Another good post, thanks for sharing your summary thoughts on the WEF survey. I think cybersecurity inequality is rightfully getting a lot more attention, and hopefully soon more action. In the critical infrastructure space this is especially critical. Small municipalities, small hydro and water treatment facilities, and similar entities are often not just understaffed, but have no cybersecurity staff at all, or maybe one person.
I agree. There are a lot of moving parts in this, to put it mildly. Breaking it down by states sounds promising - but of course so much of it comes to human and financial resources. And then there are other pain points like how much will a small entity be willing to share in order to get help that's needed.
The cost of upgrades for OT are a big factor. It’s logical for smaller entities to accept the risk than to pay the crippling cost of equipment upgrades.
True, but there are almost always things that can be done to improve security without major hardware or software upgrades. And organizations like CISA need to figure out how to help smaller entities, even with costs of equipment if they want to keep to their goal of making all of our critical infrastructure secure.
Another good post, thanks for sharing your summary thoughts on the WEF survey. I think cybersecurity inequality is rightfully getting a lot more attention, and hopefully soon more action. In the critical infrastructure space this is especially critical. Small municipalities, small hydro and water treatment facilities, and similar entities are often not just understaffed, but have no cybersecurity staff at all, or maybe one person.
Right. And when those attacks are against critical infrastucture, the lights go out - as they did in the Ukraine in 2015 and 2016.
CISA has talked about supporting smaller critical infrastructure entities, but I don't know how much progress has been made on that.
I agree. There are a lot of moving parts in this, to put it mildly. Breaking it down by states sounds promising - but of course so much of it comes to human and financial resources. And then there are other pain points like how much will a small entity be willing to share in order to get help that's needed.
The cost of upgrades for OT are a big factor. It’s logical for smaller entities to accept the risk than to pay the crippling cost of equipment upgrades.
True, but there are almost always things that can be done to improve security without major hardware or software upgrades. And organizations like CISA need to figure out how to help smaller entities, even with costs of equipment if they want to keep to their goal of making all of our critical infrastructure secure.
That’s something I never thought of 😀, you’re right!