Businesses are increasingly aware that security technology is only as valuable to their goals as the people who use it. While research increasingly touts the potential of AI-driven cybersecurity to boost digital defences, new research shows that almost half of firms spending more on cybersecurity in the coming year will do so to strengthen their human resources.

A recent paper by IBM considered the cost of data breaches. In the end, it estimated an increasing cost for organisations that suffer a data breach, with an average of $4.45 million – but that rose as high as $10.93 million in certain high-impact sectors like healthcare. According to the same study, the use of AI and automation solutions have had a real impact for organisations that use such solutions extensively within their defences. On average those organisations with such solutions in place were able to identify and contain a breach 108-days shorter than those without. These companies also reported a $1.76 million lower data breach cost compared to organisations that didn’t have such capabilities.

However, like any other form of digital transformation from the last decade, there is a risk of underestimating the changes needed to get the best results from AI technology. It is still easy to view AI as a silver-bullet, which will simply render improved results on its own when it comes to shutting out cyber-criminals – but the reality is that the best implementations of the technology are as much about human employees as the tools they use.

Source: S-RM, Cyber Security Insights Report 2023

To that end, a new study from global cybersecurity consultancy S-RM has found that while the average 97% of firms are planning to increase the use of AI tools across the firm – with boosts to cybersecurity including real-time threat detection, and automated risk and compliance – but only 53% are confident that they can secure those tools. With the introduction of new tools comes new opportunities for criminals – especially if the tools are not implemented properly.

This has seen a noted change in the way which companies view their investments in the latest digital tools. S-RM polled 600 c-suite and IT budget holders from organisations in the UK and US with a revenue over $500 million. When asked by S-RM whether they felt technology provided ‘high value for money’, around three-in-five respondents in the hype-driven 2021 and 2022 financial years agreed that it did. In 2023, however, that has fallen to less than half.

Looking deeper at the responses, some areas of technology investment were even less seen as inherently ‘high value for money’. While cybersecurity technologies were described that way by 49% of respondents, that sank to 42% for risk assessments, and 40% for third-party risk management. According to the researchers, this dip in technology’s perceived value likely reflects a growing awareness that investing in cybersecurity, technology also means investing in the governance and personnel to effectively enable and manage it. Supporting this point, S-RM also found that it seems to be a driver of rising investment in the coming year.

Source: S-RM, Cyber Security Insights Report 2023

Cybersecurity budgets grew by 3.1% in 2023, but firms predict an 8% rise in the coming year. When asked what was behind this, around four-in-ten said that they were either aiming to upskill their teams, training them to better deploy new technology, or that they were looking to hire more skilled personnel to do that same. Both those responses were around 10% less popular last year, showing a marked shift in the assumptions around the effectiveness of new cybersecurity technology on its own.

Even so, the decisionmakers determining budget still seem out of step with their staff, suggesting they may not be shifting quickly enough. Only 43% of IT professionals – those deploying technology – cited it as a ‘high value for money’ investment area, compared to 56% of C-Suite business. The difference perhaps reflects a misalignment of expectations between the operators of cyber technologies, and those a step removed from their day-today applications.

Jamie Smith, head of cybersecurity at S-RM, commented, “It’s reassuring that cyber security budgets are still rising in these challenging times, but this level of increase is simply not enough to tackle the growing cyber threat. Navigating ongoing skill shortages and investing in training and development of teams comes at a cost, but cyber professionals are not receiving the budget they need to deliver on these critical initiatives. Organisations will have to continue being cautious with cyber security spend, identifying those ‘value for money’ areas that will enable them to manage emerging cyber threats with tightened purse strings.”

A recent study conducted by IBM has found that the cost of data breaches is increasing for organizations, with an average cost of $4.45 million. In certain sectors like healthcare, the cost can rise as high as $10.93 million. However, organizations that utilize AI and automation solutions in their cybersecurity defenses have seen positive results. On average, these organizations were able to identify and contain breaches 108 days faster than those without such solutions, resulting in a $1.76 million lower data breach cost.

