Defending the Industrial Internet of Things

In 2016, hundreds of thousands found themselves without power following a cyberattack on a major Ukrainian energy plant north of Kiev. The attack targeted a specific digital relay with malware that resulted in broad system failure. Specifically, the exploit succeeded by compromising “[f]irmware used by Serial-to-Ethernet converters -- which connect industrial equipment to computer networks.” This digital relay and the subsequent intermediating firmware are perfect examples of a growing trend known as the Industrial Internet of Things. The Ukrainian plant failure also stands as an early example of IIoT devices being exploited as a security vulnerability. But what exactly is the Industrial Internet of Things and how can critical infrastructure stakeholders approach cybersecurity to avoid networking security incidents such as this?

What Is the Industrial Internet of Things?

‍

For many years, the Internet of Things (IoT) has described the proliferation of network connected devices – traditionally sensors. Everything from thermostats to security cameras, smart lightbulbs to heart monitors are becoming internet devices and assigned independent IP addresses. The IoT phenomenon has focused on commercial products and serving individuals by augmenting consumer IT networks. In parallel, however, a similar phenomenon is being seen within industrial settings far removed from consumer products. In particular, sensors within operational technology (OT) networks are being integrated into other networks to increase efficiency within industrial control systems. This is the Industrial Internet of Things (IIoT).

Of course, industrial systems have long relied upon complex networks of sensors. Historically, however, these sensors have lacked networking capabilities – or simply been contained within a discrete OT system. Recent trends, however, have led to an increased demand in network-connected sensor systems. There are many reasons for this demand. For example, enterprises are pushed to collect larger, faster, and more accurate data sets to increase efficiency and producers are working to collapse distance between production and end user requests. Whatever the cause, modern industrial demands are being aided by network connected sensors of all shapes and sizes. Furthermore, the leading accounting firm PricewaterhouseCoopers estimates that IIoT will “dwarf the size of the consumer IoT by several magnitudes.” This is supported by a 2020 study within the Journal of Computers & Electrical Engineering which found that “in 2023 the share of IIoT in the global market will be approximately 14.2 trillion US Dollars.”

Networking Security Implications

From this macro trend comes three specific implications for industrial network operators: merging OT and IT systems, an expanded vulnerability surface, and an increase in the importance of asset visibility and monitoring capabilities.

1. The merging of OT and IT systems more closely together
   In the past it was not difficult to distinguish between operational and information technology systems. It was possible to draw simple distinctions between operational technology on the factory floor and information technology on computer databases. Where interaction was necessary, it was often limited. As sensors are expected to communicate directly with IT systems, however, this is no longer the case. The IIoT trend is changing the networking paradigm by making each sensor into an information processing unit. As a result, there is more difficulty in making clear distinctions between OT and IT systems, and the respective cybersecurity teams will need to collaborate more closely.
2. Expanded vulnerability surface
   Before the rise of IIoT, it was possible for most operational technology systems to be self-contained. Many OT devices were not intended to communicate with external networks. While this limited functionality, it also limited the threat surface of most industrial operations. Within the emerging paradigm, each new network-connected sensor becomes a potential entry point for a cyberattack. This was seen in Ukraine, where a smart digital relay was leveraged to translate an attack from the “computer networks” to the “industrial equipment.”
3. An increased need for asset visibility and monitoring
   Prior to the IIoT model, there were fewer “entrances” and “exits” within a single OT network. Communication into and out of the OT network was, therefore, easier to manage. In the IIoT model, however, each individual sensor becomes a gateway into the OT network. For this reason, asset owners must create an exhaustive inventory of OT devices. The alternative is to risk the growth of “shadow IT” or unindexed connections within a system. This in turn could develop into a critical threat vector that can be used by malicious actors.

‍

In short, the IIoT is an exciting development within industrial environments. At the same time, security stakeholders need to understand the important networking security implications. Ignoring any of these risks could destroy the productivity gains of the IIoT model due to the costs of a cyberattack. To help mitigate this, OT cybersecurity teams must implement the five foundational security controls:

• Hardware inventory of all assets
• Software inventory for all assets
• Configuration management
• Vulnerability monitoring
• Event log management

Industrial Defender is already safeguarding IIoT systems around the world by automating OT asset inventory and data collection, managing asset configurations, visualizing which assets are vulnerable to attack, and monitoring the network and endpoints for security events.

FAQs

Why is the IIoT important for industries?

‍This will enable industries to collect and process data from various origins in real time. This information can be utilized to identify possible problems that arise, enhance production processes, and make better-informed choices. By attaching equipment to the internet firms can obtain valuable insights leading to higher effectiveness and ultimately saving time and money.

What are the security threats of IIoT?

The key security risks associated with IIoT include multiple entry points for cyber threats. Every internet-connected device or sensor deployed in an industrial environment becomes a weak link that can be exploited by hackers. As well, as Operational Technology (OT) increasingly converges with Information Technology (IT), there is an increased risk of cyber attacks crossing over networks.

What measures must companies take to protect their own IIoT systems?

Securing IIoT systems requires robust cybersecurity measures employed by industries. This involves keeping an updated list of all devices connected; regular software/firmware updates; access controls and encryption; as well as network monitoring for unusual activities. Additionally, it should be noted that there is a need for highly capable training of staff members who are aware of the challenges of securing industrial control systems.

‍Conclusion

The industrial internet of things is transforming industries in a way that enhances efficiency, productivity, and decision making based on data. Nevertheless, security issues have to be dealt with which are inevitable with any new technology. Understanding possible weak points and putting in place strong cyber security measures will ensure that the industry gets the best out of IIoT while minimizing chances of being attacked by hackers or unauthorized access to their data.

Remember not to address cybersecurity issue as an event because it is an ongoing process. As the IIOT keeps on changing, sectors should always be alert and also change their security approaches to tackle rising threats. It is through collective responsibility and priority in cybesecurity can we make sure that IIoT remains a vibrant platform for increased industrial activities instead of becoming a potential threat.

To learn more about how you can apply foundational controls in your IIoT environments, check out our CIS Controls Implementation Guide here.