The adoption of Industrial Internet of Things (IIoT) networking technologies into industrialized environments is increasing. As industrial organizations ramp up their investments in Internet of Things (IoT) technologies, so grows the interest of cyber attackers. Electrical power plants, oil and gas mining, and manufacturing floors are a few industrial verticals adopting smart technologies into daily operations. A recent report states this market to be worth $320 billion by 2020.
Decision-makers who integrate smart technologies into their traditional industrialized infrastructure may realize several benefits:
- Increased operational efficiency within industrial controlled environments
- Widespread visibility and foresight of failure through data analytics
- Faster incident response times
- Quick response and agility to changing market demands
IIoT adds data gathering sensors to industrial machinery like temperature gauges, gas sensors, conveyor belts, and others. This data is passed along to automation services, predictive maintenance tracking software, and other analytics services. Use of IIoT sensors in manufacturing equipment and pairing those sensors with software allows companies to predict when equipment will fail, and it gives them the opportunity to fix small problems before they become bigger ones. Through strategic implementation of IIoT sensors, industrial companies can adopt a proactive approach versus a reactionary one when addressing equipment failure and analyzing equipment performance.
IIoT VALUE COMES AT A COST
As technology has evolved, so has the intelligence and sophistication of cyber terrorists and their tactics. A 2017 analysis of industrial cyber-attacks by Kaspersky Lab determined that 39 percent of industrial companies worldwide were attacked during 2016 and more than 20 percent of industrial control devices are attacked each month.
According to the Federal Communications Commission (FCC), the two most common threats to IoT technologies are Denial of Service (DoS) and Intrusion. Additional threats include:
- Sophisticated command and control attacks
- Packet spoofing
- Hijacking of sessions / interception
- Replay attacks
- Use of worms
- Trojans and remote controllable Trojans (Back Orifice)
- Use of a Virus and Anti-forensic techniques
- Attacks on Domain Name System (DNS) infrastructure
To combat these threats, industrial companies should take an identity-centric approach to security that assures only verified users and devices gain access to the network and sensitive resources.
NETWORK ACCESS CONTROL – IIoT SECURITY’S BEST FRIEND
Security practitioners of IIoT should consider a Network Access Control (NAC) solution as an essential piece of their security plan. Protecting IoT endpoints means preventing unauthorized access and intrusion into managed networks through visibility and enforcement.
Through NAC visibility tools, managed and unmanaged IoT devices are dynamically identified and classified. Administrators gain operational insight to all resources on their networks. Enforcement is implemented to prevent unauthorized access to the network and data. Devices are also remediated based on a centralized policy before being allowed network access.
Common policy rules for IIoT devices should include:
- Access restrictions based on time of day and week
- Role (e.g. admin, user, guest)
- Physical MAC Address
The security policy should be flexible to rapid change, and restrictive to thwart the most clever of cyber attackers. The result is that only authorized users or devices have access to the right information.
SECURE ACCESS FOR TODAY AND THE FUTURE
From electric utilities to manufacturing plants, to oil refineries and air traffic control, expansion for industrial companies and critical infrastructures shouldn’t come at the price of security. Security teams should invest resources into devising standards that include use of a NAC solution to identify through visibility and enforce policy and remediation of all IIoT endpoints. This should be just one of several major milestones in the evolution of the IIoT security plan.
It is not a matter of ‘if’ a cyber-attack will happen, rather a question of ‘when’ the next attack will occur. Increased levels of automation and use of data analytics to improve processes and streamline efficiency and identify problems will continue to drive industrial companies to expand their IIoT footprint for the foreseeable future. With this should come an invested expansion into Secure Access today to keep up with the future of IoT. Learn more at https://www.pulsesecure.net/