Despite the potential benefits of AI-driven cybersecurity, it is important to recognize that the success of these technologies relies on human employees as much as the tools themselves. Global cybersecurity consultancy S-RM conducted a study that revealed while 97% of firms plan to increase their use of AI tools, only 53% are confident in securing these tools. Implementing new technologies can create opportunities for cybercriminals if not done properly.

S-RM's study also found that there has been a shift in how companies view their investments in digital tools. In previous years, technology investments were seen as providing high value for money by around three-in-five respondents. However, in 2023, less than half of respondents agreed with this statement. This decline in perceived value likely reflects a growing awareness that investing in cybersecurity technology also requires investing in governance and personnel to effectively manage it.

Despite the growing awareness, there is still a disconnect between decision-makers and IT professionals. Only 43% of IT professionals consider cybersecurity technology a high-value investment area compared to 56% of C-Suite executives. This misalignment suggests that decision-makers may not be adapting quickly enough to the changing landscape of cybersecurity.

As a result, cybersecurity budgets are predicted to rise by 8% in the coming year. Organizations are recognizing the need to upskill their teams and hire more skilled personnel to effectively deploy new technology. However, there is still a need for increased budget allocation to meet the growing cyber threat. Organizations must carefully prioritize their cybersecurity spend to manage emerging threats while working within budget constraints.

Businesses are increasingly aware that security technology is only as valuable to their goals as the people who use it. While research increasingly touts the potential of AI-driven cybersecurity to boost digital defences, new research shows that almost half of firms spending more on cybersecurity in the coming year will do so to strengthen their human resources.

A recent paper by IBM considered the cost of data breaches. In the end, it estimated an increasing cost for organisations that suffer a data breach, with an average of $4.45 million – but that rose as high as $10.93 million in certain high-impact sectors like healthcare. According to the same study, the use of AI and automation solutions have had a real impact for organisations that use such solutions extensively within their defences. On average those organisations with such solutions in place were able to identify and contain a breach 108-days shorter than those without. These companies also reported a $1.76 million lower data breach cost compared to organisations that didn’t have such capabilities.

However, like any other form of digital transformation from the last decade, there is a risk of underestimating the changes needed to get the best results from AI technology. It is still easy to view AI as a silver-bullet, which will simply render improved results on its own when it comes to shutting out cyber-criminals – but the reality is that the best implementations of the technology are as much about human employees as the tools they use.

Source: S-RM, Cyber Security Insights Report 2023

To that end, a new study from global cybersecurity consultancy S-RM has found that while the average 97% of firms are planning to increase the use of AI tools across the firm – with boosts to cybersecurity including real-time threat detection, and automated risk and compliance – but only 53% are confident that they can secure those tools. With the introduction of new tools comes new opportunities for criminals – especially if the tools are not implemented properly.

This has seen a noted change in the way which companies view their investments in the latest digital tools. S-RM polled 600 c-suite and IT budget holders from organisations in the UK and US with a revenue over $500 million. When asked by S-RM whether they felt technology provided ‘high value for money’, around three-in-five respondents in the hype-driven 2021 and 2022 financial years agreed that it did. In 2023, however, that has fallen to less than half.

Looking deeper at the responses, some areas of technology investment were even less seen as inherently ‘high value for money’. While cybersecurity technologies were described that way by 49% of respondents, that sank to 42% for risk assessments, and 40% for third-party risk management. According to the researchers, this dip in technology’s perceived value likely reflects a growing awareness that investing in cybersecurity, technology also means investing in the governance and personnel to effectively enable and manage it. Supporting this point, S-RM also found that it seems to be a driver of rising investment in the coming year.

