Mitigating IoT and IIoT security risks

The digital industrial revolution in the wake of the COVID-19 pandemic has sparked intense growth for the Internet of Things (IoT) and Industrial Internet of Things (IIoT) markets. However, these game-changing technologies come with security risks that must be addressed for organisations to reap the full benefits. As organisations increasingly rely on IoT and IIoT to manage critical business systems, finding the right security approach is essential.

The IoT market is projected to grow from US$478 billion in 2022 to US$2,465 billion by 2029, while the global smart factory market driven by IIoT is anticipated to reach US$214 billion by 2026. IoT is anticipated to grow to 75 billion connected devices by 2025. Meanwhile, the emergence of IIoT could add US$14 trillion to the global economy by 2030.

Ilan Rubin, CEO of Fortinet distributor Wavelink, said these types of technologies are not without risk, due in many instances to the speed of deployment.

“The increasing prevalence of IoT and IIoT will help organisations to work smarter; however, these technologies come with inherent risks because they are often deployed faster than they can be secured. This puts organisations in danger of cyber threats such as device hijacking, data breaches or siphoning, device theft, spoofing and denial of service attacks. These types of attacks have severe operational, financial, safety and reputational outcomes for organisations.

“This is especially concerning because organisations are trusting technology to gather sensitive data, connect virtual and physical environments, manage production workflows and predictive maintenance including safety aspects, and dynamically interact with each other. When trusting technology to this extent, it is critical to ensure organisations have the right policies in place to mitigate risks and reduce the impact of a cyber breach,” he said.

A key issue is that IoT and IIoT devices were not designed to be secure, with many having passwords hard-coded into their firmware, making it difficult for security to be patched or updated. Even if security is installed on a device, in most cases it can be circumvented by exploiting a wide range of known vulnerabilities. When IoT or IIoT devices are compromised, IT teams may find it difficult to detect an event before it impacts systems and data.

There are five ways to mitigate IoT and IIoT security risks. As part of this approach, it is important to consider the IoT/IIoT environment holistically and not as separate components or devices.

1. Segment the production environment so that all IIoT and wireless devices sit outside of the supervisory control and data acquisition (SCADA) or industrial control system (ICS) network. In many cases, micro-segmentation is required to only permit authorised communications between devices.
2. Control network access by consistently monitoring what is connecting to the network and verifying each device’s security posture before it can be connected.
3. Demand seamless visibility across all networks and devices the business uses for security monitoring and management. This should be centralised so that all devices, networks, risks, traffic and policies can be viewed and managed across both the production and IT environments in real time.
4. Use an intrusion protection system (IPS) to help detect attacks and provide virtual patching of IoT and IIoT devices. At the same time, deploy active protection solutions and deception technology to counter unknown threats.
5. Use automatic secure remote access through zero trust so that everyone on the network is verified and applications remain secure no matter where authorised users are located.

“When adopting security solutions, it’s important to ensure they can automatically scale with business needs. This includes adapting to network changes, anticipating and proactively managing threats, and providing threat intelligence in real time.

“A new generation of security tools is achieving this through delivering better visibility of the network environment while automatically responding to compromised devices or suspicious activity. These tools directly meet operational and regulatory needs by providing centralised management and a unified context-aware security policy that delivers granular control and visibility across all devices and networks. In this way, both current and emerging IoT and IIoT security solutions can ensure the integrity and protection of assets in the automated organisation, futureproofing it against emerging cyber threats,” Rubin said.

Image credit: ©stock.adobe.com/au/Michael Traitov