The Ever-Evolving Landscape of Cybersecurity: Insights from Industry Experts

“Cybersecurity is a never-ending journey. You never arrive and are all done because its technologies change daily. Bad actors are adept at using them, and so the cyber-threat surface is always there,” remarked Tayfun Kon, director and industry solutions owner at SoftServe, during a panel discussion at Yokogawa’s YNNOW2024 users’ conference in Houston. This sentiment encapsulates the ongoing challenges and complexities of cybersecurity, a field that demands constant vigilance and adaptation.

The Current State of Cybersecurity Readiness

The panel, which included experts such as Allison Luedecke, internal audit VP, and CISO Mark Littlejohn from CVR Energy, and Camilo Gomez, global cybersecurity strategist at Yokogawa’s U.S. Technology Center, reached a consensus that while progress is being made, significant challenges remain. Kon emphasized that organizations across various industries are increasingly recognizing the need to adapt their cybersecurity posture. “The first step is admitting there’s a problem, and the second step is moving to defend engineering assets,” he explained. As more organizations take these steps, there is optimism that they will reach a mature state of cybersecurity sooner rather than later.

Practical Constraints in Cybersecurity Implementation

Despite this optimism, Littlejohn highlighted that the effectiveness of cybersecurity measures often depends on several factors, including company size, location, available personnel, and revenue. For instance, companies in the Middle East, facing heightened security concerns, tend to implement robust cybersecurity measures, including air-gap procedures to prevent unauthorized communications. In contrast, U.S.-based firms exhibit a wide variance in preparedness. While some adhere to regulations like NERC-CIP, others lack basic cybersecurity measures such as firewalls and software patching. This disparity often stems from funding limitations, with larger multinationals typically able to invest more in cybersecurity than mid-sized companies.

Luedecke shared insights from CVR Energy’s journey, noting that the company conducted a cybersecurity assessment five years ago but initially struggled to gain support for proactive measures. However, recent developments indicate a shift in mindset, with executives and board members becoming more engaged in cybersecurity discussions and risk assessments. “We’ve even undertaken a cyber-risk assessment and internal audit,” Luedecke added, acknowledging that while progress has been made, there is still much work to be done.

The Need for Adaptive Cybersecurity Defenses

The rapid evolution of cyber threats necessitates equally adaptive cybersecurity defenses. Gomez pointed out that the landscape is not only changing due to technological advancements but also because of the increasing integration of IT and operational technology (OT). Many users in the OT space still overlook cybersecurity standards and best practices, but frameworks like ISA/IEC 62443 can guide organizations in implementing effective cybersecurity measures tailored to their specific applications.

The urgency for improved cybersecurity practices has been underscored by recent high-profile ransomware attacks and incidents of identity theft. Littlejohn noted that the geopolitical landscape has also influenced cybersecurity preparedness, citing Ukraine’s response to cyber-attacks during Russia’s invasion as an example of how nations can bolster their defenses in the face of threats.

Regional Variations in Cybersecurity Preparedness

The panelists discussed regional differences in cybersecurity readiness. Littlejohn observed that while users in Asia and Australia often benefit from collaborative efforts between IT and OT departments, organizations in Europe tend to prioritize regulations and investment in cybersecurity. In contrast, many firms in the Americas appear resistant to regulatory frameworks and are not investing adequately in cybersecurity measures.

Fostering Collaboration and Resilience

One of the key takeaways from the discussion was the importance of collaboration between IT and OT departments. Luedecke noted that CVR Energy’s cybersecurity initiatives gained momentum when teams began to work together, sharing insights and addressing issues collectively. This collaborative approach not only fosters a culture of cybersecurity awareness but also enhances the effectiveness of defense strategies.

Littlejohn emphasized the value of transparency in addressing cybersecurity challenges. By publicly listing cybersecurity issues and allocating a budget for remediation, CVR Energy was able to engage all stakeholders in the process. “We put these cybersecurity problems up on a board, so everyone could see them, and decided what to do as a group,” he explained. This collective effort has led to significant improvements in their cybersecurity posture.

Gomez added that cooperative cybersecurity projects and adherence to established standards, such as ISA/IEC 62443, are crucial for building long-term resilience. He highlighted the importance of continuous practice and learning from initiatives like the TSA’s Pipeline Security Directive 2, which can serve as a valuable resource for organizations looking to enhance their cybersecurity programs.

Conclusion: A Continuous Journey

As the panel concluded, it became clear that cybersecurity is not a destination but a continuous journey that requires ongoing commitment, investment, and adaptation. Organizations must remain vigilant and proactive in their efforts to defend against evolving cyber threats. By fostering collaboration, embracing best practices, and learning from past experiences, businesses can enhance their cybersecurity resilience and better protect their critical assets in an increasingly complex digital landscape.