Dive Brief:
- Cybersecurity incidents involving building systems and other operational technology are on the rise, yet few organizations are ready to deal with an incident or have even completed an inventory of their vulnerable assets, according to a survey by Honeywell Technologies.
- The average downtime reported was 16.2 hours for respondents’ most significant cybersecurity incidents involving operational technology, with 21% of incident-affected respondents estimating downtime costs above $100,000 per hour, according to the survey of 603 cybersecurity leaders, compliance and risk executives and plant and operations managers conducted earlier this year.
- Legacy or unsupported systems are the most common source of cyber risk exposure, with 45% of those affected by incidents ranking legacy systems as a top contributor to downtime, per the report.
Dive Insight:
“OT environments increasingly intersect with systems that control physical processes, support facility operations and protect people and assets,” Honeywell says in the report. These systems include field devices and controllers, safety systems, HVAC and chillers, switchgears, elevators and fire panels, physical security systems, building management systems and connected IoT devices.
Downtime is the most common consequence of cyber incidents, with over half of respondents reporting operational downtime and production disruption. Cyber incidents can also affect worker safety, disrupt service and create compliance pressure, the report says.
“When critical systems go down, production can stop and safety can be compromised. Lost revenue may follow,” Honeywell says in the report. “OT security maturity is ultimately measured by whether organizations understand their attack surface, limit incident impact and restore operations quickly.”
Many building systems are vulnerable due to equipment operating under legacy BACnet standards. The standard was introduced in the 1990s without security protocols because the systems weren’t network-connected at the time, according to cybersecurity firm Armis from ServiceNow. Patches for vulnerabilities are slow to be implemented at many organizations because of the systems’ crucial role in building operations.
“Critical infrastructure cannot simply be taken offline,” Armis said in a recent report. “The remediation backlog grows faster than teams can clear it.”
Mature OT cybersecurity programs must identify these at-risk building systems, bring them into the security scope, monitor and govern them and prepare to recover them if they are breached, Honeywell says.
Yet only 16% of respondents say their organizations continuously monitor more than three-quarters of their building automation systems, with only 20% doing so for connected IoT devices.
While most organizations have some level of OT security maturity, with 88% of respondents describing their OT security programs as planned or design-led and 80% citing strong coordination between IT and OT teams, only 33% say OT is fully integrated into an enterprise security operations center, according to the report. And only 21% have a complete asset inventory, which Honeywell says is essential for effective monitoring, detection and recovery.
Honeywell says organizations need to know which aging or unsupported assets are connected across production, building, and IoT environments, noting that legacy risk cannot be managed if operators can't see aging assets.
“A complete, continuously updated inventory is the starting point,” the Honeywell report says. “Segmentation, continuous monitoring and recovery planning help keep those systems from becoming a persistent source of exposure.”
Organizations should conduct compliance audits, which are shown to help with recovery in the event of a cyber incident, per the report. Forty-four percent of respondents whose organizations passed all audits say they are “fully recovery-ready,” compared with just 26% of those whose organizations had audit failures or findings.
Tested backups, documented response programs and clear ownership are useful as audit evidence and also support restoration under pressure, Honeywell says.
