Back in 2010, a nuclear plant in Natanz, Iran, fell victim to the Stuxnet malware that targeted Simatic Step 7, a software product for configuring and operating programmable logic controllers (PLCs). The attack allowed hackers to exploit the PLC units across the factory and damage almost one thousand uranium enrichment centrifuges, delivering a severe blow to the country’s nuclear program.
In the case of Iran, this was not necessarily a bad thing; we don’t really want more nuclear weapons around, do we?
But imagine it was your factory, your equipment worth several million dollars apiece, and your reputation at stake.
It’s always useful to put things into perspective, right?
What we’re driving at here: your business cannot afford to take cybersecurity lightly. Particularly, if you operate in highly competitive sectors like manufacturing and supply chain management. And especially if your company has tapped into the Internet of Things software development – just like 72% of your rivals.
From detecting anomalies in equipment performance before failures occur to monitoring inventory levels in real time using RFID tags and BLE beacons, there are many exciting IIoT applications and benefits to consider. And just as many ways your IIoT solution could compromise your entire IT infrastructure, leading to the following consequences:
- Damaged machinery
- Production downtim
- Accidents on the factory floor
- Data breach
- Reputational damage
- And direct and indirect financial losses caused by all of the above
What are the key factors putting IIoT security at risk – and how could your company foresee and solve the Industrial Internet of Things security challenges before disaster strikes?
Let’s solve the riddle together!
Rundown of IIoT security faults and challenges
For clarity’s sake, let’s define the Industrial Internet of Things and its technology components before zooming in on IIoT security implications.
The IIoT term refers to the interconnected network of machines, sensors, controllers, and systems that communicate and exchange data with each other and central platforms in industrial settings.
Such cyber-physical systems combine elements of traditional industrial equipment with connectivity, data analytics, and data visualization. Companies turn to IIoT consultants to monitor manufacturing and warehouse operations and automate single processes or entire workflows.
Behind the scenes, the Industrial IoT has the same architecture as every other Internet of Things solution, although edge IoT deployments where data is analyzed closer to sensors prevail in industrial settings.
Companies tapping into IIoT may procure brand-new equipment enhanced with sensors and supporting connectivity by default or upgrade existing machinery using custom and off-the-shelf IIoT retrofit kits.
From the Industrial IoT security standpoint, why is it important to understand how IIoT systems function behind the scenes?
IIoT security issues can manifest themselves at every tier of your cyber-physical system – from programmable controllers to legacy apps containing unpatched vulnerabilities. To mitigate IIoT security risks, your company should thus protect all endpoints on your wired or wireless network, secure data in transit and at rest, and patch security loopholes in applications comprising your IT infrastructure.
Without further ado, let’s investigate what factors undermine security in IIoT solutions – and what you can do to shield your cyber-physical systems from these threats.
Challenge #1: Unsecured communications
Connectivity technologies are the backbone of all IoT systems, no matter the complexity and area of application.
In industrial settings, as more devices and sensors go online, more endpoints, communication channels, and data storage solutions emerge. And this calls for a very diverse and, preferably, balanced mixture of data and networking protocols meeting specific IIoT security requirements.
Currently, up to 98% of all IoT traffic is unencrypted, meaning hackers can easily bypass the first line of defense – e.g., by learning a user’s login and password via a phishing attack – and lay their hands on your company’s data.
Poor encryption practices stem from using legacy communication technologies, such as Modbus, Profibus, and DeviceNet. In fact, most of the legacy IIoT communication protocols lack data encryption capabilities altogether, forcing IoT developers to look for workarounds, such as implementing VPNs and secure tunnels or gateways and addressing encryption issues at the Secure Sockets Layer (SSL)/Transport Layer Security (TLS) level.
Solution
To secure data exchange between the components of an IIoT solution and thus prevent the Industrial Internet of Things security accidents, we recommend you implement a fail-proof connectivity tech stack consisting of:
- Reliable data protocols. In Industrial IoT, data protocols determine how information is structured, encoded, and interpreted by devices. If your company opts for a wired IIoT deployment, you could facilitate data exchange between connected equipment and gateways through the Ethernet protocols, such as Profinet, EtherNet/IP, and Modbus TCP/IP. While these protocols do not inherently support data encryption, your IIoT developers can still make data unreadable to third parties by implementing the TLS/SSL tech stack at the transport layer or introducing intermediary devices, such as secure gateways or firewalls, between connected devices and the network. Should you look for a more flexible data protocol for IIoT and industrial automation solutions, we highly recommend the OPC Unified Architecture (OPC UA) protocol, which supports end-to-end encryption, employs X.509 digital certificates for device authentication, and can be used in both wired and wireless IIoT solutions. When building wireless IIoT systems, the ITRex team usually sticks to Message Queuing Telemetry Transport (MQTT), Constrained Application Protocol (CoAP), Advanced Message Queuing Protocol (AMQP), WebSockets, or RESTful APIs with HTTPS. These modern protocols offer encryption capabilities through TLS/SSL or Datagram Transport Layer Security (DTLS) and help establish secure communication channels between connected equipment, gateways, and cloud servers. For more information about data protocols and their impact on Industrial IoT security, book a free consultation with our R&D team.
