May 23, 2018 By Shane Schick 2 min read

Eighty-five percent of security professionals believe cybersecurity threats will lead to an attack on major critical infrastructure over the next five years, according to a recent survey. The annual Pwnie Express study, The Internet of Evil Things, polled approximately 500 security professionals about a range of cybersecurity threats, including malware and devices connected as part of the Internet of Things (IoT).

Cybersecurity vs. Online Evil

The research looked at the variety of industry sectors that might be least prepared for an attack. Health care topped the list at 51 percent — but was followed closely by the waste and wastewater sectors (47 percent) and the energy sector (43 percent).

Security professionals may be predicting major attacks on critical infrastructure because they’re already dealing with so many issues in their own organizations. Malware attacks affected 59 percent of those polled, for example. Additionally, 32 percent were impacted by ransomware. More serious cybersecurity threats — specifically distributed denial of service (DDoS) attacks — struck 30 percent.

Security Professionals Still Lack the Right Tools

Perhaps more worryingly, security professionals suggested they aren’t necessarily strengthening their defenses — even after grappling directly with some of the most serious cybersecurity threats. While WannaCry affected 21 percent of those surveyed, for instance, approximately 18 percent said they still lack the tools to deal with the ransomware cryptoworm. Fourteen percent weren’t sure one way or the other. There were similar findings about other well-known malware and ransomware strains, including NotPetya, Locky and Mirai.

The gaps between the risks and the capability to deal with them weren’t limited to specific malware — it spread to entire areas of data protection. While a majority of 80 percent said they are concerned about cybersecurity threats as a result of bring-your-own-device (BYOD) policies in the workplace, less than half said they had real-time monitoring tools for personal devices.

About the same percentage said they were worried about the risk inherent in IoT-connected smart devices, but only 23 percent claimed to be keeping track of such devices effectively. Overall, while 64 percent said they are more concerned about the security of connected devices than they were last year, the authors said there was no improvement in the frequency at which they’re checking them.

More from

Regulatory harmonization in OT-critical infrastructure faces hurdles

3 min read - In an effort to enhance cyber resilience across critical infrastructure, the Office of the National Cyber Director (ONCD) has recently released a summary of feedback from its 2023 Cybersecurity Regulatory Harmonization Request for Information (RFI). The responses reveal major concerns from critical infrastructure industries related to operational technology (OT), such as energy, transport and manufacturing. Their worries include the current fragmented regulatory landscape and difficulty adapting to new cyber regulations. The frustration appears to be unanimous. Meanwhile, the magnitude of…

Generative AI security requires a solid framework

4 min read - How many companies intentionally refuse to use AI to get their work done faster and more efficiently? Probably none: the advantages of AI are too great to deny.The benefits AI models offer to organizations are undeniable, especially for optimizing critical operations and outputs. However, generative AI also comes with risk. According to the IBM Institute for Business Value, 96% of executives say adopting generative AI makes a security breach likely in their organization within the next three years.CISA Director Jen…

Q&A with Valentina Palmiotti, aka chompie

4 min read - The Pwn2Own computer hacking contest has been around since 2007, and during that time, there has never been a female to score a full win — until now.This milestone was reached at Pwn2Own 2024 in Vancouver, where two women, Valentina Palmiotti and Emma Kirkpatrick, each secured full wins by exploiting kernel vulnerabilities in Microsoft Windows 11. Prior to this year, only Amy Burnett and Alisa Esage had competed in the contest's 17-year history, with Esage achieving a partial win in…

Topic updates

Get email updates and stay ahead of the latest threats to the security landscape, thought leadership and research.
Subscribe today