The Growing Threat to Cyber-Physical Systems: Insights from Claroty’s 2024 Report

In an era where digital transformation is reshaping industries, the security of cyber-physical systems (CPS) has emerged as a critical concern for organizations worldwide. Claroty, a leading company in CPS protection, recently released a comprehensive report titled The Global State of CPS Security 2024: Business Impact of Disruptions. This report sheds light on the significant business impacts of cyber attacks on CPS environments, drawing from a global survey of 1,100 professionals across various sectors, including information security, operational technology (OT) engineering, and facilities management.

Financial Impacts of Cyber Attacks

The findings from the report reveal alarming statistics regarding the financial repercussions of cyber attacks on CPS. In the Australia and New Zealand (ANZ) region, 22% of organizations reported financial impacts exceeding USD 1 million due to cyber incidents affecting their CPS. The primary contributors to these losses included:

• Loss of Customer or Partner Relationships: 19% of respondents cited this as a significant factor.
• Lost Revenue: 15% reported a direct loss in revenue.
• Regulatory Fines: 12% faced penalties due to compliance failures following an attack.

These figures underscore the urgent need for organizations to prioritize cybersecurity measures to protect their critical infrastructure.

The Ransomware Epidemic

Ransomware attacks have become a prevalent threat, particularly in the healthcare sector. The report indicates that three-quarters of ANZ respondents who experienced ransomware attacks met ransom demands exceeding USD 500,000 to regain access to their encrypted systems. This trend is particularly concerning in healthcare, where 78% of respondents reported similar ransom payments. The relentless nature of ransomware and extortion-based attacks on hospitals and clinical environments highlights the vulnerability of CPS in critical sectors.

Operational Downtime and Recovery Challenges

Beyond financial losses, cyber attacks also lead to significant operational disruptions. The report reveals that 25% of ANZ respondents experienced a full day or more of operational downtime, severely impacting their ability to deliver goods or services. Furthermore, 40% reported that the recovery process took a week or more, while 18% faced recovery times extending beyond a month. This is particularly alarming for CPS environments, such as manufacturing plants, where uptime is crucial for operational efficiency.

Root Causes of Cyber Vulnerabilities

The survey also delves into the root causes of these cyber attacks. Many organizations in ANZ acknowledged a lack of essential security capabilities that could have mitigated the negative impacts. Key areas of concern included:

• Lack of Exposure Management: 16% of respondents identified this as a critical gap.
• Absence of an OT-Specific Security Operations Center (SOC): 14% noted that not having a dedicated SOC hindered their ability to respond effectively to attacks.

These insights highlight the need for organizations to enhance their cybersecurity frameworks and invest in specialized resources to protect their CPS environments.

The Role of Third-Party Access

A significant portion of cyber attacks in the past year originated from third-party supplier access to CPS environments. The report indicates that 93% of ANZ organizations surveyed experienced at least one cyber attack linked to third-party access, with 47% reporting five or more such incidents. Alarmingly, 58% of respondents admitted to having only partial or no understanding of third-party connectivity to their CPS. This lack of visibility poses a substantial risk, emphasizing the need for robust third-party risk management strategies.

Growing Confidence and Future Improvements

Despite the challenges faced over the past year, there is a silver lining. The report reveals that 73% of ANZ respondents feel more confident in their organization’s CPS resilience against cyber attacks compared to the previous year. Furthermore, 100% expect to see quantifiable improvements in their CPS security within the next 12 months, with 36% already observing positive changes. This growing confidence reflects a shift in mindset, with organizations recognizing the importance of proactive cybersecurity measures.

Legislative Changes and Secure Access Principles

As the risks to CPS networks continue to evolve, legislative changes, such as the Security of Critical Infrastructure (SOCI) Act and industry-specific standards like the Australian Energy Sector Cyber Security Framework (AESCSF), have been introduced. These regulations aim to ensure organizations maintain an accurate inventory of CPS assets and understand the associated risks.

Moreover, the survey results emphasize the critical need for Australian organizations to implement secure access principles. This applies not only to third-party contractors but also to internal users, providing an additional layer of auditability and monitoring on critical assets. Given that CPS networks often serve as the core of an organization’s operations, prioritizing their cybersecurity is paramount.

Conclusion: The Path Forward

The impacts of cyber attacks on asset-intensive organizations can be devastating, often necessitating substantial investments in cybersecurity to recover. Claroty’s Chief Strategy Officer, Grant Geyer, emphasizes the need for organizations to transition from a reactionary approach to a proactive one, integrating cybersecurity into their core mission. The insights from the report serve as a wake-up call for organizations operating CPS networks, reinforcing that neglecting the unique challenges of CPS protection can lead to significant financial and operational consequences.

For a deeper understanding of the findings and recommendations, you can read the full report here. As the landscape of cyber threats continues to evolve, organizations must remain vigilant and committed to enhancing their cybersecurity posture to safeguard their critical infrastructure.