Executive Summary
In the rapidly evolving landscape of cyber threats, critical infrastructure sectors such as manufacturing and utilities face unique operational technology (OT) vulnerabilities. With the increasing incidence of cyberattacks targeting these critical infrastructure sectors, the role of employee security awareness has never been more crucial. Jericho Security offers an innovative, AI-generated training solution tailored to the specific needs and threats facing OT. This whitepaper details the pressing need for such targeted training and outlines why Jericho Security is the preferred partner for OT CISOs aiming to bolster their cyber defenses.
Incidence and Financial Impact of Breaches
In 2021, the manufacturing sector experienced 585 security incidents, 270 of which involved confirmed data disclosure, while the utilities sector saw 546 incidents with 355 disclosures. The financial ramifications are considerable, with breaches costing an average of $4.65 million in the energy sector and $4.24 million in industrial settings.
More recently, in June 2023, Cupertino Electric discovered that malicious hackers had gained unauthorized access to their computer systems, exposing the sensitive personal information of 24,684 individuals. The construction company is currently facing multiple class-action lawsuits related to the data breach.
Phishing attempts have been on the rise. A 2024 report from Harvard Business Review revealed that the entire phishing process can now be automated by Large Language Models (LLMs), reducing the cost of phishing attacks by more than 95% while achieving similar success rates as non-artificial intelligence-phishing messages. The global average cost of a data breach is 4.88M according to IBM, a 10% increase compared to last year and the highest total ever.
The Human Factor in Security Breaches
According to the Verizon DBIR, human errors were involved in 98% of breaches in the utilities sector and 82% in manufacturing. These errors typically involved social engineering, system intrusions, and web application attacks. Notable incidents include the 2015 Ukraine power grid attack, initiated through phishing emails, which resulted in significant power outages, and a 2019 ransomware attack on an Alabama medical center that had tragic consequences, emphasizing the severe impacts of OT breaches.
Rising Security Investment
Investment in OT security is projected to grow significantly, from $17.9 billion in 2023 to $38.2 billion by 2028, reflecting an increasing recognition of the cybersecurity challenges in this sector.
Targeting by Nation-State Actors
Manufacturing and utilities are often targets for nation-state actors due to their critical importance. According to the 2023 study conducted by BlackBerry surveying 1,500 manufacturing IT decision makers across North America, UK, Germany, Japan and Australia, 75% of manufacturing IT decision-makers fear nation-state attacks and 65% are concerned about foreign governments spying on their facilities. IBM X-Force Threat Intelligence Index Report showed manufacturing surpassing finance and insurance to take the lead as the most-targeted industry for cyberattackers in 2021, with 23% of cyberattacks targeting manufacturing.
Vulnerabilities in Legacy Systems
The integration of legacy systems with modern networks increases the attack surface, complicating security management. The bringing together of IT and OT systems creates complexities that these organizations are not prepared for. Palo Alto Network’s State of OT Security Report 2024 states that approximately 70% of industrial organizations have suffered cyberattacks in the last year, with 25% of organizations experiencing operational shutdowns as a consequence. The report also pointed to IT as the primary vector for attacks, being the origin of 72% of the attacks targeting OT.
Employee Susceptibility
Many employees in OT lack familiarity with cybersecurity practices, making them vulnerable targets for cyberattacks, especially phishing. Since the OT systems were largely isolated prior to recent years, there is a gap in IT / OT training. In many heavy manufacturing companies, there has been a historical focus on physical safety and production uptime, with less emphasis on cybersecurity. As these workers gain access to integrated IT/OT systems, now they become potential targets for phishing attacks aimed at gaining access to sensitive operational systems.
Customized Training Solutions
Jericho's platform offers customized training that addresses the specific risks and compliance requirements unique to the OT environment. The OT environment is especially heterogeneous, with differing legacy systems and combinations of physical and digital systems. Jericho works closely with CISOs to create tailored video training content for each scenario in a timely manner.
Clients can also independently create AI-generated phishing simulations when new issues arise in the sector. Using Jericho’s product, CISOs can easily generate personalized scam email simulations by providing topics and employee information as inputs. Jericho also provides “pre-texts,” which are topics to be included in the phishing content generation. Pre-texts are updated based on Jericho’s data as well as intelligence shared by the community of Jericho clients. These include topics like “holiday bonuses,” “enrolling health benefits,” etc.
The City of Fort Lauderdale recently was scammed for a $1.2 million payment by what they believed was a legitimate bill from Moss Construction invoice for construction. Unlike traditional security awareness training vendors, like what City of Fort Lauderdale was likely using, Jericho provides the ability to create landing pages for third party vendors to realistically simulate phishing attacks.
Comprehensive Surface Coverage
Jericho is building advanced training simulations, including SMSishing and voice phishing (vishing), to prepare employees for a variety of attack vectors. As phishing attacks continue to evolve in terms of complexity and frequency, it becomes increasingly necessary to keep employees up-to-date with the latest attacks.
Multi-Language Support
Recognizing the diverse workforce in OT, Jericho provides training in multiple languages, ensuring broad accessibility and effectiveness. The product currently supports English, Spanish, and Japanese, with others on the way.
The dynamic and complex threat environment facing the OT sector necessitates a proactive approach to cybersecurity, with employee security awareness at the forefront. Jericho Security's tailored, AI-generated training solutions equip employees with the necessary skills and knowledge to defend against cyber threats. We urge OT CISOs to partner with Jericho to enhance their security posture and safeguard their critical infrastructure.
This whitepaper was published in conjunction with Stanford researcher, JooHo Yeo.