12 Tech Trends to Watch Closely 2022
[real3dflipbook pdf="https://www.bizzboard.com/wp-conte...
Industrial security: Challenges and opportunities Security for the industrial internet of things (IIoT) and operational technology (OT) is in its infancy in many organizations. Several
factors — including security incidents — are driving awareness and
improvements. There’s certainly plenty of room for both, considering
more than 90% of organizations surveyed acknowledged experiencing
a security incident in the last 12 months.
From web application attacks to distributed denial-of-service (DDoS)
attacks and everything in between, global businesses are dealing with
a wide range of potential cybersecurity risks. In addition, respondents
are also concerned about the impact that the current threat landscape
and geopolitical situation could have on their organizations. While that
largely sits outside an organization’s control, it impacts them in some
shape or form and is a concern.
3
| Barracuda • THE STATE OF INDUSTRIAL SECURITY IN 2022
Security threats are rife, and organizations should
be protecting themselves, especially those in
the critical sectors, such as oil and gas. Just one
Methodology
successful supply-chain attack can have wide-
Barracuda commissioned independent
reaching, catastrophic impacts. Indeed, the high
market researcher Vanson Bourne to
level of incidents underscores the vital need
conduct a global survey of senior IT
for IIoT/OT security to adequately protect all
managers, senior IT security managers,
organizations, in every sector.
and project managers responsible for
This report takes an in-depth look at IIoT/OT
security projects, implementation challenges,
security incidents, technology investments, and
a variety of issues related to cybersecurity risks.
IIoT/OT in their organization. There were
800 survey participants from a broad
range of industries, including agriculture,
biotechnology, construction, energy,
government, healthcare, manufacturing,
retail, telecommunications, wholesale,
and others. Survey participants were
from the U.S., Europe, and Australia.
In Europe, respondents were from the
United Kingdom, France, Germany, Austria,
Switzerland, Belgium, the Netherlands,
Luxembourg, Denmark, Finland, Norway,
and Sweden. The survey was fielded in
April 2022.
4
| Barracuda • THE STATE OF INDUSTRIAL SECURITY IN 2022
FINDING #1
Most organizations
have experienced
security incidents
Initially, we asked respondents about their general feelings and
concerns about the threat landscape to get an indication of how
much awareness this topic gets and to help put the rest of their
responses in context.
How concerned are you about the current threat
landscape and geopolitical situation in terms of the
impact it may have on your organization?
Respondents from the U.S. and Australia are most likely to be
(n=800)
region but also by industry.
very concerned, while respondents from France are the least
likely to be concerned. The level of concern not only varies by
2%
41%
10%
2%
20%
4%
28%
3%
Central,
federal, and
local gov
3%
Fairly concerned
Very concerned
60%
28%
38%
40%
60%
52%
50%
Telecom
Retail
Oil and gas
Wholesale
2%
3%
13%
4%
56%
1%
14%
9%
Not very concerned
Not concerned at all
68%
10%
10%
%
47
78%
10%
42%
43%
Energy, power
generation,
and utilities
3% 5%
21%
65%
26%
29%
55%
71%
Overall, respondents are concerned about the impact that the
current threat landscape and geopolitical situation will have on
37%
their organizations, with 88% very or fairly concerned. While the
current threat landscape and geopolitical situation is something
that largely sits outside an organization’s control, it impacts
them in some shape or form and is a concern for organizations.
5
| Barracuda • THE STATE OF INDUSTRIAL SECURITY IN 2022
Manufacturing
33%
32%
32%
Distribution
and
transportation
Healthcare
(public & private)
Mining and
metals
20%
20%
Biotechnolgy,
chemicals, and
pharmaceuticals
Agriculture,
forestry, and
fishing
Very concerned
Fairly concerned
Not very concerned
Not concerned at all
5.38%
Understandably, concern is more prevalent in sectors likely to
By industry
feel the effects of the current threat and geopolitical landscape.
Government respondents are the most likely to be very
concerned. The overall level of concern, when looking at those
who are both very and fairly concerned, is also high among other
Central, federal,
and local gov
100%
Mining and metals
100%
Oil and gas
100%
critical sectors, including oil and gas and healthcare. Critical
sectors will be on high alert during periods of uncertainty, as any
impacts could have wide-reaching implications.
Telecommunications
99%
Agriculture, forestry,
and fishing
98%
Wholesale
98%
Manufacturing
98%
Next, we wanted to better understand the security situation in
industrial environments.
Has your organization experienced a security
incident in the last 12 months?
(n=800)
5.38%
0.2
5%
Distribution and
transportation
96%
Healthcare (public
and private)
94%
Retail
93%
Energy, power
generation, and utilities
85%
Biotechnology, chemicals,
and pharmaceuticals
9 4.3 8
%
Experienced an incident
82%
By geography
99%
U.S.
Has not experienced any incidents
98%
UK
Don’t know
Most organizations (94%) have experienced some sort of security
incident in the last 12 months, which is a surprising and alarmingly
high number.
Looking at the detailed results by region and industry,
this appears to be a general problem.
Nordics
92%
DACH
92%
Australia
France
6
| Barracuda • THE STATE OF INDUSTRIAL SECURITY IN 2022
97%
Benelux
90%
89%
All government, mining and metals, and oil and gas respondents
Because so many organizations have been hit by a security
say they’ve experienced at least one incident. Given the critical
incident, we wanted to know more details, especially about the
nature of some of these sectors, it’s essential they bolster security
impact and duration of these incidents.
to avoid disastrous impacts.