Source: S-RM, Cyber Security Insights Report 2023

Cybersecurity budgets grew by 3.1% in 2023, but firms predict an 8% rise in the coming year. When asked what was behind this, around four-in-ten said that they were either aiming to upskill their teams, training them to better deploy new technology, or that they were looking to hire more skilled personnel to do that same. Both those responses were around 10% less popular last year, showing a marked shift in the assumptions around the effectiveness of new cybersecurity technology on its own.

Even so, the decisionmakers determining budget still seem out of step with their staff, suggesting they may not be shifting quickly enough. Only 43% of IT professionals – those deploying technology – cited it as a ‘high value for money’ investment area, compared to 56% of C-Suite business. The difference perhaps reflects a misalignment of expectations between the operators of cyber technologies, and those a step removed from their day-today applications.

Jamie Smith, head of cybersecurity at S-RM, commented, “It’s reassuring that cyber security budgets are still rising in these challenging times, but this level of increase is simply not enough to tackle the growing cyber threat. Navigating ongoing skill shortages and investing in training and development of teams comes at a cost, but cyber professionals are not receiving the budget they need to deliver on these critical initiatives. Organisations will have to continue being cautious with cyber security spend, identifying those ‘value for money’ areas that will enable them to manage emerging cyber threats with tightened purse strings.”

A recent study by IBM has found that the cost of data breaches is increasing for organizations. On average, organizations that experience a data breach face a cost of $4.45 million, but this can rise to as high as $10.93 million in sectors like healthcare. However, organizations that extensively use AI and automation solutions in their cybersecurity defenses have seen positive results. These companies were able to identify and contain breaches 108 days faster than those without such solutions, resulting in a $1.76 million lower data breach cost.

Despite the potential of AI-driven cybersecurity, it is important not to underestimate the changes needed to fully utilize this technology. AI should not be viewed as a standalone solution but rather as a tool that requires the involvement of human employees. The best implementations of AI technology involve both the tools and the people who use them.

A new study by cybersecurity consultancy S-RM reveals that while 97% of firms plan to increase their use of AI tools, only 53% are confident in securing these tools. The introduction of new tools creates opportunities for criminals if they are not implemented properly. This has led to a shift in how companies view their investments in digital tools. In previous years, around three-in-five respondents believed that technology provided high value for money, but in 2023, less than half agreed with this statement.

When looking at specific areas of technology investment, cybersecurity technologies were seen as high value for money by 49% of respondents, while risk assessments and third-party risk management were seen as high value for money by 42% and 40% respectively. This decline in perceived value reflects a growing awareness that investing in cybersecurity technology also requires investment in governance and personnel to effectively manage it. As a result, firms are increasing their investment in upskilling their teams and hiring skilled personnel to deploy new technology.

However, there is a disconnect between decision-makers and IT professionals when it comes to the value of cybersecurity technology. Only 43% of IT professionals consider it a high value for money investment, compared to 56% of C-Suite executives. This misalignment of expectations suggests that decision-makers may not be fully understanding the effectiveness of new cybersecurity technology.

In conclusion, while cybersecurity budgets are increasing, there is still a need for greater investment to tackle the growing cyber threat. Organizations must be cautious with their cybersecurity spend and identify areas that provide value for money in order to effectively manage emerging cyber threats.

Businesses are increasingly aware that security technology is only as valuable to their goals as the people who use it. While research increasingly touts the potential of AI-driven cybersecurity to boost digital defences, new research shows that almost half of firms spending more on cybersecurity in the coming year will do so to strengthen their human resources.

A recent paper by IBM considered the cost of data breaches. In the end, it estimated an increasing cost for organisations that suffer a data breach, with an average of $4.45 million – but that rose as high as $10.93 million in certain high-impact sectors like healthcare. According to the same study, the use of AI and automation solutions have had a real impact for organisations that use such solutions extensively within their defences. On average those organisations with such solutions in place were able to identify and contain a breach 108-days shorter than those without. These companies also reported a $1.76 million lower data breach cost compared to organisations that didn’t have such capabilities.

