Cyber threats on the rise in South Africa
Increasingly, companies are looking to adopt smart technologies to optimise production and decision-making in order to create businesses of the future. However, as reliance on autonomous and digital technology grows, so too does the risk of cyber-attacks, says professional services firm PwC.
As technologies become more interconnected, the potential cybersecurity threats and attack vectors are growing. The consequences of these threats can be severe, resulting in production and revenue losses, regulatory fines, reputational damage, as well as the shutdown of critical infrastructures.
This has been further compounded by the complexities and uptake of smart systems that use advanced technologies such as machine learning and the Internet of Things (IoT).
Termed ‘Smart Manufacturing/Smart Mining’, South African industry leaders recognise that the terms encompass everything from Artificial Intelligence (AI) to robotics and cyber-security.
PwC said it has issued a point of view on emerging cyber threats in the mining and manufacturing industries. The document focuses on emerging cyber threats affecting these sectors, with a focus on South African and other Africa-based organisations.
Although there are considerable benefits in the convergence of these advanced technological systems and the operational technology that makes up the backbone of the sectors, it is important to note that the reliance on such connected and internet-dependent systems is not without its own risks, PwC pointed out.
Junaid Amra, PwC Forensics Technology Solutions Leader said: “Organisations in the manufacturing and mining sectors face a myriad of different cyber threats. A number of organisations have not been paying enough attention to these threats. They are also not prioritising the implementation of the appropriate mitigation strategies, whilst threat actors are starting to take an interest in organisations operating in this space.
Due to the increasing level of technology adoption, the consequences of attacks on organisations in these sectors can be far-reaching and potentially devastating. It is therefore important for businesses to understand key risk areas, attack vectors and vulnerabilities to ensure that they employ the correct controls to improve security and protect their assets.”
The technologies most targeted by attackers within these sectors are Industrial Control Systems (ICS). ICS are embedded computing devices that are responsible for a myriad of automated process controls in industries (e.g., measuring instruments, packaging machinery and all other components of an assembly line that make parts of any production process.
“The Covid-19 pandemic has further exacerbated the problem of cyber-attacks. According to international research, there was an uptake in intrusion activity in the manufacturing sector in 2020, as well as several cybersecurity incidents in some country’s mining and resources sectors,” said Amra.
PwC’s paper highlights the different threats to ICS technologies and the profiles of the actors perpetrating these attacks. It also focuses on notable incidents to help demonstrate the complexity and subsequent impact of ICS attacks.
Attacker tactics, techniques and procedures
PwC’s global Threat Intelligence practice recognises four types of motivations driving attackers, namely espionage, hacktivism, terrorism/sabotage and organised crime. There are also a range of different tactics, techniques and procedures used by each attacker.
This not only determines the impact of each attack but also the means by which organisations get targeted and subsequently compromised. It is also notable that insiders can be part of any threat group, PwC said.
Organisations who are mindful that a security breach can take several different forms and originate from several different places are in a better position to imagine ways of implementing the correct defences.
It is important to note that local regulator stipulations and disclosure laws play a major role in the number of incidents that are reported and, as a by-product, known to the public.
Motivation
Espionage has been growing as one of the driving forces behind cyber-attacks in the manufacturing industry. Cyber-criminals gain access to the networks of businesses in the sectors with the aim of stealing trade secrets and intellectual property.
However, our research revealed that although in 2020 there was a notable uptick of espionage-motivated incidents as compared to the same period last year, most of the attacks have predominantly been financially motivated (63-95%).
“We have also drawn on our experience conducting cyber-security assessments and penetration tests from across our global network to identify the most common security vulnerabilities in OT/ICS networks.
“The most common attacks identified by PwC’s incident response teams over 2019 and 2020 were: infiltration of insecure email platforms following cloud adoption; phishing; and insecure remote access platforms (VPN, remote login), PwC said.
Ransomware
Once attackers have a foothold in an organisation, the tools and tactics used by them are usually designed to monetise their attacks by the simplest means possible. An example is ransomware, which is a type of malicious software (malware) that holds your systems or data to ransom.
Globally, PwC has tracked ransomware attacks across various industries for 2020. Of these, 17% affected the manufacturing sector but no data appears to have been advertised from the mining sector.
“Based on our experience, the nature of attacks in the mining sector have largely been focused on electronic payment fraud, industrial espionage and sabotage. Data available for the African continent is limited, however, we believe this to be a representation of how susceptible African organisations in the sectors are to these types of attacks,” PwC said.
Potential impact
Cyber-attacks are becoming more pronounced as technology is embedded in operational processes. Apart from the loss of data and intellectual property, the risk to the core business operations becomes heightened and could lead to severe disruption through cyber-attacks.
In addition, safety, health, environmental and quality (SHEQ) systems could also be affected as there is a growing dependence on smart devices to support these processes and functions.
“Organisations in the mining and manufacturing sectors need to embed a safety culture against potential cyber-attacks – organisations should have plans and processes in place to prevent, respond and recover from a potential cyber-attack. The likelihood and consequences of a cyber-attack should not be downplayed,” said Amra.
Article by businesstech.co.za photo by Markus Spiske via unsplash.com