Announcing the 2016 IIoT Bold Prediction Series!
The year 2015 is soon coming to an end as the year 2016 looks to be ushering in exciting new ways in which the Internet of Things (IoT) is changing our way of life. It’s easy to see these transformations taking shape on the consumer side (home automation, smart appliances, connected cars, personal computers, smart devices, etc.), but what will 2016 hold for the Industrial IoT (IIoT) space? (Note: Go here for a quick rundown on the difference between consumer IoT and industrial IoT) 2016 IIoT Bold Prediction Series As stated in our introductory blog post (Are We All on the Same Industrial IoT WaveLength?), we at FreeWave Technologies are thrilled for the future of the IIoT and what it means for the entire business ecosystem. That is why we are excited to present the “connected world” community with a bold prediction in IIoT each day this week – aptly named the 2016 IIoT Bold Prediction Series! We of course encourage everyone to contribute your perspectives and experiences – whether in response to our predictions or a submission of your own – to help advance the dialogue around the emergence of the industrial internet. Our first bold prediction in the series comes from Glenn Longley, Regional Manager of Energy Markets at FreeWave: Prediction #1: Major Security Breach of Industrial SCADA System Brings New Focus to IoT According to Longley, “There will be a major security breach of an industrial SCADA system in 2016, which will drive industrial organizations to shift more of a focus on IoT and newer, more secure communication systems.” If you may not already know, cyber attacks against supervisory control and data acquisition (SCADA) systems are not new. In fact, Homeland Security Magazinereported earlier this year that “Cyber attacks against industrial targets—including power plants, factories and refineries—increased 100 percent in the past year, according to a new study conducted by computer technology company Dell.” Additionally, IT World Canada reported on a new InfoSec survey by the SANS Institute in 2015 where, “Both the degree of uncertainty and the rising number of known incidents are red flags calling for the dedication of greater resources to monitoring, detecting and analyzing anomalous activity in control system networks.” The survey also found that only 65 percent said vendor qualification of security technologies and solutions to be either highly important or mandatory. So with a proliferation of new cyber attacks seemingly happening more frequently, Longley explains how this widespread issue will impact IoT adoption in industrial businesses in the coming years: “Each company is different in how it handles the influx of IoT and the resulting IT/ OT convergence. With the merging/blending of Information Technology (IT) and Operations Technology (OT), the firewall that separates the two becomes more complicated and less well-defined. Traditionally, each was a separate entity; however, with IP-enabled devices and blending of technologies in enterprise networks, that dividing line becomes less clear. IT and OT professionals themselves might put a different emphasis on security, but in 2016, the two will need to come together (more than ever before) to prioritize security in their quest to create end points for all of their field assets. Therefore, security will ultimately be the limiting factor on how much IIoT is deployed.”
IT Security Dynamics and the Industrial IoT
The quest to understand production and operational factors, distribute this information to business systems and people within an organization, and directly improve business processes and profitability as a result is not new. In fact, it has been embraced by companies for decades. This collection of operational information for use in information or business systems is known as IT/OT convergence. Getting IT and OT systems to work together to maximize business efficiency — while avoiding negative consequences, risks and pitfalls in the process — is a tall task. However, thanks to new technologies, this process is becoming more practical and is creating the opportunities for huge economic benefits when these two disciplines are successfully integrated. But, how does this convergence affect the security paradigm in large, geographically dispersed enterprises? Let’s Talk Security Traditionally, companies have a corporate firewall that divides the corporate IT space from OT space. With an Internet of Things (IoT) communications network, there is a need to protect the sensors and new applications on the OT side. However, even if there is a secure communication link, if the individual devices that are connected on the OT side become compromised and the threat has access to that communication link, a hacker can push malicious data, cause denial of service (DoS), or introduce malware or viruses to the entire network. There are many of ways to run into problems on the IoT front if companies are not careful in their network design security implementation. On the IT side, corporate network security typically sees many threats. Those threats require significant attention, and consequently IT organizations have numerous options and tools to use, such as intrusion detection, log monitoring, network behavior monitoring, network inspections, whitelisting, firewalls, and more. The IT space has a much different attack surface than OT because with an IT network, the company can physically secure the building and control where the data goes in and out. Data escaping the