July 20, 2015
Information technology (IT) executives within critical infrastructure organizations see a need for public-private threat intelligence sharing partnerships (86% of respondents) to keep pace with escalating cybersecurity threats, according to a survey released today by The Aspen Institute and Intel Security.
A majority (76%) of survey respondents also indicated they believe a national defense force should respond when a cyber attack damages a critical infrastructure company within national borders. Additionally, although most respondents agree that threats to their organizations are on the rise, they maintain a high degree of confidence in existing security.
The survey, Holding the Line Against Cyber Threats: Critical Infrastructure Readiness Report, reveals that the critical infrastructure providers surveyed are pleased with the results of their efforts to improve cybersecurity over the last three years, but at the same time many (72%) said that the threat level of attacks was escalating. Almost half of all respondents (48%) believe it is likely that a cyberattack on critical infrastructure, with the potential to result in the loss of human life, could happen within the next three years.
“This data raises new and vital questions about how public and private interests can best join forces to mitigate and defend against cyberattacks,” said Clark Kent Ervin, a director with the Aspen Institute, an educational and policy studies organization based in Washington, D.C. “This issue must be addressed by policymakers and corporate leaders alike.”
Survey results suggest there may be a disconnect between critical infrastructure providers and the current threat landscape:
Perceived Improvements: Respondents believe their own vulnerability to cyberattacks has decreased over the last three years. When asked to evaluate their security posture in retrospect, 50% reported that they would have considered their organizations “very or extremely” vulnerable three years ago; by comparison, only 27% believe that their organizations are currently “very or extremely” vulnerable.
Government Involvement Encouraged: Private industry is often hesitant when it comes to government’s involvement in private sector business; however, 86% of respondents believe that cooperation between the public and private sectors on infrastructure protection is critical to successful cyber defense. Furthermore, 68% of respondents believe their own government can be a valuable and respectful partner in cybersecurity.
Confidence in Current Solutions: 64% believe an attack resulting in fatalities has not happened yet because good IT security is already in place. Correspondingly, more than four in five are satisfied or extremely satisfied with the performance of their own security tools such as endpoint protection (84%), network firewalls (84%), and secure web gateways (85%).
Disruptions Increasing: More than 70% of respondents think the cybersecurity threat level in their organization is escalating. Around nine in 10 (89%) of respondents experienced at least one attack on a system within their organization, which they deemed secure, over the past three years, with a median of close to 20 attacks per year
The survey, conducted by Vanson Bourne, interviewed 625 IT decision makers with influence over their organization’s security solutions in France, Germany, the United Kingdom and the United States (250 interviews in the U.S. and 125 in each of the UK, France and Germany).
Respondents were from private and public organizations (minimum of 500 employees), with particular focus on the critical infrastructure sectors of energy (139 respondents), transport (130 respondents), finance (159 respondents) and government (128).