UK critical infrastructure (CNI) firms will be overwhelmed by an increase in cyber-attacks of up to 100% in the next two years, causing chaos, disruption and major regulatory fines, according to Huntsman Security.
The cybersecurity vendor claimed that smart, connected systems will offer more opportunities for hackers to compromise them. This could result in key systems being held to ransom, costly service outages and potentially even loss of life, it said.
The predicted rise in attacks will come at a bad time for the industry, struggling as it is to cope with a growing skills crisis which will see a shortfall of 1.8 million information security professionals by 2022.
In the UK, 66% of firms currently have too few cybersecurity personnel, with 47% claiming the reason is a dearth of qualified applicants, as older professionals retire with few coming through the ranks to replace them.
These challenges will be exacerbated by new European laws designed to improve baseline security in providers of “essential services” like CNI firms.
The so-called NIS Directive lands in May 2018 and will levy the same maximum fines of 4% of global annual turnover or £17m — whichever is higher — on serious transgressions.
Firms running the energy, transport, health, drinking water supply and distribution and digital infrastructure sectors are so far slated to be covered by the directive.
Piers Wilson, head of product management at Huntsman Security, told Infosecurity that the new law is still being finalized by parliament.
“Since NIS is a directive, and so must be enacted locally, we may not see the same rapid changes that have accompanied the more all-encompassing GDPR,” he added. “NIS will doubtless drive improvements in organizations’ cybersecurity resilience, but like other regulations it will form part of a broader approach instead of a one-stop cure-all.”
CEO Peter Woollacott argued that while NIS is making organizations think about the threat from cyberspace, it needs to be matched with the appropriate action.
“When connections were entirely physical, it was relatively simple to prevent and stop attacks — in the online world, this is nowhere near enough,” he said.
“Without the ability to automatically triage potential threats and take the appropriate action — whether that’s simply logging the incident, alerting security teams, or quarantining the danger — organizations will find themselves overwhelmed and the odds of being victim to a major attack with serious consequences will increase accordingly.”