building is relatively small in comparison to the OT space. WiFi that is leaking outside the building could be a vulnerability, but there are tools and ways to lock down that type of threat, and checkpoints where the IT department can analyze the traffic going through the network. In IT, bandwidth is plentiful and the network overhead associated with security is generally not a major factor. Considering Industrial IoT Networks IIoT networks, on the other hand, can span many miles with potentially hundreds of thousands of data points. An IIoT network likely consists of small embedded devices with long lifespans, making it very efficient. However, they are generally not like the Windows operating system, which is consistently conducting massive updates. Some embedded technologies don’t allow any updates, making it essential to carefully select the best devices for a network. Having thousands of these edge devices is where organizations will begin to see IT/OT convergence – many more points in the field where threats could be coming into the IT network. Industrial organizations today are creating a connected infrastructure with IP-enabled sensors or IP/IIoT-enabled Access Gateways. The data generated by sensors at an asset location can be valuable to more than just the central control system. This might mean M2M communication with sensors talking directly to each other. It may mean that multiple systems consume the live, real-time sensor data directly from the field. It may even mean that operators connect their sensors directly to the cloud or other back office systems. If there is a way to share critical data while addressing security issues that can help provide information to key data users, then that information becomes increasingly valuable. Security Through Obscurity is Not a Solution IIoT solutions often utilize the widely deployed security technologies from the Internet to avoid the custom, one-off solutions of past industrial security, when it was used at all. IP technology makes it easier to deploy and talk to sensors, but it also makes it easier for intruders to see and snoop on valuable data streams. Security through obscurity is not a solution. There are many common attack vectors for industrial devices that become even more relevant when considering the IIoT infrastructures and fully networked, geographically dispersed projects.
Today’s IIoT Security Challenges
For decades, Supervisory Control and Data Acquisition (SCADA) systems have played a significant role in industrial operations. Industries like oil and gas, electric power/smart grid, agriculture and utilities have implemented SCADA systems and networks to collect data and automate processes, and are always looking to automation systems for more effective ways to operate. The ability to collect more data from geographically dispersed field assets in remote locations has driven the need for enhanced communication technologies. With the emergence of continuously improving wireless machine-to-machine (M2M) technologies, networks have more access to data points than ever before. The number of sensors and data points collected will continue to rise dramatically with improved connectivity. This collected data helps operators improve operational decisions, save manpower and, in many instances, keep employees safe by avoiding dangerous environments. Today, industrial network operators are increasingly implementing end-to-end Internet Protocol (IP) connectivity or the Internet of Things (IoT), enabling more capabilities at the edge of these networks. This does not make SCADA systems obsolete by any means; it opens the door to greater possibilities of enabling new applications and analytics with every single data point being captured in the system. So What’s the Security Tradeoff? There are many implications for the concept of a completely connected enterprise in terms of network security. Critical infrastructure projects are only as reliable and secure as the technology serving them. Security, therefore, will ultimately be the limiting factor on how much IoT technology is deployed. With security, the traditional trade-off is either “easy to use” or “secure”— but not both. We often consider a third tradeoff as well of features, though in most cases, operators are not willing to trade off features, but it is certainly part of the equation. An operator striving for an Industrial IoT (IIoT) network must look at SCADA security, the convergence of Operations Technology (OT) and Information Technology (IT), and make a thorough assessment of what will allow them to achieve a secure data communications network. Some of the top security challenges for the IIoT today include: With more data being transported than ever before, it’s important not only to secure assets, but to secure the communication link itself. Traditionally, SCADA systems have been on the outside of a firewall from the corporate IT network. Newer SCADA systems that use Ethernet devices are more security focused with measures such as VPN, secure sockets, encryption and dedicated log-ins on the devices. One Final Thought There are many benefits to the concept of a completely connected IoT system, but this also implies more crossover between IT and OT systems. Companies need to prioritize security in their quest to create end points for all of their field assets. Some industries, like the smart grid, are already experiencing mandates that ensure a more cyber-secure network. With others, however, it is still up to the organization to make security a top priority.