voice of the security technology market Dealing with cyber security risks in the Industrial IoT Alan Grau is President and co-founder of Icon Labs, a leading provider of security software for IoT and embedded devices and he discusses and explores how we might detect and provide counter-measures for security threats on the factory floor in industry. By Alan Grau, President and co-founder of Icon Labs Alan Grau, President and co-founder of Icon Labs. The Industrial IoT (IIoT) provides manufacturers in all industries with greater connectivity that in turn, generates valuable information and intelligence regarding operations. By leveraging this intelligence, they are able to attain significant efficiencies and manufacturing improvements. However, this expanded network also opens up these newly connected devices to significant threats of cyber-attack. As industrial facilities become more connected, hackers are getting more sophisticated, resulting in greater vulnerabilities and increased risk of devastating cyber-attacks. Intrusion detection, the ability to detect when hackers begin probing devices, is a critical first step to building a secure IIoT. Sometimes there are questions about the difference between the IIoT and IT from a security point of view, but they are different for several reasons. First, with IIoT, you have a much larger attack surface. There is a proliferation of connected devices and every new device brought onto the network is a target for hackers. Second, many of these devices are deployed outside of the current IT security perimeter. This creates significant new security challenges. Finally, many of the IIoT devices are embedded systems operating in the cyber-physical realm, which makes protection from cyber-attacks critical. Because they are embedded systems, they require new security solutions – traditional IT and PC security approaches won’t work on these specialised devices. If an IT system is hacked the consequence is usually data loss. This can be significant and costly. However, if an IIoT system is hacked, the damage can be much more serious, even life threatening. The power grid can go down, flights can be grounded, production lines can be shut down, machines can go out of control, and real physical damage can occur. For example, a blast furnace was damaged in Germany due to a cyber-attack. This caused significant financial loss and could have caused injury or loss-of-life. Intrusion Detection Solutions (IDS) for IIoT need to be customised to the nature of the devices. Small devices with limited resources need a solution tailored to the types of attacks they are likely to experience without overwhelming the limited memory and computing resources of the device. At the same time, the sophistication of the Intrusion Detection Solution must scale up to support more powerful gateway and control systems. As a result, it is necessary to build a scalable framework that can support a cybersecurity firms to coordinate their solutions and ensure they are staying current and building appropriate solutions. One of the key elements to a robust solution includes using a hardware platform with hardware security elements as a foundation and “Attackers are becoming more sophisticated over time. They are learning about new vulnerabilities and developing automated attack tools to exploit those vulnerabilities.” wide range of devices and can be easily customised based on the needs of the individual device or network. In all cases, the key is to monitor for, detect, and quickly report anomalous traffic. This requires integration with a security management system where IDS events can be sent and viewed by a human (or potentially an AI engine) to determine if the anomalous events indicate a cyber-attack. To keep up with the current attacks and all aspects of cyber-security countermeasures requires a team of experts. Today, many OEMs are designating an internal cyber-security champion to work with outside experts and implementing secure firmware updates so devices can be updated as security patches become available. Attackers are becoming more sophisticated over time. They are learning about new vulnerabilities and developing automated attack tools to exploit those vulnerabilities. There are cyber criminals who build and sell these attack tools, making them available to anyone willing to pay for them. Unfortunately, there are a large number of bad actors with the motivation and means to launch sophisticated cyber-attacks. They have made millions stealing data from IT networks and they are beginning to turn their efforts towards IoT devices and networks. Securityworldhotel.com top ranked again Based on information published on Alexa.com November 11, 2016, SecurityWorldHotel.com has the best global ranking among online security trade publications in English. Each year Detektor magazine lists the most popular global websites by security trade publishers, based on estimations of traffic by Alexa.com. Alexa.com, which is part of the Amazon group, measures and collects information about traffic on the world’s websites. Based on that information, it provides estimates on the volume of traffic and ranking of web pages. The lower the global ranking number, the the higher the popularity of the site in terms of traffic, according to Alexa.com. – SecurityWorldHotel.com was introduced in 1998 and was the security industry’s first webbased news portal updated each day. So we’ve been around a long time and worked hard to keep Website Securityworldhotel.com Sourcesecurity.com Securityinfowatch Asmag.com Securitymagazine.com the quality of news, comments Lennart Alexandrie, CEO of AR Media International. Here is the global top 5 list of online security trade publications Nationality Sweden UK USA Taiwan USA Alexa Global Ranking 104.428 119,156 176,390 193.608 216.378 Security News Every Day – www. securityworldhotel.com 8 • d etektor internati onal