How long were your organization’s operations impacted due to the most
significant security incident experienced in the last 12 months?
(n=715)
43%
22%
19%
13%
Operations were impacted
for less than a day
Operations were
impacted for 1 day
Operations were
impacted for 2 days
Operations were
impacted for 3 days
2%
1%
Operations were
impacted for 4 days
Operations were
impacted for 5 days
87% of organizations that experienced an incident were impacted between one and five days.
On average, it took organizations 1.84 days to resolve the issue. Looking at the provided
severity of the impact of those incidents explains why it took so much time to remediate.
Q: What impact did the most significant security incident experienced
in the last 12 months have on your organization’s operations?
(n=755)
Impact average days
11%
Total
UK
France
9%
Nordic
Australia
U.S.
7
36%
39%
4%
10%
2%
48%
20%
7%
42%
49%
7%
34%
9%
46%
16%
29%
38%
48%
31%
5%
1.72
1.91
2%
9%
1.71
1.81
4%
31%
62%
8%
1.84
5%
50%
40%
DACH
Benelux
47%
1.63
1.87
2.05
Significant impact (complete shutdown of all devices and locations)
Moderate impact (a large number of devices or several locations were impacted)
Minimal impact (a few devices or one location was impacted)
No impact was experienced
| Barracuda • THE STATE OF INDUSTRIAL SECURITY IN 2022
Those in the DACH region (Germany, Austria, and Switzerland) and those in the U.S. were
more likely to experience significant impacts from their most significant security incident in
the last 12 months. Those in the U.S. were impacted for an average of just over two days.
Experiencing a complete shutdown of all devices and locations for this length of time can
have catastrophic implications for organizations, and it’s a situation that can be avoided by
making relatively modest investments in security.
Impact average days
Agriculture, forestry, and fishing
Biotechnology, chemicals, and pharmaceuticals
9%
12%
Energy, power generation, and utilities
Healthcare (public and private)
5%
15%
11%
Manufacturing
8%
Mining and metals
8%
48%
56%
9%
56%
37%
33%
49%
44%
Telecommunications
11%
38%
Wholesale
11%
37%
45%
31%
68%
51%
Retail
1.91
3%
1.63
4%
1.73
2%
2.06
3%
1.81
1.94
32%
53%
35%
3%
44%
58%
13%
Oil and gas
28%
36%
31%
Central, federal, and local gov
Distribution and transportation
60%
16%
41%
3%
1.88
3%
1.78
7%
1.79
20%
1.85
5%
2.18
5%
1.54
3%
Significant impact (complete shutdown of all devices and locations)
Moderate impact (a large number of devices or several locations were impacted)
Minimal impact (a few devices or one location was impacted)
No impact was experienced
When combining significant and moderate impacts, the scale of these incidents demonstrates
how some organizations have been struggling.
While government organizations are still the most likely to have experienced a significant or
moderate impact, those in wholesale; and agriculture, forestry, and fishing also have over
two-thirds of respondents reporting the same. Given the impacts include a complete shutdown
or many devices being impacted, organizations cannot afford to become complacent in
this area.
8
| Barracuda • THE STATE OF INDUSTRIAL SECURITY IN 2022
FINDING #2
The most common
attack vectors
To get the next level of detail around security incidents that have
significantly impacted operations, we asked respondents about the
attack types their organization has experienced in the past year.
Which of the following security incidents has your
organization experienced in the last 12 months?
The most common incidents were web application attacks,
(n=800)
compromised remote access.
42%
Web application attacks
Malicious external hardware or removable media
Distributed denial of service (DDoS)
9
37%
never be exposed. The issues with malicious external hardware
Compromised supply chain
34%
Data theft
31%
API attacks
31%
Ransomware
31%
| Barracuda • THE STATE OF INDUSTRIAL SECURITY IN 2022
future, as automation increases, APIs will be a bigger target
for attacks. APIs and management interfaces, which are not
35%
24%
Web applications and APIs are popular attack vectors. In the
38%
Compromised remote access
Other malware
malicious external hardware or removable media, DDoS, and
intended for public access, need robust protection and should
and removable media, like USB sticks, were ranked surprisingly
high. IoT/OT environments require temporary third-party access
for maintenance as well as troubleshooting. The high ranking of
compromised remote access shows the urgency for getting this
fixed.
Another finding was that organizations with more devices
experience more attacks, especially in the top attack categories.
Interestingly, ransomware attacks are more evenly distributed
across organizations with differing numbers of devices.
Security incidents experienced in the organization in the last 12 months
80%
40%
65%
63%
60%
29%
34%
40%
51% 48%
58%
49% 48%
27% 24%
34%
24%
33% 35%
44% 45%
20%
0%
Web application attacks
Malicious external hardware or removable media
Distributed denial of service (DDoS)
80%
60%
46%
40%
30% 29% 31%
56%
52%
35%
26% 26%
36% 37% 33%
31%
36%
30% 27% 32%
25%
20%
0%
Compromised remote access
Compromised supply chain
Ransomware
1–2,000 IIoT/OT devices or cyber-physical systems
2,001–3,000 IIoT/OT devices or cyber-physical systems
3,001–4,000 IIoT/OT devices or cyber-physical systems
4,001–5,000 IIoT/OT devices or cyber-physical systems
5,001–6,000 IIoT/OT devices or cyber-physical systems
6,001 or more IIoT/OT devices or cyber-physical systems
The high level of incidents underscores the vital need for IIoT/OT
In some critical sectors, organizations experienced fewer
security to adequately protect all organizations. This is probably
incidents. In biotechnology, chemicals, and pharmaceuticals,
why 96% agree their organization needs to invest more in the
nearly 20% had no incidents in the last 12 months. In energy,
security of IIoT and OT.
power, and utilities, 15% had no incidents in the last 12 months.
