|
While it is possible that some of this increase is due to the fact that the database was started in early 2001, we believe that the bulk of the increase is not. We have found that the event dates of incidents have a low correlation with the submission date, indicating that companies will report incidents long after they have actually occurred. Thus if more incidents had occurred prior to 2002, we would still expect to see a few of them being submitted as late as 2006. Since this is not happening, it appears that sometime between 2001 and 2002 there was a significant shift in incident occurrence rates. As we have noted in earlier papers on ISID, it appears that the time period between 2001 and 2002 marks a significant watershed for SCADA and controls security and is a natural partition for analysing trend data in more detail.
On first reading of the early indicators for 2006, it might suggest a marked decrease in the frequency of cyber attacks against the SCADA and Process Control industry as compared to the 2003/2004 period. However, based on our experience in previous years, this is unlikely to be the case: the time lag between the occurrence of an incident and when it is logged into the database (a mean delay of 13 months) is likely masking the true incident rates for 2005 and 2006. For example, at this point in 2005 only 10 incidents had been reported for 2004 and 15 for 2003; a year later that number had climbed to 23 and 29 respectively. Thus with eight incidents currently reported for 2005, we can assume that by 2007 the incident numbers for 2005 will be of the same magnitude as 2003 and 2004. Figure 2 shows the predicted incident rates from 1994 to 2005 along with a moving average trend line.
Fig. 2. Actual and predicted ISID incidents from 1994 to 2005
« Prev | 1 | 2 | 3 | 4 | 5 | 6 | 7 | 8 | 9 | 10 | 11 | Next »
|