However, like any other form of digital transformation from the last decade, there is a risk of underestimating the changes needed to get the best results from AI technology. It is still easy to view AI as a silver-bullet, which will simply render improved results on its own when it comes to shutting out cyber-criminals – but the reality is that the best implementations of the technology are as much about human employees as the tools they use.

Source: S-RM, Cyber Security Insights Report 2023

To that end, a new study from global cybersecurity consultancy S-RM has found that while the average 97% of firms are planning to increase the use of AI tools across the firm – with boosts to cybersecurity including real-time threat detection, and automated risk and compliance – but only 53% are confident that they can secure those tools. With the introduction of new tools comes new opportunities for criminals – especially if the tools are not implemented properly.

This has seen a noted change in the way which companies view their investments in the latest digital tools. S-RM polled 600 c-suite and IT budget holders from organisations in the UK and US with a revenue over $500 million. When asked by S-RM whether they felt technology provided ‘high value for money’, around three-in-five respondents in the hype-driven 2021 and 2022 financial years agreed that it did. In 2023, however, that has fallen to less than half.

Looking deeper at the responses, some areas of technology investment were even less seen as inherently ‘high value for money’. While cybersecurity technologies were described that way by 49% of respondents, that sank to 42% for risk assessments, and 40% for third-party risk management. According to the researchers, this dip in technology’s perceived value likely reflects a growing awareness that investing in cybersecurity, technology also means investing in the governance and personnel to effectively enable and manage it. Supporting this point, S-RM also found that it seems to be a driver of rising investment in the coming year.

Source: S-RM, Cyber Security Insights Report 2023

Cybersecurity budgets grew by 3.1% in 2023, but firms predict an 8% rise in the coming year. When asked what was behind this, around four-in-ten said that they were either aiming to upskill their teams, training them to better deploy new technology, or that they were looking to hire more skilled personnel to do that same. Both those responses were around 10% less popular last year, showing a marked shift in the assumptions around the effectiveness of new cybersecurity technology on its own.

Even so, the decisionmakers determining budget still seem out of step with their staff, suggesting they may not be shifting quickly enough. Only 43% of IT professionals – those deploying technology – cited it as a ‘high value for money’ investment area, compared to 56% of C-Suite business. The difference perhaps reflects a misalignment of expectations between the operators of cyber technologies, and those a step removed from their day-today applications.

Jamie Smith, head of cybersecurity at S-RM, commented, “It’s reassuring that cyber security budgets are still rising in these challenging times, but this level of increase is simply not enough to tackle the growing cyber threat. Navigating ongoing skill shortages and investing in training and development of teams comes at a cost, but cyber professionals are not receiving the budget they need to deliver on these critical initiatives. Organisations will have to continue being cautious with cyber security spend, identifying those ‘value for money’ areas that will enable them to manage emerging cyber threats with tightened purse strings.”

A recent study conducted by IBM has revealed that the cost of data breaches is increasing for organizations. On average, organizations that experience a data breach face a cost of $4.45 million, which can rise to as high as $10.93 million in sectors like healthcare. However, organizations that extensively use AI and automation solutions in their cybersecurity defenses have seen positive results. These organizations were able to identify and contain breaches 108 days faster than those without such solutions, resulting in a $1.76 million lower data breach cost.

Despite the potential benefits of AI-driven cybersecurity, it is important not to underestimate the changes required to achieve optimal results. Many still view AI as a solution that can single-handedly protect against cybercriminals, but the reality is that successful implementation of AI technology depends on human employees as much as the tools themselves.

A new study by cybersecurity consultancy S-RM has found that while 97% of firms plan to increase their use of AI tools for cybersecurity, only 53% are confident in securing these tools. The introduction of new tools presents opportunities for criminals if not implemented properly. This has led to a shift in how companies view their investments in digital tools. In previous years, around three-in-five respondents believed that technology provided high value for money. However, in 2023, less than half of respondents held this view.