Overall, we see significant differences in both probability and
attack vector across different industry verticals.
10
| Barracuda • THE STATE OF INDUSTRIAL SECURITY IN 2022
Security incidents experienced in the organization in the last 12 months
60%
47%
36%
40%
51%
40%
31%
43%
57%
49%
47%
38%
38%
44%
20%
0%
Web application attacks
60%
37%
40%
31%
40%
46%
40%
29%
55%
53%
40%
35%
33%
41%
20%
0%
Malicious external hardware or removable media
60%
53%
40%
32%
28%
36%
22%
31%
47%
37%
45%
38%
35%
20%
20%
0%
Compromised remote access
60%
40%
22%
27%
27%
45%
36%
26%
39%
29%
27%
20%
33%
31%
21%
0%
Compromised supply chain
11
Agriculture, forestry, and fishing
Biotechnology, chemicals, and pharmaceuticals
Central, federal, and local gov
Distribution and transportation
Energy, power generation, and utilities
Healthcare (public and private)
Manufacturing
Mining and metals
Oil and gas
Retail
Telecommunications
Wholesale
| Barracuda • THE STATE OF INDUSTRIAL SECURITY IN 2022
FINDING #3
Organizations are
investing in security
To put the rather frightening results of the security incidents and
successful attacks into perspective, we asked respondents how
far their organization’s operational technology and industrial IoT
security projects had progressed.
What stage is your organization at when it comes to IIoT/OT security projects?
(n=800)
32%
Total
40%
50%
Oil and gas
Telecommunications
48%
Energy, power generation, and utilities
46%
Retail
45%
Government
44%
10%
17%
Healthcare
17%
Distribution and transportation
40%
4%
21%
3%
24%
54%
30%
36%
33%
48%
We will be starting an IIoT/OT security
project in the next 6 months
We will be starting an IIoT/OT security
project in the next 12 months
12%
15%
44%
We are in the process of completing
IIoT/OT security projects
3%
27%
34%
38%
3%
6%
6%
13%
24%
We have already completed
some IIoT/OT security projects
| Barracuda • THE STATE OF INDUSTRIAL SECURITY IN 2022
7%
10%
54%
Wholesale
1%
2%
20%
35%
21%
Biotechnology, chemicals, and pharmaceuticals
6%
17%
26%
24%
Manufacturing
12
32%
42%
Mining and metals
Agriculture, forestry, and fishing
21%
1%
5%
1%
12%
25%
47%
5%
2%
11%
11%
We will be starting an IIoT/OT security
project in the next 3 months
2%
2%
Organizations are facing a multitude of hurdles when it comes to IIoT/OT security
projects, leaving their networks and infrastructure open to the risks of security
incidents. Many organizations are in their infancy when it comes to IIoT/OT security
projects. Overall, while 72% are at least in the process of completing these projects,
only just under a third have already done so.
Oil and gas are the furthest ahead when it comes to completing some IIoT/OT
security projects. Agriculture, forestry, and fishing are much less likely to have done
this. In biotechnology, chemicals, and pharmaceuticals, only a fifth of respondents
have completed projects. Manufacturing and healthcare are also among the lowest.
Given the impacts if some of their devices are hacked, it should be a larger focus for
all sectors.
We thought it would be interesting to analyze the state of IIoT/OT security projects
not just by vertical, but also by the size of the organization.
48%
50%
39%
40%
30%
34% 32%
37% 39%
31%
27%
22% 23%
20%
23%
17%
10%
2%
0%
We have already
completed some IIoT/OT
security projects
500–999 employees
We are in the process
of completing IIoT/OT
security projects
We will be starting an
IIoT/OT security project
in the next 3 months
1,000–2,999 employees
6%
10%
4%
We will be starting an
IIoT/OT security project
in the next 6 months
3,000–4,999 employees
0% 0% 1%
2%
We will be starting an
IIoT/OT security project
in the next 12 months
5,000 or more employees
Analyzing the state of IIoT/OT security projects when grouping
We also wanted to know if organizations implement IIoT/OT
organizations by the number of employees, apparently
security on their own or if they work with external experts on
enterprises with more than 5,000 employees are more likely to
these types of projects.
have completed projects already, whereas the majority of small
companies are still working on it.
13
| Barracuda • THE STATE OF INDUSTRIAL SECURITY IN 2022
Did your organization consult an external security
specialist when developing its current IIoT/OT strategy?