- Secure networking protocols. Unlike data protocols, which mostly deal with information exchange and interoperability, network protocols define rules, standards, and procedures for how devices are connected, how data is transmitted, and how the components of an IIoT system interact within a network. From the Industrial IoT security standpoint, networking protocols can be attractive targets for hackers. Some reasons for that include limited access control and authentication mechanisms and a lack of data encryption capabilities. Depending on your network architecture – i.e., point-to-point, star, or mesh patterns – and intended use cases, you can utilize various networking protocols to address IIoT security challenges. These protocols span Data Distribution Service (DDS), Low Power Wide Area Network (LoRaWAN), Zigbee, WirelessHART, and Narrowband IoT (NB-IoT). To select the appropriate connectivity tech stack meeting all of your IIoT security needs, it is important to consider the type of cyber-physical system you’re looking to build, the required data transmission range, and power consumption requirements. This can be done during the discovery phase of your IoT project.
Challenge #2: Inadequate software update practices
Unlike computers, tablets, and smartphones, IoT devices do not support endpoint security systems, such as antivirus programs – simply because they often run highly customized or outdated embedded software or are specifically designed to be small and energy-efficient.
While you can partially solve Industrial IoT security challenges by introducing firewalls, intrusion detection and prevention (IDP), and device control mechanisms at the network level, upgrading the applications constituting your IIoT software ecosystem to the latest version becomes critical for resolving possible IIoT security issues.
Speaking of IIoT software, we need to draw the line between embedded systems, such as firmware, middleware, and operating systems (OSs), and ordinary software – think web, desktop, and mobile applications facilitating device management.
Due to IIoT device design constraints and a large number of endpoints within a cyber-physical system, patching IIoT software security vulnerabilities is a task few industrial companies can address. That’s why up to 65% of manufacturers still use outdated operating systems ridden with zero-day security vulnerabilities.
Solution
To mitigate IIoT cybersecurity risks, an industrial company must have an efficient software update management mechanism in place.
Here at ITRex, we are strong advocates of software and firmware updates over the air (OTA). In this scenario, a cloud-based platform powered by AWS IoT Device Management, Azure IoT Hub, or pre-configured SaaS solutions like Bosch IoT Rollouts automatically delivers software updates to edge devices, controllers, and gateways.
A properly configured device management platform will also keep better track of your device fleet, optimize update rollouts considering device-specific settings and security requirements, and notify your IT team in emergencies.
Challenge #3: Poor physical security measures
Network IIoT security aside, a cyber-aware industrial company should also prevent cybercriminals and malicious insiders from stealing hardware with the goal of scanning the devices’ interior and infesting them with viruses and spying programs.
Insufficient physical security measures not only compromise the integrity and confidentiality of sensitive data, but also lead to service disruptions, operational downtime, and financial losses. The repercussions of physical security vulnerabilities can extend beyond the immediate impact, potentially endangering public safety and critical infrastructure.
Solution
To address the poor physical security issues in industrial IoT, a multi-faceted approach is required. Here’s what your company should do as part of the physical IIoT security overhaul:
- Prioritize the implementation of robust access control mechanisms. This includes measures such as role-based access control (RBAC) to connected equipment, biometric authentication, computer vision-powered video surveillance, and the implementation of intrusion detection systems
- Conduct regular physical security audits and risk assessments. The Industrial Internet of Things security audits help identify vulnerabilities early on and develop appropriate mitigation strategies. This proactive approach enables organizations to stay one step ahead of potential threats and take preventive measures to safeguard their IIoT systems. In practice, this means disconnecting devices with evidence of tampering from the network, hiding manufacturer markings on the devices, and, when possible, removing unnecessary IIoT solution components to prevent reverse engineering events
- Implement comprehensive employee training programs. Raising awareness about physical security risks and best practices is key to fortifying the Industrial Internet of Things cybersecurity (more on that later). Collaboration between IT and physical security teams is also vital. This partnership ensures a holistic approach to security, where both digital and physical aspects are considered and synchronized to provide robust protection against emerging IIoT security threats.