The perceived value of technology investment varies across different areas. While 49% of respondents considered cybersecurity technologies to be high value for money, this percentage dropped to 42% for risk assessments and 40% for third-party risk management. This decline likely reflects a growing awareness that investing in cybersecurity technology also requires investment in governance and personnel to effectively manage it. As a result, there is an increasing focus on strengthening human resources in cybersecurity.

Cybersecurity budgets are expected to rise by 8% in the coming year, with many organizations aiming to upskill their teams or hire more skilled personnel to deploy new technology. However, there is a misalignment between decision-makers and IT professionals. Only 43% of IT professionals consider cybersecurity technology to be a high value for money investment, compared to 56% of C-Suite executives. This suggests a disconnect in expectations between those deploying the technology and those overseeing its implementation.

Jamie Smith, head of cybersecurity at S-RM, emphasizes the need for increased cybersecurity budgets to effectively tackle the growing cyber threat. He notes that organizations must be cautious with their spending and identify areas that provide value for money to manage emerging cyber threats within budget constraints.

Businesses are increasingly aware that security technology is only as valuable to their goals as the people who use it. While research increasingly touts the potential of AI-driven cybersecurity to boost digital defences, new research shows that almost half of firms spending more on cybersecurity in the coming year will do so to strengthen their human resources.

A recent paper by IBM considered the cost of data breaches. In the end, it estimated an increasing cost for organisations that suffer a data breach, with an average of $4.45 million – but that rose as high as $10.93 million in certain high-impact sectors like healthcare. According to the same study, the use of AI and automation solutions have had a real impact for organisations that use such solutions extensively within their defences. On average those organisations with such solutions in place were able to identify and contain a breach 108-days shorter than those without. These companies also reported a $1.76 million lower data breach cost compared to organisations that didn’t have such capabilities.

However, like any other form of digital transformation from the last decade, there is a risk of underestimating the changes needed to get the best results from AI technology. It is still easy to view AI as a silver-bullet, which will simply render improved results on its own when it comes to shutting out cyber-criminals – but the reality is that the best implementations of the technology are as much about human employees as the tools they use.

Source: S-RM, Cyber Security Insights Report 2023

To that end, a new study from global cybersecurity consultancy S-RM has found that while the average 97% of firms are planning to increase the use of AI tools across the firm – with boosts to cybersecurity including real-time threat detection, and automated risk and compliance – but only 53% are confident that they can secure those tools. With the introduction of new tools comes new opportunities for criminals – especially if the tools are not implemented properly.

This has seen a noted change in the way which companies view their investments in the latest digital tools. S-RM polled 600 c-suite and IT budget holders from organisations in the UK and US with a revenue over $500 million. When asked by S-RM whether they felt technology provided ‘high value for money’, around three-in-five respondents in the hype-driven 2021 and 2022 financial years agreed that it did. In 2023, however, that has fallen to less than half.

Looking deeper at the responses, some areas of technology investment were even less seen as inherently ‘high value for money’. While cybersecurity technologies were described that way by 49% of respondents, that sank to 42% for risk assessments, and 40% for third-party risk management. According to the researchers, this dip in technology’s perceived value likely reflects a growing awareness that investing in cybersecurity, technology also means investing in the governance and personnel to effectively enable and manage it. Supporting this point, S-RM also found that it seems to be a driver of rising investment in the coming year.

Source: S-RM, Cyber Security Insights Report 2023

Cybersecurity budgets grew by 3.1% in 2023, but firms predict an 8% rise in the coming year. When asked what was behind this, around four-in-ten said that they were either aiming to upskill their teams, training them to better deploy new technology, or that they were looking to hire more skilled personnel to do that same. Both those responses were around 10% less popular last year, showing a marked shift in the assumptions around the effectiveness of new cybersecurity technology on its own.

Even so, the decisionmakers determining budget still seem out of step with their staff, suggesting they may not be shifting quickly enough. Only 43% of IT professionals – those deploying technology – cited it as a ‘high value for money’ investment area, compared to 56% of C-Suite business. The difference perhaps reflects a misalignment of expectations between the operators of cyber technologies, and those a step removed from their day-today applications.