(n=800)
71%
66%
49%
Combination of “We consulted an external
OT security specialist” and “We consulted
an external IT security specialist”
45%
Combination of “We consulted an
external IT security specialist” and
“We worked with an in-house team”
31%
Combination of “We consulted an
external OT security specialist” and
“We worked with an in-house team”
We consulted an external
IT security specialist
We consulted an external
OT security specialist
We worked with
an in-house team
Combination of “We consulted an external
OT security specialist” and “We consulted
an external IT security specialist” and “We
worked with an in-house team”
Organizations are more likely to be looking to both external IT and OT security
specialists when developing their current IIoT/OT security strategies, rather than
just relying on their in-house teams. The majority sought external help to develop
their IIOT/OT security strategies.
14
| Barracuda • THE STATE OF INDUSTRIAL SECURITY IN 2022
28%
18%
FINDING #4
Security measures
do help
Next, we’ll be reviewing to what extent industrial security projects
mitigate the risks implied by the ever-evolving threat landscape.
To highlight the requirement for security, we compared the state
of IIoT/OT security projects with the most significant impact
experienced after an incident.
What impact did the most significant security incident experienced
in the last 12 months have on your organization’s operations?
(n=755)
Significant impact (complete shutdown of all devices and locations)
Moderate impact (a large number of devices or several locations were impacted)
Minimal impact (a few devices or one location was impacted)
No impact was experienced
We have already completed some IIoT/OT security projects
38%
30%
30%
32%
41%
27%
36%
42%
75%
We are in the process of completing IIoT/OT security projects
23%
8%
18%
We will be starting an IIoT/OT security project
Investments in security are paying off for organizations
There are a variety of different technologies available,
by reducing the impact of incidents when they happen.
though, so we also wanted to know which security measures
Organizations that have already completed some IIoT/OT
organizations have implemented and how it improved their
security projects are more likely to not experience an impact.
IIoT/OT security posture.
15
| Barracuda • THE STATE OF INDUSTRIAL SECURITY IN 2022
“We have already implemented the below technologies”
100%
98%
95%
75%
80%
66% 70%
93%
84%
68%
76%
79%
68%
80%
75%
60%
69% 64%
79%
90%
73%
72%
64%
90%
77%
67% 72%
88%
79%
69% 72%
40%
20%
0%
Industrial protocol detection
and enforcement
Antivirus or IPS
No impact was experienced
Segmentation
Web application firewall (WAF)
Minimal impact
Moderate impact
Anomaly detection
Advanced Threat Protection
Network traffic encryption
Significant impact
All these technologies are valuable in reducing impacts, especially industrial protocol detection
and enforcement and anti-virus/IPS.
Overall, out of respondents that already implemented IIoT/OT security and think it works well,
enterprise organizations represent the majority, and it seems smaller businesses have made less
progress in implementing their security strategy. There is a clearly visible relation between the
implementation status of security measures and the size of the organization.
Already implemented and works well
50%
40%
30%
27%
34% 36%
42%
31%
35%
42% 41%
40%
46%
39%
48%
42%
35%
25% 25%
39%
48%
43%
29% 27%
40%
24%
27%
39%
26%
43%
31%
20%
10%
0%
Industrial protocol detection
and enforcement
500–999 employees
Antivirus or IPS
Web application firewall (WAF)
1,000–2,999 employees
Segmentation
3,000–4,999 employees
Anomaly detection
5,000 or more employees
Security and technology adoption is generally higher in enterprise organizations, and the
largest organizations are successfully implementing more advanced security technologies.
However, organizations still face a variety of challenges when it comes to implementing IoT
security projects, which is perhaps why so many have had projects fail.
16
| Barracuda • THE STATE OF INDUSTRIAL SECURITY IN 2022
Advanced Threat Protection
Network traffic encryption
Why, if at all, have any previous IIoT/OT security
projects failed within your organization?
60%
48%
(n=755)
60%
40%
0%
20%
40%
60%
80%
57%
39%
57%
48% 31% 31%
100%
31%
31% 31%
93%
25%
25%
0%
20%
The technology took
too long to implement
55%
The technology
was too expensive
41%
No one in the organization took
clear responsibility for the project
39%
We couldn’t source technology
that met our needs
We’ve not had any IIoT/OT
security projects fail
31%
47%
39%
40%
20%
Have had IIoT/OT
security projects fail
47%
500–999 employees
0%
60%
60%
40%
38%
7%
40%
20%
60%
50% 50%
500–999 employees
60% 41%
50% 50%
1,000–2,999 employees
55%
1,000–2,999 employees
48%
45%
55%
29%
41%
45%
48%
29%
0%
20%
3,000–4,999 employees
93% had a failed project, due to a variety of challenges related
to technology and costs. The top challenge, according to more
than half of the respondents, was that implementation took too
0%
5,000 or more employees
The technology took too long to implement
3,000–4,999 employees
5,000 or more employees
The technology was too expensive
long. Costs have also held back organizations; 41% of those
No one in the organization took clear
The technology took too long to implement
responsibility for the project
with failed projects said the technology was too expensive.
We couldn’t
source
that met our needs
The
technology
wastechnology
too expensive
Organizations are in dire need of a streamlined, simple, and
No one in the organization took clear
responsibility for the project
cost-effective approach to manage and run their IIoT/OT security
projects, to help reduce the risk of impact from security incidents.
Reasons for failed projects vary depending on the size of
the organization.
We couldn’t source technology that met our needs
Cost is less of a problem for large organizations. Instead,
responsibility and technological requirements are the most
common problems for these organizations.