Challenge #4: Limited visibility into device and network activity
Up to 90% of organizations report having shadow IoT devices on their network, with 44% of the respondents admitting those devices were connected without the knowledge of their security or IT teams.
As a result, companies are unaware of which devices communicate with each other, what information they gather and exchange, and whether this information is inaccessible to third parties.
And the fact that IIoT security audits stretch far beyond identifying hardware solutions by their IP and operating system only complicates the matter.
Solution
There are several steps you could take to achieve device and network visibility in IIoT deployments:
- Analyze all network communications using deep packet inspection (DPI) solutions
- Collect exhaustive device information, including hardware type, model, serial number, and embedded system versions
- Group your devices based on their type, function, mission criticality, and potential IIoT security risks
- Create virtual local area networks (VLANs) for every device group to enhance traffic visibility and control
- Make use of reliable device management platforms, such as AWS IoT Core, Azure IoT Hub, and PTC ThingWorks, to improve device inventories, monitoring, configuration, update rollouts, and troubleshooting
Challenge #5: Insufficient employee training and cyber-awareness
As we’ve mentioned earlier, a lack of collaboration and coordination between information technology (IT) and operational technology (OT) teams can result in poor IIoT security management practices.
While equipment operators and factory managers properly care for connected machines, they know little about the embedded and connectivity technologies that power them. IT teams, on the contrary, are well-versed in traditional information security but tend to treat IIoT solutions like ordinary hardware.
This may lead to low patch levels, limited visibility into network activity, and misconfigurations of the Industrial Internet of Things systems. Additionally, cybercriminals may exploit your employee’s limited knowledge of IIoT security best practices through phishing attacks and impersonation. Your team may also choose weak passwords or reuse passwords across applications, which may open a backdoor to your IT infrastructure, undermining IIoT software security.
Solution
Here’s a high-level plan that could help your company raise cybersecurity awareness among employees:
- Create training programs specifically tailored to the Industrial IoT environment. These programs should cover topics such as cybersecurity fundamentals, IoT device security, secure configuration practices, password hygiene, recognizing and reporting potential security incidents, and compliance with internal security policies and procedures.
- Conduct regular training sessions to ensure employees stay up-to-date with the latest cybersecurity threats and best practices. This can be done through workshops, seminars, webinars, or online training modules in your learning management system (LMS). As part of the training activities, for instance, you could teach your staff to recognize and respond to IIoT security threats through phishing simulations and penetration testing. You should also tailor training programs to specific job functions, ensuring that employees receive the training relevant to their responsibilities. For example, IT staff may require more technical training, while operational employees may need training on secure device usage and physical security.
- Develop comprehensive policies and procedures that address the unique Industrial Internet of Things security challenges. Communicate these policies effectively to employees and ensure they understand their roles and responsibilities in maintaining security. Regularly review and update these policies as technology and threats evolve.
- Promote a culture of IIoT security awareness and accountability throughout the organization. Encourage employees to report any security incidents or suspicious activities promptly. Emphasize that cybersecurity is everyone’s responsibility, from top management to frontline staff, and reward employees for demonstrating good security practices.
- Consider partnering with external Industrial IoT experts or consultants to conduct security assessments. External experts can bring valuable insights, industry best practices, and the latest threat intelligence to enhance employee training programs. Additionally, they could help you bring the so-called “security by design” practices into the IIoT software development process and elicit functional and non-functional requirements for IIoT deployments.
On a final note
IIoT adoption rates have soared in recent years – and so have the high-profile attacks targeting critical IIoT infrastructures in the industrial segment.
According to a recent survey from Check Point, in the first two months of 2023, 54% of companies suffered IoT-related attacks, with an estimated 60 attacks per week per organization (41% up from last year). Among the devices most susceptible to hacker attacks were routers, network video recorders, and IP cameras – in short, hardware that comprises the backbone of every company’s IT infrastructure.
Even if your IT team follows IIoT security best practices throughout the development and implementation process, there’s no guarantee hackers won’t exercise control over your equipment and data by exploiting vulnerabilities in apps and devices outside the IIoT ecosystem. That’s why your company needs an all-embracing security strategy – and here’s what ITRex can do for you!
Whether you’re considering launching an IIoT pilot or need help scaling an Industrial IoT proof of concept (PoC) across other use cases, drop us a line! We’re well-versed in business analysis, embedded system engineering, cloud computing and DevOps, and end-user application development.
The post IIoT Security Challenges & Tips to Navigate Them appeared first on Datafloq.