Jamie Smith, head of cybersecurity at S-RM, commented, “It’s reassuring that cyber security budgets are still rising in these challenging times, but this level of increase is simply not enough to tackle the growing cyber threat. Navigating ongoing skill shortages and investing in training and development of teams comes at a cost, but cyber professionals are not receiving the budget they need to deliver on these critical initiatives. Organisations will have to continue being cautious with cyber security spend, identifying those ‘value for money’ areas that will enable them to manage emerging cyber threats with tightened purse strings.”

Businesses are recognizing the importance of human resources in cybersecurity, rather than relying solely on technology. According to a recent study by IBM, the cost of data breaches is increasing, with an average cost of $4.45 million and even higher costs in sectors like healthcare. However, organizations that extensively use AI and automation solutions in their defenses have been able to identify and contain breaches more quickly, resulting in lower breach costs.

Despite the potential of AI technology, it is important not to underestimate the changes needed to achieve optimal results. AI should not be viewed as a standalone solution but rather as a tool that works in conjunction with human employees. A new study by S-RM, a global cybersecurity consultancy, found that while 97% of firms plan to increase their use of AI tools for cybersecurity, only 53% are confident in securing these tools. Implementing new tools improperly can create opportunities for cybercriminals.

S-RM surveyed 600 c-suite and IT budget holders from organizations in the UK and US with a revenue over $500 million. The study revealed that fewer companies view technology investments as providing high value for money. Only 49% of respondents considered cybersecurity technologies as high value for money, while risk assessments and third-party risk management were seen as even less valuable. This shift in perception likely reflects a growing awareness that investing in cybersecurity technology also requires investment in governance and personnel.

Despite the growing awareness, decision-makers determining budgets may not be shifting quickly enough. Only 43% of IT professionals viewed technology as a high value for money investment area, compared to 56% of C-Suite executives. This misalignment of expectations highlights the need for better communication and understanding between those deploying cyber technologies and those overseeing their implementation.

In response to the changing landscape, cybersecurity budgets are predicted to increase by 8% in the coming year. Many organizations are focusing on upskilling their teams and hiring more skilled personnel to effectively deploy new technology. However, there is still a need for increased budget allocation to support these critical initiatives and manage emerging cyber threats effectively. Organizations must carefully consider areas that provide value for money to make the most of their cybersecurity spend.

A Stornoway councillor has voiced concerns that the cyber attack on the Comhairle’s IT systems in early November, which left the system inaccessible, could mean the loss of 30 years of archive and historical document digitisation work by the authority’s museums and libraries.

Stornoway South councillor Cllr Frances Murray raised the issue at a meeting of the Comhairle’s Education, Sport and Children’s Services Committee on Tuesday. 

A spokesperson for the Comhairle said: “The interim results of the forensic investigation following the cyber-attack on Tuesday, November 7, has established that data stored on Comhairle nan Eilean Siar’s operational and backup servers cannot be accessed. 

“There is currently no indication that any data has been extracted from the server or published. 

“The Comhairle is working with Police Scotland, Scottish Government and the National Cyber Security Centre to establish the impact of this incident. This is an ongoing investigation into a criminal act.”

Follow STV News on WhatsApp

Scan the QR code on your mobile device for all the latest news from around the country

A councillor in Stornoway has expressed concerns about the recent cyber attack on the IT systems of Comhairle nan Eilean Siar, the local authority for the Western Isles. The attack, which occurred in early November, resulted in the system becoming inaccessible. The councillor, Cllr Frances Murray, raised the issue at a meeting of the Comhairle's Education, Sport and Children's Services Committee.

According to a spokesperson for the Comhairle, the interim results of the forensic investigation into the cyber attack have revealed that the data stored on the authority's operational and backup servers cannot be accessed. However, there is currently no evidence to suggest that any data has been extracted from the server or published.