17
| Barracuda • THE STATE OF INDUSTRIAL SECURITY IN 2022
In addition to the challenges they actually faced, organizations have
and expect to face a variety of implementation challenges when it
comes to IoT security projects.
Which of the following challenges did/do you think
your organization would/will face when implementing
IIoT/OT security projects?
(n=793)
Scalability of the solution
39%
The level of security provided by the solution
39%
Lack of control over external devices joining the network
36%
Challenges of a distributed environment
36%
The time it takes to implement the project
35%
Dealing with a number of different vendors
34%
Lack of technical knowledge
34%
32%
Dealing with legacy infrastructure
The cost of the project
27%
Nearly all respondents say their organization has or expects to face
challenges when implementing IIoT/OT security projects, including
scalability, security, technical knowledge, and cost.
39% of respondents stated that scalability of the solution is
a main concern, so we did a deeper analysis by vertical.
18
| Barracuda • THE STATE OF INDUSTRIAL SECURITY IN 2022
How problematic are the connectivity and
scalability of your organization’s IIoT/OT networks?
(n=800)
Connectivity: Combination of
very and fairly problematic
Scalability: Combination of
very and fairly problematic
72%
Wholesale
Telecommunications
Retail
35%
Telecommunications
45%
Mining and metals
Biotechnology, chemicals, and pharmaceuticals
Agriculture, forestry,
and fishing
Distribution and transportation
53%
Central, federal, and local gov
Biotechnology, chemicals, and pharmaceuticals
64%
Overall, 58% of respondents say the scalability of their organization’s IIoT/
OT network is very or fairly problematic. 56% say the same when it comes
to connectivity. Some industries, such as healthcare and wholesale, are
19
| Barracuda • THE STATE OF INDUSTRIAL SECURITY IN 2022
53%
58%
69%
57%
Energy, power generation, and utilities
36%
experiencing more challenges with connectivity and scalability.
67%
Healthcare (public and private)
61%
58%
48%
Manufacturing
55%
Energy, power generation, and utilities
Central, federal, and local gov
Mining and metals
61%
Healthcare (public and private)
34%
Oil and gas
47%
Manufacturing
Distribution and transportation
Retail
65%
Oil and gas
67%
Wholesale
Agriculture, forestry,
and fishing
40%
53%
62%
66%
FINDING #5
Infrastructure is at risk
When infrastructure is hit by an attack,
it is essential to stop lateral movement.
Micro-segmentation is the best practice to mitigate the impact
incidents in the first place is to keep the infrastructure and
of an incident. That way, potentially vulnerable devices on
devices fully patched and up to date. So, we also inquired
the network can be isolated from the rest, and only legitimate
about the frequency of updates applied to OT and IIoT devices.
network traffic is permitted.
How is/will your organization’s network
be segmented?
(n=796)
0%
20%
How often are security updates for your
organization’s IIoT/OT devices applied?
40%
60%
43%
Segmentation between IT and OT
(n=800)
21%
Daily
34%
Weekly
Segmentation according to Purdue
model within the OT network or similar
Micro-segmentation of single machines
or small groups of machines on
separate network segments
51%
16%
Quarterly
6%
Every six months
Every nine months
Looking at how organizations segment their networks, only
between IT and OT. That basic segmentation is usually the first
step, but security should be improved further by introducing
additional segmentation on the OT network. That is necessary
to combat threats on the local network, such as malicious
media devices and compromised remote access. 51% have
done that by creating network segments according to the
Purdue model — a common reference architecture — or similar
means. Only 6% have taken the further step of implementing
micro-segmentation, providing the best possible protection by
isolating each single device or small groups of devices.
Besides micro-segmentation, one of the most important
mechanisms to reduce the attack vector and avoid security
| Barracuda • THE STATE OF INDUSTRIAL SECURITY IN 2022
5%
2%
Average numer of months
security updates are applied
43% of organizations have implemented segmentation
20
23%
Monthly
Central, federal, and local gov
0.44
Manufacturing
0.82
Distribution and transportation
0.85
Wholesale
0.91
Retail
0.96
Healthcare (public and private)
1.12
Oil and gas
1.16
Energy, power generation, and utilities
1.18
Telecommunications
Mining and metals
1.44
1.66
Agriculture, forestry, and fishing
1.76
Biotechnology, chemicals, and pharmaceuticals
1.77
On average, security updates are applied every 1.25
in the last 12 months. Nearly one-quarter apply updates
months. Those in government are doing this most often,
monthly. Only 6% apply updates every six to nine months.
around twice a month on average. This higher frequency
It appears that in many cases, updates are reactionary after
could be explained by the fact that they are one of the
an incident, as opposed to proactively preventing them.
most likely sectors to have experienced security incidents
Average number of months organizations apply security updates to IIoT/OT devices
Device manufacturer applies
the security update
Security updates of IIoT/OT devices are not
manual at all — updates are applied automatically
1.13
The organization applies the
security update themselves
1.29
Security updates of IIoT/OT devices are
completely manual — none are automatic
Third-party service provider
applies the security update
1.30
Security updates of IIoT/OT devices are
somewhat manual / somewhat automatic
0.69
1.26
1.45
The frequency of these updates varies depending on who
For around two-thirds of respondents, security updates are
applies the update and if the updates are automatic or manual.
applied to these devices through a third-party service provider or
a device manufacturer. Just less than half of organizations handle
updates themselves.
