「英中对照」霍尼韦尔提示：不成熟的楼宇系统易引发网络攻击及停机

This audio is auto-generated. Please let us know if you have feedback. 本音频为自动生成。如您有反馈，请告知我们。

Dive Brief:Dive 简报：

• Cybersecurity incidents involving building systems and other operational technology are on the rise, yet few organizations are ready to deal with an incident or have even completed an inventory of their vulnerable assets, according to a survey by Honeywell Technologies.涉及建筑系统和其他运营技术的网络安全事件正在增加，但鲜有组织做好应对事件的准备，甚至完成易受攻击资产清点的组织也寥寥无几，据 Honeywell Technologies 的一项调查。
• The average downtime reported was 16.2 hours for respondents’ most significant cybersecurity incidents involving operational technology, with 21% of incident-affected respondents estimating downtime costs above $100,000 per hour, according to the survey of 603 cybersecurity leaders, compliance and risk executives and plant and operations managers conducted earlier this year. 今年早些时候对 603 名网络安全负责人、合规与风险高管以及工厂和运营经理开展的调查显示，受访者遭遇的涉及运营技术的最重大网络安全事件平均停机时间为 16.2 小时；在受事件影响的受访者中，21% 估计停机成本高于每小时 $100,000。 
• Legacy or unsupported systems are the most common source of cyber risk exposure, with 45% of those affected by incidents ranking legacy systems as a top contributor to downtime, per the report.报告称，遗留系统或不受支持系统是网络风险敞口的最常见来源；在受事件影响者中，45% 将遗留系统列为造成停机的首要因素。

Dive Insight:Dive 洞察：

“OT environments increasingly intersect with systems that control physical processes, support facility operations and protect people and assets,” Honeywell says in the report. These systems include field devices and controllers, safety systems, HVAC and chillers, switchgears, elevators and fire panels, physical security systems, building management systems and connected IoT devices. Honeywell 在报告中表示：“OT 环境正日益与控制物理过程、支持设施运营并保护人员和资产的系统相互交织。这些系统包括现场设备和控制器、安全系统、HVAC 和冷水机组、开关设备、电梯和火灾报警面板、物理安防系统、楼宇管理系统以及联网 IoT 设备。 

Downtime is the most common consequence of cyber incidents, with over half of respondents reporting operational downtime and production disruption. Cyber incidents can also affect worker safety, disrupt service and create compliance pressure, the report says. 停机是网络事件最常见的后果，超过一半的受访者报告出现运营停机和生产中断。报告称，网络事件还可能影响工人安全、中断服务并造成合规压力。 

“When critical systems go down, production can stop and safety can be compromised. Lost revenue may follow,” Honeywell says in the report. “OT security maturity is ultimately measured by whether organizations understand their attack surface, limit incident impact and restore operations quickly.”Honeywell 在报告中表示：“当关键系统发生故障时，生产可能停止，安全可能受损，收入损失可能随之而来。OT 安全成熟度最终要以组织是否了解其攻击面、限制事件影响并快速恢复运营来衡量。”

Many building systems are vulnerable due to equipment operating under legacy BACnet standards. The standard was introduced in the 1990s without security protocols because the systems weren’t network-connected at the time, according to cybersecurity firm Armis from ServiceNow. Patches for vulnerabilities are slow to be implemented at many organizations because of the systems’ crucial role in building operations. 许多建筑系统因设备在遗留 BACnet 标准下运行而存在漏洞。据来自 ServiceNow 的网络安全公司 Armis 称，该标准于 1990 年代推出时未包含安全协议，因为当时这些系统未连接网络。由于这些系统在建筑运营中发挥关键作用，许多组织的漏洞补丁实施进展缓慢。 

“Critical infrastructure cannot simply be taken offline,” Armis said in a recent report. “The remediation backlog grows faster than teams can clear it.”“关键基础设施不能随意断网停运，”Armis在近期一份报告中表示。“待修复积压问题的增长速度超过了团队的清理速度。”

Mature OT cybersecurity programs must identify these at-risk building systems, bring them into the security scope, monitor and govern them and prepare to recover them if they are breached, Honeywell says. Honeywell指出，成熟的OT网络安全方案必须识别这些面临风险的建筑系统，将其纳入安全范围，对其进行监控与治理，并做好系统遭到入侵后的恢复准备。 

Yet only 16% of respondents say their organizations continuously monitor more than three-quarters of their building automation systems, with only 20% doing so for connected IoT devices. 但仅有16%的受访者表示，其所在机构会对超过四分之三的建筑自动化系统开展持续监控，仅有20%的机构对联网IoT设备执行此类监控。 

While most organizations have some level of OT security maturity, with 88% of respondents describing their OT security programs as planned or design-led and 80% citing strong coordination between IT and OT teams, only 33% say OT is fully integrated into an enterprise security operations center, according to the report. And only 21% have a complete asset inventory, which Honeywell says is essential for effective monitoring, detection and recovery. 该报告显示，尽管大多数机构的OT安全成熟度达到一定水平，88%的受访者称其OT安全方案处于规划阶段或以设计为导向，80%的受访者表示IT与OT团队之间协作紧密，但仅有33%的受访者表示OT已完全整合至企业安全运营中心。此外仅有21%的机构拥有完整资产清单，Honeywell表示这是实现有效监控、检测与恢复的必要条件。 

Honeywell says organizations need to know which aging or unsupported assets are connected across production, building, and IoT environments, noting that legacy risk cannot be managed if operators can't see aging assets. Honeywell表示，各机构需要掌握生产、建筑及IoT环境中接入的老旧资产与不受支持资产的情况，并指出如果运维人员无法查看老旧资产，遗留风险就无法得到管控。 

“A complete, continuously updated inventory is the starting point,” the Honeywell report says. “Segmentation, continuous monitoring and recovery planning help keep those systems from becoming a persistent source of exposure.” “完整且持续更新的资产清单是工作起点，”Honeywell的报告指出。“分段、持续监控与恢复规划有助于避免这些系统成为持续的风险暴露源。” 

Organizations should conduct compliance audits, which are shown to help with recovery in the event of a cyber incident, per the report. Forty-four percent of respondents whose organizations passed all audits say they are “fully recovery-ready,” compared with just 26% of those whose organizations had audit failures or findings. 根据该报告，各机构应开展合规审计，合规审计已被证明有助于网络事件发生后的恢复工作。所在机构通过全部审计的受访者中，44%表示自身“完全做好恢复准备”，而所在机构存在审计未通过或审计发现问题的受访者中，这一比例仅为26%。 

Tested backups, documented response programs and clear ownership are useful as audit evidence and also support restoration under pressure, Honeywell says.Honeywell表示，经过测试的备份、记录完备的响应方案以及明确的责任归属既可用作审计证据，也能够支撑压力下的系统恢复工作。