The Comhairle is working with Police Scotland, the Scottish Government, and the National Cyber Security Centre to determine the impact of the incident. This ongoing investigation is focused on identifying and addressing the criminal act behind the cyber attack.

The concern raised by Cllr Frances Murray is that the cyber attack could result in the loss of 30 years' worth of archive and historical document digitization work carried out by the authority's museums and libraries. The full extent of this potential loss is yet to be determined.

Paul Evans at Nozomi Networks outlines the key cyber-security priorities for manufacturing companies

In 2023, the manufacturing industry will continue to experience challenges around rising energy costs, labour issues, supply chain delays and disruptions, affecting its ability to maintain adequate levels of production and quality.

Despite grim economic predictions, manufacturers must continue to keep pace by adopting new technologies that come with the next phase of the industrial revolution, accelerating innovation, improving efficiency, and increasing customer value.

However, while Industry 4.0 has its benefits, from increased automation, process improvements and new levels of efficiencies, it exposes critical operational technology (OT) to security vulnerabilities, presenting new windows of opportunity for cyber-criminals. 

Low visibility across manufacturing environments

According to a report, 42% of UK manufacturers have been a victim of cyber-crime in 2022. With cyber-threats against industrial manufacturing rapidly escalating as more and more connected systems create larger attack surfaces, the manufacturing industry remains one of the most cyber-vulnerable sectors.

These cyber-security issues and lack of system visibility are slowing down the introduction of new technologies, hampering potential productivity gains and holding companies back from growth.

Production security and operational resilience go hand in hand: both are essential for the overall risk management. So how can manufacturers best manage new technology adoptions while ensuring business continuity when they don’t have full visibility into their OT environments?  

Challenges posed by Industrial Control Systems

The majority of large manufacturing facilities typically have a significant presence of brownfield sites and legacy plants, with a set of outdated Industrial Control System (ICS) assets and new IoT devices – both difficult to secure.

Traditional ICS devices usually have long life cycles and are custom-built, stand-alone systems, designed to be reliable, rather than secure. They often run scaled-down versions of operating systems, communicating via proprietary or industrial protocols that lack safety features. In addition, they are often sensitive to changes in network traffic or firmware, making many IT security tools unsafe to use.

Traditionally, ICS security was not as a critical consideration because OT networks were designed to be isolated, running less-known industrial protocols and custom software. Those systems had limited exposure, whereas, today, OT environments have converged and are often no longer air-gapped from IT networks.

At the same time, millions of IoT devices are being added to production networks to reduce costs and provide greater value to customers. Like legacy ICS devices, many IoT devices have lightweight, low-key operating systems that lack common security features. Their firmware is rarely updated, and they are found connected to other systems becoming an easy target for threat actors.

These inherent characteristics of manufacturing systems and facilities make them difficult to protect and require specialized know-how and technology in OT/IoT security and visibility to reduce risks. 

ICS and OT-specific malware such as Industroyer and Incontroller are evidence of the increasingly sophisticated capabilities that attackers have begun to deploy in attacking ICS and OT systems, resulting in many serious incidents.

The way forward: to take over, detect and respond

Visibility and asset management lay the foundation for network security. As we know, you cannot protect what you cannot see so manufacturers must ensure higher levels of visibility over all connected devices on their networks. 

So how can manufacturers see in detail the resources of their OT environment, which devices are actively communicating and what protocols they are using? 

One way to improve cyber-resilience is by having real-time situational awareness of OT networks, including visibility into assets, connections, communications, protocols, and more. The good news is that companies can automate asset inventory for manufacturing plants, eliminate blind spots, and reveal items that may have been previously overlooked.

Such a solution requires a large depth and breadth of protocol support, including accurate analysis of ICS protocols. In addition, it must support IoT protocols and current profiles of millions of devices for detailed asset identification and anomaly reporting.