How are the security updates for your organization’s IIoT/OT devices applied?
(n=800)
100%
75%
80%
60%
40%
40%
51% 54%
78%
64%
53%
70%
52%
20%
0%
We handle this ourselves
It’s not manual at all — updates are applied automatically
Device manufacturer
Third-party service provider
It’s somewhat manual/somewhat automatic
It’s completely manual — none are automatic
Automation is higher when updates are managed externally, which is one of the primary benefits of doing
so. There is demonstrated value in having a third party manage updates, as they tend to be performed
automatically. Internally, updates tend to be handled manually.
21
| Barracuda • THE STATE OF INDUSTRIAL SECURITY IN 2022
Agriculture, forestry, and fishing
Biotechnology, chemicals, and pharmaceuticals
10%
78%
6%
82%
53%
47%
Distribution and transportation
17%
63%
15%
36%
Manufacturing
56%
16%
8%
60%
20%
35%
58%
28%
Telecommunications
Security updates of IIoT/OT devices are not manual
at all — updates are applied automatically
8%
59%
36%
Wholesale
8%
76%
20%
Retail
7%
69%
22%
Oil and gas
9%
47%
14%
Healthcare (public and private)
Mining and metals
11%
38%
Central, federal, and local gov
Energy, power generation, and utilities
12%
13%
52%
Security updates of IIoT/OT devices are
somewhat manual/somewhat automatic
12%
Security updates of IIoT/OT devices are
completely manual — none are automatic
The level of automation varies across the different verticals. In energy, power, and
utilities, 86% of organizations are using a partially manual process, leaving themselves
exposed to the risk of breach if not done regularly or correctly.
The degree of update automation clearly has a relation to the severity of incidents,
showing that frequent updates help to defend against cyberattacks.
Incidents resulting in complete shutdown
20%
18%
15%
12%
10%
6%
5%
0%
Completely manual updates
Somewhat manual updates
Completely automatic updates
For those applying updates manually, nearly one-fifth said the most significant security incident led to a
complete shutdown of all devices and locations. It’s clear that the level of automation plays a major part
in the impact security incidents have on organizations. Where security updates are applied automatically,
just 6% experienced a complete shutdown of all devices and locations following an incident.
22
| Barracuda • THE STATE OF INDUSTRIAL SECURITY IN 2022
FINDING #6
Remote access
security requires
immediate attention
Virtually all organizations allow both internal and
external users to access OT environments remotely.
The frequent usage of remote access mechanisms
requires robust security and authentication measures.
Does your organization allow remote access into
OT environments?
(n=800)
59%
Internal users
51%
External users
25%
27%
2%
14%
18%
2%
1%
Yes, full network access and multifactor authentication is required
Yes, full network access and multifactor authentication is not required
Yes, partial network access (to certain systems only) and multifactor authentication is required
Yes, partial network access (to certain systems only) and multifactor authentication is not required
No, no remote access at all
The majority allow full network access, but around a quarter of this group report that multifactor
authentication (MFA) is not required. Only 18% of companies restrict network access and enforce MFA
when it comes to remote access into OT networks. Given the sensitive nature of these environments,
organizations should be taking every precaution necessary to keep them as secure as possible.
23
| Barracuda • THE STATE OF INDUSTRIAL SECURITY IN 2022
Remote access for internal users
39%
Agriculture, forestry, and fishing
41%
46%
Biotechnology, chemicals, and pharmaceuticals
19%
33%
16%
76%
Central, federal, and local gov
16%
Healthcare (public and private)
Manufacturing
24%
62%
28%
61%
29%
47%
Mining and metals
9%
10%
73%
Retail
24%
47%
24%
10%
15%
29%
Yes, full network access and multifactor authentication is not required
Yes, partial network access (to certain systems only) and multifactor authentication is required
Yes, partial network access (to certain systems only) and multifactor authentication is not required
Across the different sectors, most internal users have
environments remotely without using MFA. This might be
full network access, but MFA is not as widespread. In
because they are further behind on their IIoT/OT projects.
biotechnology, chemicals, and pharmaceuticals, for example,
This is an area that these organizations need to be aware
a third of respondents said internal users can access OT
of, given the implications if their devices are compromised.
| Barracuda • THE STATE OF INDUSTRIAL SECURITY IN 2022
3%
10%
Yes, full network access and multifactor authentication is required
24
2%
1%
5%
18%
60%
Wholesale
9%
18%
77%
Telecommunications
7%
29%
Oil and gas
11%
20%
69%
Energy, power generation, and utilities
5%
13%
64%
Distribution and transportation
2%
1%
Remote access for external users
36%
Agriculture, forestry, and fishing
29%
36%
49%
Biotechnology, chemicals, and pharmaceuticals
31%
56%
Central, federal, and local gov
Distribution and transportation
38%
Energy, power generation, and utilities
38%
33%
16%
40%
61%
Mining and metals
61%
Retail
60%
Telecommunications
59%
16%
4%
1%
13%
16%
8%
23%
18%
18%
15%
53%
2%
25%
25%
52%
Wholesale
15%
31%
Manufacturing
Oil and gas
9%
47%
45%
Healthcare (public and private)
1%
3%
2%
16%
20%
23%
33%
5%
2%
10%
3%
2%
1%
3%
Yes, full network access and multifactor authentication is required
Yes, full network access and multifactor authentication is not required
Yes, partial network access (to certain systems only) and multifactor authentication is required
Yes, partial network access (to certain systems only) and multifactor authentication is not required
No, no remote access at all
Similarly, the majority allow external users full network access to
This situation should never exist in critical sectors and should be
OT environments. The use of MFA to do this is widespread, but it
addressed immediately. As we saw with the attack on Colonial
is severely lacking for some sectors. Energy, power generation,
Pipeline, just one successful remote access attack can have
and utilities is the most likely sector to allow full network access
wide-reaching, catastrophic impacts.
without the requirement of MFA.
