Research by both the Koninklijke Metaalunie and PCW reveals that many companies in the manufacturing industry are watching the rise of the Industrial Internet of Things (IIoT) with a wait-and-see attitude. This is not only a shame in view of the numerous opportunities, but also unwise, as IIoT has actually long since made its appearance. It is 'here to stay'. Therefore, there is no other option but to embrace it. I would be happy to help you on your way.
Current digitalisation is cited as one of the key drivers for the growth of the Dutch manufacturing industry. The IIoT is an important part of this. If you want to exploit these technologies, you cannot avoid the security issue with an eye on your business continuity and laws and regulations. The roadmap below will help you get a solid foundation for the security of your IIoT environment. First, we briefly explore the forest of relevant abbreviations, how they relate to each other and what impact they have on security.
IoT & IIoT versus IT & OT
The Internet of Things (IoT) refers to all devices that connect to digital networks to exchange data. IIoT is a part of this and specifically concerns devices and machines connected within industrial environments. As such, IIoT touches both information technology (IT) and operational technology (OT). We see that the rise of IIoT contributes to further convergence between IT and OT, as more and more connections to the outside world emerge from OT environments, sometimes through the IT domain but also regularly directly to the internet. This development thus brings challenges, in addition to new opportunities such as predictive maintenance. Especially when it comes to security. When hackers shut down your electric toothbrush, that is already annoying. When they can gain access to vital infrastructures such as those of the drinking water supply or power plants, things get really tricky.
1. Awareness
A future-oriented policy on IIoT is step one, and that starts with awareness. Many companies already have (I)IoT in place, consciously or unconsciously. And this without the organisation having a clear understanding of what IIoT entails, how you want to use it as an organisation and how it can be used securely. This creates a business risk that is often underestimated. It is important to include cyber security as an integral part when working out the business strategy, and like everything else, this starts with the awareness of the people within the organisation. They need to understand why cyber security is important to achieve the desired business objectives and what the risks are if this is not done in the right way. An IIoT (security) awareness programme is a good solution for this. This programme aims to make employees at all layers in the organisation aware of the (possible) role of IIoT, the expected benefits for the organisation, as well as the policies and cyber security aspects that affect business continuity. It is common that people do not realise how many connected devices are connected to their network, or which ones they are. Less obvious smart devices can pose an unexpectedly high risk. Consider, for example, the remarkable hack of a casino in America, in which their database was stolen via their aquarium's thermometer, which had a connection to the company network.
2. A robust, resilient architecture
Once you have a clear understanding of what how IIoT will strengthen your business strategy, it is important to also make this infrastructure robust and resilient. It should not only work on paper, but also in practice. The starting point here is to develop a good architecture that, if implemented properly, can stand the test of time and is flexible enough to remain robust and resilient. This may sound simple but is difficult in practice. After all, IIoT is usually woven into existing infrastructures. The most important thing is to build the infrastructure with proper segmentation of the network, called 'zones and conduits'. The premise here is that the infrastructure is robust and resilient and will not go down with every random attack or unintended incident. Zoning also ensures that in case of any contamination via, e.g., IIoT devices, the vital parts of the network remain protected.
In addition, setting up clear procedures for making changes and keeping the overview of network components and the devices/machines linked to them up to date. If you want to get it absolutely right, these devices should also be subject to security testing and certification. The combination of these measures ensures that your investment in IIoT applications is actually going to facilitate further business growth.
3. Testing devices, applications and other end points
Ultimately, the current security level can only be determined by actually testing the infrastructure. It will then become clear whether the security measures have been adequately implemented and also whether you need to take additional measures. In any case, it is advisable to carry out this type of penetration test regularly. After all, your strategy and your suppliers' promises may look great on paper, but practice is more difficult. Implementation is not always done as agreed on paper and constant changes also take place in the management phase. In addition, the external threat landscape also changes regularly. Simple vulnerabilities can thereby lead to annoying and even dangerous situations. Most of these incidents do not make the news, others do. For example, it was recently reported that hackers had access to garden sprinklers, allowing them to drastically influence the local water supply. Hackers who (potentially) accessed the infrastructure of energy companies are also regularly written about. To be really sure your infrastructure is secure enough, you can only 'know by measuring'.
4. Incident response capability
If you have followed the above steps, you have laid a good foundation. In practice, however, there is no such thing as 100 per cent watertight security. There always will be. It is therefore essential that you have incident response capacity in place, available in case of incidents. And then also for the industrial domain. Some organisations already have such a capacity for their IT environment, but for the industrial domain this is hardly invested. Such a consists, on the one hand, of a trained team with knowledge of the networks, systems, applications and protocols used within an industrial environment and, on the other hand, out procedures to identify and analyse any incidents as timely as possible. Again, you need to realise that the approach from the IT environment does not work 1-to-1 for the industrial domain. Having a team and good procedures is important to be able to act as adequately as possible and minimise the potential impact of incidents.
IIoT offers numerous opportunities. We see industries like the oil & gas industry, but also the energy and chemical industries actively exploring it. Which opportunities are in store for you is pie in the sky. However, it is a given that smart devices have long found their way to your organisation and will only find more in the future. Now it is up to you to deal with them smartly and safely.