The goal would be to have maximum and accurate coverage of all OT, IoT and IT assets from all systems, regardless of their generation, vendor or function, possibly with an easily scalable solution to monitor an unlimited number of resources and networks in numerous production facilities.

Further steps to minimize the risks 

The next step, once the company has excellent visibility, is risk reduction. This requires real-time detection of vulnerabilities, threats and anomalies in both decommissioned and active plants. It includes process insights that highlight risks to reliability, such as equipment failure, unusual variables, and changes in network communications.

It is also necessary to know how to react to alerts and reports that signal the presence of a problem. A system that prioritizes risk, with actionable intelligence and remediation playbooks, helps to keep every facility safer in an efficient and systematic way.

And if problematic network changes need to be analyzed over time or require rapid incident response performance, robust forensics and the availability of effective query tools accelerate repair. For manufacturers, this translates into maximized uptime, consistent product quality and production volumes.

The inherent characteristics of manufacturing facilities make them vulnerable to cyber-attacks. As traditional ICS security measures become insufficient in the era of converged OT environments and added IoT devices, specialised knowledge and technology in OT/IoT security and visibility are necessary to mitigate risks. 

The good news is that manufacturing companies are aware of the threat and have started putting their cyber-security first. In fact, cyber-security is already an urgent priority for 63% of UK manufacturers, with almost half (43%) investing in security, firewalls and anti-virus precautions. 

It is crucial for manufacturing companies to make the key next step and prioritise the visibility of their OT environment, investing in effective security solutions to protect their assets, employees, and customers.

Paul Evans is a cyber-security evangelist at Nozomi Networks

Main image courtesy of iStockPhoto.com

The manufacturing industry is facing various challenges, including rising energy costs, labor issues, supply chain disruptions, and delays. These challenges can impact production levels and quality. Despite these difficulties, manufacturers must embrace new technologies to stay competitive and drive innovation.

However, the adoption of Industry 4.0 technologies also brings cybersecurity risks. As more connected systems are introduced, the manufacturing industry becomes increasingly vulnerable to cyber threats. In fact, a report reveals that 42% of UK manufacturers have experienced cybercrime in 2022, highlighting the urgent need for cybersecurity measures in the sector.

One of the main challenges in securing manufacturing environments is the lack of visibility. Many manufacturing facilities have a mix of outdated Industrial Control System (ICS) assets and new Internet of Things (IoT) devices, both of which are difficult to secure. Traditional ICS devices were designed for reliability rather than security and often lack safety features. Additionally, they communicate using proprietary or industrial protocols that are not compatible with standard IT security tools. With the convergence of operational technology (OT) and IT networks, these systems are now exposed to more risks.

IoT devices also pose security challenges. They often have lightweight operating systems that lack common security features, and their firmware is rarely updated. As a result, they become easy targets for cybercriminals.

To address these challenges, manufacturers need to prioritize visibility and asset management in their OT environments. Real-time situational awareness of OT networks, including assets, connections, communications, and protocols, is crucial for effective cybersecurity. Automated asset inventory can help eliminate blind spots and identify overlooked devices.

Manufacturers should also focus on risk reduction by detecting vulnerabilities, threats, and anomalies in their plants. Real-time monitoring and actionable intelligence can help prioritize risks and enable efficient incident response. Robust forensics and query tools are essential for analyzing network changes and accelerating repairs.

It is encouraging to see that many manufacturing companies are already prioritizing cybersecurity. A significant number of UK manufacturers have made cybersecurity an urgent priority and are investing in security measures. However, it is crucial for manufacturers to prioritize visibility and invest in effective security solutions to protect their assets, employees, and customers.

In conclusion, the manufacturing industry faces cybersecurity challenges due to the adoption of new technologies. The lack of visibility and the presence of legacy systems and IoT devices make securing manufacturing environments difficult. However, by prioritizing visibility, asset management, and risk reduction, manufacturers can mitigate cybersecurity risks and ensure business continuity.