The market offers a variety of different remote access
mechanisms, from simple traditional VPN to highly secure
Zero Trust solutions.
25
| Barracuda • THE STATE OF INDUSTRIAL SECURITY IN 2022
Which of the following tools is your organization
using for remote access?
In addition to who can access the network, organizations also
need to consider what users are allowed to do on the network.
(n=800)
0%
Fully implemented Zero Trust
model with commercial zero
trust offering
Basic web-based Zero Trust concept to
RDP/screenshare host, no network access
Web-based access to RDP or other
screen-sharing tools, segmentation
enforced on RDP host via limited
access to resources
10%
20%
30%
40%
50%
1%
1%
Access rights and security policies for single users or user groups
need to be defined.
In your organization, which of the following
access permissions are granted via remote
access for internal and external users?
2%
1%
(n=800)
18%
0%
6%
19%
VPN or SSL-VPN access to other
screen-sharing tools with full access
34%
41%
Direct network-level access via
VPN or SSL-VPN, few or very little
network segmentation
26%
40%
60%
Collecting data for
analytics and maintenance
15%
VPN or SSL-VPN access to RDP
host (Remote Desktop Protocol)
with full access everywhere
20%
36%
External users
Internal users
63%
Applying configuration
changes and updates
56%
Use of specified applications
and protocols only
54%
Privileged access
management is applied
None of these access
permissions are granted
80%
49%
1%
Zero Trust Network Access (ZTNA) is the most secure way to
provide remote access, including granular permissions based
on user id, device id and type, health state, and geographic
location. It’s not one-time access; it’s continuously applied,
and permissions are continually verified. With only 1% of
respondents using ZTNA for either internal or external users,
it’s clearly in its infancy in the OT space. This represents an
easy opportunity for the industry to improve their security
posture quickly when it comes to remote access.
The majority of organizations provide direct network-level
access without further security. All network traffic from remote
connections should run through detailed security inspection and
be limited to specific target systems only. In particular, the use
of screen-sharing tools and remote desktop connections are
often inadvertently bypassing existing security measures in many
cases. Given that compromised remote access is a common
problem, addressing these weaknesses could increase the level
of protection significantly.
26
| Barracuda • THE STATE OF INDUSTRIAL SECURITY IN 2022
There are a range of access permissions granted via remote
access for both internal and external users: collecting data for
analytics and maintenance (63%); applying configuration changes
and updates (56%); use of specified applications and protocols
(54%); privileged access management is applied (49%). Just 1%
say none of these access permissions are granted. If access
to an organization’s OT environment fell into the wrong hands,
especially in a critical sector, the impacts could be detrimental.
Worryingly, over half (57%) of respondents report that external
users who have full network access are able to apply
configuration changes and updates, a very high-risk situation
for a breach.
FINDING #7
Digital transformation
drives new technology
The adoption of the public cloud, software-as-a-service
(SaaS), and secure access service edge (SASE) is changing
the way corporations operate and the network architecture
they require. We wanted to know where businesses are on
this journey to digitalization.
Does your organization plan to utilize a public cloud offering for
digital transformation?
(n=800)
0%
10%
20%
30%
We are already
utilizing a public
cloud offering
40%
36%
We are in the process
of adopting a public
cloud offering
40%
We will be adopting a
public cloud offering
within the next 12 months
We will be adopting a public
cloud offering within the
next 12 to 24 months
20%
4%
Virtually all organizations have committed to the adoption of public cloud. 96% are already using public
cloud, are in the process of adopting a public cloud offering, or have plans to do so in the next 12 months.
However, the level of adoption shows significant differences between industries.
27
| Barracuda • THE STATE OF INDUSTRIAL SECURITY IN 2022
Public cloud adoption by industry
17%
Agriculture, forestry, and fishing
Biotechnology, chemicals, and pharmaceuticals
53%
15%
61%
23%
60%
Central, federal, and local gov
9%
49%
Distribution and transportation
28%
32%
38%
20%
50%
Retail
38%
56%
Telecommunications
14%
43%
We are in the process of adopting a public cloud offering
We will be adopting a public cloud offering within the next 24 months
We will be adopting a public cloud offering but not in the next 24 months
We currently have no plans to adopt a public cloud offering
The adoption of public cloud is widespread in some industries but still being worked on in others.
Interestingly, in the government sector, where the use of IIoT tends to be for managing critical
infrastructure, the use of public cloud is very high at 60%. On the other end of the spectrum are
the healthcare; mining and metals; agriculture, forestry, and fishing; biotechnology, chemicals, and
pharmaceuticals; and wholesale verticals, all with an adoption rate below 30%.
