security Breach by 2025

By 2025, 30% of critical infrastructure organizations will experience a security breach that will result in the halting of operations or mission-critical cyber-physical systems, as per the recent report from Gartner. Critical infrastructure security has become a primary concern for governments around the world, with the U.S., U.K. EU, Canada and Australia each identify sectors deemed ‘critical infrastructure’, for example, communications, transport, energy, water, healthcare and public facilities.

In some countries, critical infrastructure is state-owned, while in others, like the U.S., private industry owns and operates a much larger portion of it. The recent massive cyber attack on Australian energy Infra by Chinese hackers, were just minutes away from shutting down power to three million Australian homes when they were foiled at the last obstacle. If the attack is successful, it will knock off electricity to between 1.4 and 3 million homes, with no way of knowing how long it will take to retake control of the generators. Experts say, what is the need to go for the complete automation of the Operational Technology.

Operational technology, monitors and manages industrial process assets and manufacturing/industrial equipment. Essentially, OT is the hardware and software that keeps things, for instance factories, power plants, facility equipment etc. running.

“Governments in many countries are now realizing that their national critical infrastructure has been an undeclared battlefield for decades and they are now making moves to mandate more security controls for the systems that underpin these assets. A Gartner survey showed that 38% of respondents expected to increase spending on operational technology (OT) security between 5% and 10% in 2021, with another 8% of respondents predicting an increase of above 10%.

Besides the need to catch up, there is a growing number of increasingly sophisticated threats. “Owners and operators of critical infrastructure are also struggling to prepare for the coming increased oversight.” Over time, the technologies that underpin critical infrastructure have become more digitized and connected - either to enterprise IT systems and/or to each other - creating cyber-physical systems security risks.

The result has been a substantial increase in the attack surface for hackers and bad actors of all kinds. In critical infrastructure sectors, organizations need to be more concerned about real world hazards to humans and the environment, rather than information theft. Gartner predicts that by 2025, attackers will have weaponized a critical infrastructure cyber-physical system to successfully harm or kill humans.