McAfee Report Authored by CSIS Finds that 40 Percent of Critical Infrastructure Organizations Expect Major Attacks in Next 12 Months
Recent High Profile Cyberattacks Revealed by Google Underscore Risk to Critical Infrastructure
DAVOS, Switzerland–WORLD ECONOMIC FORUM ANNUAL MEETING â McAfee, Inc. (NYSE:MFE) today revealed the staggering cost and impact of cyberattacks on critical infrastructure such as electrical grids, oil and gas production, telecommunications and transportation networks. A survey of 600 IT security executives from critical infrastructure enterprises worldwide showed that more than half (54%) have already suffered large scale attacks or stealthy infiltrations from organized crime gangs, terrorists or nation-states. The average estimated cost of downtime associated with a major incident is $6.3 million per day.
The report âIn the Crossfire: Critical Infrastructure in the Age of Cyberwarâ, commissioned by McAfee and authored by the Center for Strategic and International Studies (CSIS), also found that the risk of cyberattack is rising. Despite a growing body of legislation and regulation, more than a third of IT executives (37%) said the vulnerability of their sector had increased over the past 12 months and two-fifths expect a major security incident in their sector within the next year. Only 20% think their sector is safe from serious cyberattack over the next five years.
Many of the worldâs critical infrastructures were built for reliability and availability, not for security. Traditionally, these organizations have had little to no cyber protection, and have relied on guards, gates and guns. Today however, computer networks are interconnected with corporate IT networks and other infrastructure networks, which are accessible from anywhere in the world.
âIn todayâs economic climate, it is imperative that organizations prepare for the instability that cyber attacks on critical infrastructure can cause,â said Dave DeWalt, president and chief executive officer of McAfee. âFrom public transportation, to energy to telecommunications, these are the systems we depend on every day. An attack on any of these industries could cause widespread economic disruptions, environmental disasters, loss of property and even loss of life.â
âThe recently identified Operation Aurora was the largest and most sophisticated cyberattack targeted at specific corporations, but it could have just as easily targeted the worldâs critical infrastructure,â continued DeWalt. âThe attack announced by Google and identified by McAfee was the most sophisticated threat seen in years making it a watershed moment in cybersecurity because of the targeted and coordinated nature of the attack.â
Other key report findings:
* Low confidence in preparedness: More than a third of those surveyed believe their sector is unprepared to deal with major attacks or stealthy infiltrations by high-level adversaries. Saudi Arabia, India and Mexico emerge as the least confident.
* Recession-driven cuts raising the risk: Two thirds of IT executives surveyed claimed that the current economic climate has caused cutbacks in the security resources available; one in four said resources had been reduced by 15% or more. Cuts are particularly evident in the energy and oil/gas sector.
* Government involvement in cyberattacks: 60% of those surveyed believe representatives of foreign governments have been involved in past infrastructure infiltrations. In terms of countries that posed the biggest threat to critical infrastructure security, the United States (36%) and China (33%) topped the list.
* Laws ineffective in protecting against potential attacks: More than half (55%) believe that the laws in their country are inadequate in deterring potential cyberattacks with those based in Russia, Mexico and Brazil the most sceptical; 45% donât believe that the authorities are capable of preventing or deterring attacks.
* Insurance firms bearing brunt of cyberattack costs: More than half of those surveyed expected insurance to pick up the cost of a cyberattack while nearly one in five said it would fall on rate-payers or customers. Just over a quarter expected a government bail-out.
âGovernance issues are at the center of any discussion of security for critical infrastructure,â said Stewart Baker distinguished visiting fellow at CSIS and Lawyer at Steptoe and Johnson. âThe relationships between the governments and private sector organisations involved are complex but it is essential that each have faith in the others ability. The security industry will always strive to stay one step ahead, but in the absence of any technological silver bullet, regulation has a role to play in defending critical infrastructures around the world.â
The McAfee âIn the Crossfire: Critical Infrastructure in the Age of Cyberwarâ report is available for download at www.mcafee.com.
To learn more about the research findings and opinions, please visit the McAfee Security Insights blog at siblog.mcafee.com.
About the report:
McAfee commissioned Vanson Bourne, a specialist research-based technology marketing consultancy, to survey more than 600 people responsible for IT or security in critical infrastructure enterprises across seven sectors in 14 countries across the globe (US, UK, Japan, China, Germany, France, Italy, Russia, Spain, Brazil, Mexico, Australia and Saudi Arabia).
The Centre for Strategic and International Studies (CSIS) then analyzed the quantitative results, conducted additional qualitative research and authored the report.
About McAfee, Inc.
McAfee, Inc., headquartered in Santa Clara, California, is the worldâs largest dedicated security technology company. McAfee is committed to relentlessly tackling the worldâs toughest security challenges. The company delivers proactive and proven solutions and services that help secure systems and networks around the world, allowing users to safely connect to the Internet, browse and shop the web more securely. Backed by an award-winning research team, McAfee creates innovative products that empower home users, businesses, the public sector and service providers by enabling them to prove compliance with regulations, protect data, prevent disruptions, identify vulnerabilities, and continuously monitor and improve their security. http://www.mcafee.com
About CSIS
The Center for Strategic and International Studies (CSIS) is a bipartisan, non-profit organization founded in 1962 and headquartered in Washington, D.C. It seeks to advance global security and prosperity by providing strategic insights and policy solutions to decision makers.
NOTE: McAfee is a registered trademark of McAfee, Inc. or its subsidiaries in the United States and other countries. Other marks may be claimed as the property of others. The product plans, specifications and descriptions herein are provided for information only and subject to change without notice, and are provided without warranty of any kind, express or implied.
