The COVID-19 crisis is forcing companies across the globe to experiment massively with having their employees work from home, and it is also pushing companies to accelerate the pace of their digital transformations. At the same time, we also see companies that are moving part of their industrial supervision and maintenance into the homes of their operational staff. For example, machine manufacturers are reducing their in-field maintenance by implementing remote maintenance procedures. Some infrastructure owners are connecting their OT infrastructure to corporate IT networks to enable remote supervision and are implementing procedures to reduce control room staffing and rotate their workforce more rapidly. This is accelerating IT/OT convergence and is speeding up the need for Industrial IoT technology and the implementation of a holistic cyber security posture that includes the home.
Earlier this month, the University Hospital in Brno, Czech Republic, was forced to shut down its operations and move COVID-19 patients to other hospitals. In addition, the Illinois Public Health Agency's website became victim of ransomware; which demonstrates that cyber criminals aren’t hesitating to abuse the current situation and attack targets that are critical to managing the COVID-19 crisis.
We expect that over time the sophistication of these attacks will increase, targeting user and admin credentials that expose access to IT infrastructures, and ultimately to connected OT systems. With the massive increase in working from home, criminals can easily hide their activities among the vast amount of VPN connections to corporate infrastructure. Therefore, ramping up on cyber security controls and increasing monitoring capabilities becomes essential.
In late March, the International Energy Agency (IEA) published a note to underline the importance of our critical infrastructure during the era of COVID-19. Indeed, as people stock up on food and toilet paper to prepare for a potentially extended period of self-quarantine, it is impossible to ignore the importance of utilities like electricity, gas and the water supply. People need these critical services to be able to cook, heat their homes, use their fridges and washing machines and indeed to be able to work from home.
We also see an increasing dependence on digital technologies to keep that critical infrastructure running. Power network management is heavily dependent on measurement data and substation automation to ensure grid stability. Keeping this operational becomes increasingly challenging with system operators that have their workforce working from home or with a reduced workforce as employees fall ill.
This is where security technology companies such as the Kudelski Group play an important role. We are developing Industrial IoT cyber security technologies and are integrating these into systems to make them more cyber resilient. We protect infrastructure and enable remote operation use-cases such as predictive maintenance, remote maintenance, and remote control. The company is also participating in several organizations that are striving to improve the cyber resilience of critical infrastructure, such as the World Economic Forum, the European Energy ISAC and the International Energy Agency. And lastly, the Kudelski Group is a global provider of enterprise cybersecurity services, providing the monitoring, threat hunting, and incident response services for the networks of some of the world’s largest corporations.
The need for cyber resilience was already high on the agenda even before the COVID-19 crisis. Before summer 2020, the World Economic Forum group on cyber resilience for the Electrical Energy market will publish advisory reports, the IEA plans to publish recommendations later this year and work together with regulators across the globe to implement appropriate measure. The European Commission (DG Energy) will publish requirements and recommendations towards the end of the year.
Implementing recommended measures to improve cyber security posture must remain a top priority for infrastructure owners as the threat landscape increases. They must implement a holistic approach of cyber resilience implementing security controls as suggested by the NIST cyber security framework; from defensive technology to detection and response measures. To support this, vendors must integrate the necessary technology and work with regulators and industry experts.
The Kudelski Group is a trusted security partner to both the manufacturers of connected equipment for critical infrastructure as well as those who operate it. We provide robust protections across the entire value chain and have done so successfully for more than 30 years, protecting billions of dollars in annual client revenue and ensuring the continuity of high-value business models and infrastructures. We do this by providing:
