For CISOs tasked with safeguarding industrial networks, understanding IT security professionals' attitudes, perceptions, and concerns regarding operational technology (OT) is crucial to forging an effective path forward. Our latest research report offers a global perspective on the state of industrial cybersecurity based on an independent survey of 1,000 full-time IT security professionals across the United States, United Kingdom, Germany, France, and Australia.
Our research gleaned insight into the following areas, which are broken down in-depth in our Global State of Industrial Cybersecurity report:
The survey illuminated a notable lack of confidence in the status quo of OT safeguards among IT security professionals in the U.S. relative to other countries. For instance, 51% of industry practitioners in the U.S. believe today's industrial networks are not properly safeguarded, compared to just 4% of their German counterparts.
Worldwide, a clear majority (74%) of respondents in all regions characterized cyberattacks on critical infrastructure as having greater potential to inflict damage than an enterprise data breach.
Respondents identified hacking (43%), ransomware (33%), and sabotage (9%) as the most prevalent attacks against industrial networks. The survey also indicated consensus characterizing electric power (45%) as the sector most vulnerable to cyber attacks on critical infrastructure, followed by the oil and gas (22%), chemical (12%), and transportation (12%) sectors.
Despite a clear consensus (80%) that IT security teams are responsible for protecting an organization's industrial networks, a significant portion of respondents (25% globally, 34% in the U.S.) had not been trained on the differences between IT and OT networks. 93% of respondents said OT-focused cybersecurity should be incorporated into the education and training of IT security professionals.
In addition to identifying key areas for CISOs to focus their efforts, our Global State of Industrial Cybersecurity report offers an actionable roadmap for closing the decades-old cybersecurity gap between IT and OT through increased awareness and education, reduced complexity, simplified governance, and IT–OT alignment.
To learn more, download the report.
CWE-79 IMPROPER NEUTRALIZATION OF INPUT DURING WEB PAGE GENERATION ('CROSS-SITE SCRIPTING')
The affected product is vulnerable to a reflected cross-site scripting vulnerability, which could allow a remote attacker to execute arbitrary JavaScript on the victim's browser.
Zenitel recommends users to upgrade to Version 9.3.3.0 or later.
CVSS v3: 9.8
CWE-787 OUT-OF-BOUNDS WRITE
The affected product is vulnerable to an out-of-bounds write vulnerability, which could allow a remote attacker to crash the device.
Zenitel recommends users to upgrade to Version 9.3.3.0 or later
CVSS v3: 7.6
CWE-78 IMPROPER NEUTRALIZATION OF SPECIAL ELEMENTS USED IN AN OS COMMAND ('OS COMMAND INJECTION')
An OS command injection vulnerability exists due to incomplete validation of user-supplied input. Validation fails to enforce sufficient formatting rules, which could permit attackers to append arbitrary data. This could allow an unauthenticated attacker to inject arbitrary commands.
Zenitel recommends users to upgrade to Version 9.3.3.0 or later
CVSS v3: 9.8
CWE-78 IMPROPER NEUTRALIZATION OF SPECIAL ELEMENTS USED IN AN OS COMMAND ('OS COMMAND INJECTION')
An OS command injection vulnerability exists due to insufficient sanitization of user-supplied input. The application accepts parameters that are later incorporated into OS commands without adequate validation. This could allow an unauthenticated attacker to execute arbitrary commands remotely.
Zenitel recommends users to upgrade to Version 9.3.3.0 or later.
CVSS v3: 9.8
CWE-78 IMPROPER NEUTRALIZATION OF SPECIAL ELEMENTS USED IN AN OS COMMAND ('OS COMMAND INJECTION')
An OS command injection vulnerability exists due to improper input validation. The application accepts a parameter directly from user input without verifying it is a valid IP address or filtering potentially malicious characters. This could allow an unauthenticated attacker to inject arbitrary commands.
Zenitel recommends users to upgrade to Version 9.3.3.0 or later
CVSS v3: 9.8