The UK's critical infrastructure is vulnerable to DDoS attacks due to failure to carry out basic security defence work - 39 percent of respondents to a recent survey had not completed the government's '10 Steps to Cyber Security' programme, which was first issued in 2012.
New data was obtained by Corero Network Security under the Freedom of Information Act surveying 338 critical infrastructure organisations in the UK, including fire and rescue services, police forces, ambulance trusts, NHS trusts, energy suppliers and transport organisations; it also showed that 42 percent of NHS Trusts had not completed the programme.
More than half (51 percent) of these critical infrastructure organisations were described by Corero as ignoring the risk of short, stealth DDoS attacks on their networks – which typically account for around 90 percent of DDoS attacks and are used by attackers to plant malware or ransomware, or engage in data theft. Corero reports that these stealth attacks are typically less than 30 minutes in duration, and 98 percent of those stopped by the company were less than 10Gbps in volume, hence they often go unnoticed by security staff, but are frequently used by attackers in their efforts to target, map and infiltrate a network.
In a statement issued today, Sean Newman, director of product panagement at Corero, comments: “Cyber-attacks against national infrastructure have the potential to inflict significant, real-life disruption and prevent access to critical services that are vital to the functioning of our economy and society. These findings suggest that many such organisations are not as cyber resilient as they should be, in the face of growing and sophisticated cyber threats.”
Newman adds, “ By not detecting and investigating these short, surgical, DDoS attacks on their networks, infrastructure organisations could also be leaving their doors wide-open for malware or ransomware attacks, data theft or more serious cyber attacks.”
It was also pointed out that in the event of a breach, these organisations could be liable for fines of up to £17 million, or four percent of global turnover, under the UK government's proposals to implement the EU's Network and Information Systems (NIS) directive, from May 2018.
In an email to SC, David Emm, principal security researcher, Kaspersky Lab observed, “The world isn't ready for cyber -threats against critical infrastructure – but criminals are clearly ready and able to launch attacks on these facilities. We've seen attempts on power grids, oil refineries, steel plants, financial infrastructure, seaports and hospitals – and these are cases where organisations have spotted attacks and acknowledged them. However, many more companies do neither, and the lack of reporting these incidents hampers risk assessment and response to the threat.”