{"id":6183,"date":"2024-11-11T15:40:38","date_gmt":"2024-11-11T21:40:38","guid":{"rendered":"https:\/\/www.darkreading.com\/ics-ot-security\/incident-response-anomaly-detection-rank-high-on-planned-ics-security-spending"},"modified":"2024-11-11T15:40:38","modified_gmt":"2024-11-11T21:40:38","slug":"incident-response-anomaly-detection-rank-high-on-planned-ics-security-spending","status":"publish","type":"post","link":"https:\/\/ddi.mohflo.net\/index.php\/2024\/11\/11\/incident-response-anomaly-detection-rank-high-on-planned-ics-security-spending\/","title":{"rendered":"Incident Response, Anomaly Detection Rank High on Planned ICS Security Spending"},"content":{"rendered":"
<\/a><\/div>\n
<\/div>\n

In the <\/span>SANS State of ICS\/OT Cybersecurity 2024<\/a><\/span> report, 530 professionals working in critical infrastructure sectors were asked which technologies they have in their OT environments and what they were planning to add in the next year and a half. The two lists highlight which technologies are widely deployed and what areas security teams are going to focus on next. <\/span><\/p>\n

As for technologies currently in use, access controls (81%); backup and recovery tools (74.4%); endpoint detection and response tools such as traditional antivirus (73%); implementing segmentation between control systems and higher risk networks (66%); and securing remote access by deploying multi-factor authentication (65%) were the top five. These categories have seen “massive jumps in implementation,” SANS said in the report. Just 53% of respondents reported using EDR in 2019, which comes out to a 20% increase in 2024.<\/span><\/p>\n

“We often describe ICS\/OT as the ‘M&M’ model: hard shell, gooey center. This is why we focus a lot on IT\u2013OT boundaries (i.e., the hard shell),” the report said. “However, security professionals need to also focus on toughening up that gooey center.”<\/span><\/p>\n

Securing that “gooey center” may be one of the reasons for a shift suggesting more non-technology spending, such as in training, simulations, and incident response. When asked what new technologies or solutions are planned for the next 18 months, the five most-planned activities were: implementing ICS-specific cybersecurity metrics or dashboards (37%); deploying ICS network security monitoring and anomaly detection (33%); rolling out control system enhancements and upgrades (32%); conducting ICS-specific cybersecurity training (31%); and running ICS-specific incident response tabletops or simulations (30%). <\/span><\/p>\n

With the exception of cybersecurity metrics and dashboards, these planned technologies are already in use by nearly half of the respondents. The fact that over 30% more are making plans to use them suggest the industry is on the brink of another jump in implementation in these areas.<\/span><\/p>\n

It’s worth noting that the three least deployed technologies for ICS defense had a “”urprisingly” larger number of respondents planning to invest in them over the next year and a half. Roughly a quarter of respondents have deployed the following technologies and solutions at this time: software bill of materials (25%); industrial cloud security (26%); and security orchestration, automation, and response (28%). A higher than average number of respondents have plans to start using SBOM (28%), industrial control security (23%), and SOAR (30%). <\/span><\/p>\n

The planned rates indicate these technologies may become more common across ICS security programs toon, SANS said.<\/span><\/p>\n

Source<\/a><\/p>\n","protected":false},"excerpt":{"rendered":"

In the SANS State of ICS\/OT Cybersecurity 2024 report, 530<\/p>\n","protected":false},"author":12,"featured_media":6184,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"_jetpack_memberships_contains_paid_content":false,"footnotes":""},"categories":[1],"tags":[809],"class_list":["post-6183","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-dark-reading"],"featured_image_urls":{"full":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/11\/incident-response-anomaly-detection-rank-high-on-planned-ics-security-spending.jpg?fit=1280%2C720&ssl=1",1280,720,false],"thumbnail":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/11\/incident-response-anomaly-detection-rank-high-on-planned-ics-security-spending.jpg?resize=150%2C150&ssl=1",150,150,true],"medium":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/11\/incident-response-anomaly-detection-rank-high-on-planned-ics-security-spending.jpg?fit=300%2C169&ssl=1",300,169,true],"medium_large":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/11\/incident-response-anomaly-detection-rank-high-on-planned-ics-security-spending.jpg?fit=640%2C360&ssl=1",640,360,true],"large":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/11\/incident-response-anomaly-detection-rank-high-on-planned-ics-security-spending.jpg?fit=640%2C360&ssl=1",640,360,true],"1536x1536":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/11\/incident-response-anomaly-detection-rank-high-on-planned-ics-security-spending.jpg?fit=1280%2C720&ssl=1",1280,720,true],"2048x2048":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/11\/incident-response-anomaly-detection-rank-high-on-planned-ics-security-spending.jpg?fit=1280%2C720&ssl=1",1280,720,true],"chromenews-featured":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/11\/incident-response-anomaly-detection-rank-high-on-planned-ics-security-spending.jpg?fit=1024%2C576&ssl=1",1024,576,true],"chromenews-large":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/11\/incident-response-anomaly-detection-rank-high-on-planned-ics-security-spending.jpg?resize=825%2C575&ssl=1",825,575,true],"chromenews-medium":["https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/11\/incident-response-anomaly-detection-rank-high-on-planned-ics-security-spending.jpg?resize=590%2C410&ssl=1",590,410,true]},"author_info":{"display_name":"Dark Reading","author_link":"https:\/\/ddi.mohflo.net\/index.php\/author\/darkreading\/"},"category_info":"Uncategorized<\/a>","tag_info":"Uncategorized","comment_count":"0","jetpack_featured_media_url":"https:\/\/i0.wp.com\/ddi.mohflo.net\/wp-content\/uploads\/2024\/11\/incident-response-anomaly-detection-rank-high-on-planned-ics-security-spending.jpg?fit=1280%2C720&ssl=1","jetpack_sharing_enabled":true,"_links":{"self":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/6183","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/users\/12"}],"replies":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/comments?post=6183"}],"version-history":[{"count":0,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/posts\/6183\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/media\/6184"}],"wp:attachment":[{"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/media?parent=6183"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/categories?post=6183"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/ddi.mohflo.net\/index.php\/wp-json\/wp\/v2\/tags?post=6183"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}