Public cloud is not a security risk. In general, companies using public cloud seem to be more willing
to adopt technology and invest in security. The same group is also seen adopting edge computing
more often, and public cloud appears to be a driver for that technology. So, we wanted to know if
28
| Barracuda • THE STATE OF INDUSTRIAL SECURITY IN 2022
13%
22%
We are already utilizing a public cloud offering
this is in fact the case.
2%
16%
45%
42%
Oil and gas
2%
15%
50%
24%
Mining and metals
16%
43%
34%
Manufacturing
2%
31%
28%
Healthcare (public and private)
1%
29%
33%
54%
Energy, power generation, and utilities
Wholesale
31%
21%
43%
1%
To what extent has your organization adopted edge computing?
(n=800)
We are already utilizing
a public cloud offering
67%
We are in the process of
adopting a public cloud offering
23%
19%
We will be adopting a public cloud
offering within the next 12 months
65%
8%
We will be adopting public cloud
offering later or have no plans to adopt
16%
38%
6%
We have fully adopted edge computing
7%
48%
31%
43%
11%
6%
We currently have no plans to adopt edge computing
Don’t know
Edge computing is considered an important part of an organization’s setup by the vast majority of
respondents and will likely continue to gain in popularity in the future.
Over two-fifths of respondents say their organization is in the process of adopting edge computing.
About one-third say edge computing has been fully adopted. About one-quarter say their organization
will be adopting edge computing within the next 12 to 24 months. Based on the data, it’s clear edge
computing helps businesses take advantage of public cloud, with adoption among those who are
already utilizing a public cloud offering reaching 67%.
Looking at the popular IoT edge platforms, Google IoT Edge, AWS Greengrass, and Azure IoT Edge
are the most likely edge computing tools being considered, according to respondents.
Which of the following benefits has/do you think your organization
would gain by adopting always connected IIoT?
(n=800)
42%
Improved
product
quality
29
39%
Improving
asset/device
management
39%
Increased
agility
38%
Competitive
advantages
| Barracuda • THE STATE OF INDUSTRIAL SECURITY IN 2022
37%
Optimized/
simplified
maintenance
36%
Optimize
equipment
effectiveness
1%
1%
1%
3%
We will be adopting edge computing within the next 12 months
We are in the process of adopting edge computing
We will be adopting edge computing in 12 to 24 months
4%
3%
34%
Improving
decisionmaking
34%
Reduce
production
cost
29%
29%
Reduce
CO2
emission
Real-time
monitoring
and control
When asked about the importance of digitalization in general, there is overwhelming
agreement from respondents when it comes to three items:
• Always connected IIoT/OT is viewed as competitive assets for organizations
• Edge computing is considered an important part of an organization’s setup
• Organizations need to invest more in the security of IIoT and OT
In more detail, improving product quality, asset/device management, and agility were
cited as top benefits of always connected IIoT.
Our final question in this survey was about the most important use cases for future
digitalization projects.
Which of the following would your organization consider when
digitally transforming your organization?
(n=800)
52%
52%
Artifical Intelligence/
machine learning
Data normalization
and aggregation
50%
33%
Predictive/
pre-emptive
maintenance
Product
customization/
lot size 1
Looking forward to the adoption of additional technologies, organizations are
considering a number of solutions and strategies, including the use of AI/ML
and better data management.
30
| Barracuda • THE STATE OF INDUSTRIAL SECURITY IN 2022
50%
Remote condition
monitoring of assets
27%
Digital twin
Conclusion
In today’s uncertain geopolitical environment, people and
Fortunately, effective solutions to IIoT security challenges are
organizations are highly concerned with potential cyberattacks.
available, including secure endpoint connectivity devices and
The most concerning are possible attacks on critical infrastructure
ruggedized network firewalls, all centrally deployed and managed
and industrial assets. Unfortunately, IIoT/OT security currently
via a secure cloud service. These solutions can enable effective
requires a lot of improvement.
network segmentation and advanced threat protection, provide
multifactor authentication, and even implement Zero Trust Access.
This report shows nearly all — 94% — of organizations have
In addition, web application firewall services can be deployed to
experienced at least one security incident, which likely impacted
protect the infrastructure from web application and DDoS attacks.
their industrial IoT infrastructure. These incidents had significant
impact on organizations, with 87% of them reporting their
operations were impacted for one day or more. The incidents
involved a wide range of attacks, with web application, malicious
external hardware/removable media, and distributed denial of
service attacks being the most frequent.
The good news is the majority of organizations are already
implementing or planning IIoT/OT security projects. Even better
news is organizations that didn’t experience an impact are
more likely to have already completed some IIoT/OT security
projects, so these projects seem to be effective. There are
many challenges, however, in successfully implementing IIoT/
OT security, including long implementation times and high
costs. In fact, 93% of organizations had a failed project on their
journey to IIoT/OT security.
Some of the areas that require attention are the lack of network
segmentation, reactive rather than proactive security updates,
and insufficient automation. One area that requires urgent
attention is remote access security. While most organizations
allow both internal and external users access to their OT
environments, roughly a quarter are not requiring multifactor
authentication, leaving organizations wide open to attacks.
31
| Barracuda • THE STATE OF INDUSTRIAL SECURITY IN 2022
Nearly all — 94% — of
organizations have
experienced at least
one security incident,
which likely impacted
their industrial
IoT infrastructure.
These incidents had
significant impact on
organizations, with
87% of them reporting
their operations were
impacted for one day
or more.