Oil and Gas companies in charge of critical infrastructure in the UK could be targeted by a “crippling” cyber-attack within the next two years, according to a security chief.
In an interview with the Guardian, the head of the National Cyber Security Centre Ciaran Martin said the UK has been fortunate to avoid a category one (C1) attack, and it is a matter of “when, not if” such an incident occurs.
A C1 attack is one that might cripple key infrastructure such as energy supplies.
Kevin Bocek, chief cyber-security strategist at Venafi, echoed Mr Martin’s comments.
“It’s only a matter of time until the UK suffers a crippling attack. Adversaries have already tried to manipulate elections and target critical infrastructure in Europe and US.
“Escalation of hostilities – whether criminal or by nations – is one of the most basic rules of human history. Much of the reason the UK is so vulnerable is that many organisations – both in the public and private sectors – are simply bad at doing the basics right.
“With security teams being pulled from pillar to post by constant attacks, they don’t have the time to take care of a number of key precaution.
“It’s precisely these oversights which can let attackers in.”
An increased rate of attacks brought the issue to the fore last year, when consultants Deloitte published research showing oil and gas companies are particularly prone to cyber security risks.
Mr Bocek added that the defences most organisations have in place are useless against this new set of attacks involving machines and encryptions.
“Last year around 40% of attacks came through encrypted traffic, a figure that would be unthinkable if organisations had a proper grip of what machines encrypting communications should be trusted or not.
“It’s these failures to sort out cyber-security basics which make Martin’s prediction of a C1 level attack within the next 2 years all the more likely to come true.
“What’s more, given that many of these issues can be automated, fixing the problem doesn’t even involve taking analysts away from tackling live threats.
“Martin’s warning should be a reminder for all organisations, particularly those responsible for our critical infrastructure, to get a handle on these processes immediately – otherwise they are simply laying out the red carpet for those who want to do us harm.”
Recommended for you
