{"id":4582,"date":"2023-11-10T16:49:10","date_gmt":"2023-11-10T03:49:10","guid":{"rendered":"https:\/\/ostermanresearch.com\/2023\/11\/10\/sans-2021\/"},"modified":"2025-03-11T06:37:49","modified_gmt":"2025-03-10T17:37:49","slug":"sans-2021","status":"publish","type":"post","link":"https:\/\/ostermanresearch.com\/2023\/11\/10\/sans-2021\/","title":{"rendered":"SANS report from 2021 on cybersecurity in OT\/ICS"},"content":{"rendered":"\n

In August 2021, SANS published a report on cybersecurity<\/a> in OT (operational technology) and ICS (industrial control systems) environments. The findings are based on a survey of 480 organizations in relevant industries. <\/p>\n\n\n\n

Among many other things, respondents were asked if they’d experienced one or more security incidents involving their OT\/ICS environment over the previous 12 months. 15.1% said yes. See the graph on page 8. On the next page, there are two additional graphs – the number of incidents in the past 12 months (with 42.9% saying “less than 10”) and an assessment of how disruptive the incidents were (with only 9.5% saying “no impact\/disruption”).<\/p>\n\n\n\n

We often use something we call “midpoint analysis” in creating averages. This means looking at the distribution of answers for the various answer options, and multiplying the midpoint of each answer option (e.g., the midpoint of “1 to 5 hours” is 3 hours) by the frequency with which the respondent said “that’s me.” If 25% chose the 1-5 hours answer option, then the contribution to the overall midpoint is 3 hours x 25%, or 0.75 hours. Once we’ve done this for the remaining 75% of respondents, we sum the contribution of each answer option to get the overall midpoint.<\/p>\n\n\n\n

We ran this with the numbers for incidents and disruption in the SANS report – see below. <\/p>\n\n\n\n

\"\"<\/figure>\n\n\n\n

From the above, we’d state the following. For the 15.1% of respondents that suffered at least one security incident in the previous 12 months:<\/p>\n\n\n\n