Cyber-attacks against critical network infrastructure can have severe consequences ranging from operational shutdowns, to damaged equipment, financial loss, and even theft of confidential information. The imminent concern has put world governments on high alert.
The U.S. Department of Homeland Security (DHS) has grown weary over the growing number of cyber-attacks on industrial control networks. To provide clear cybersecurity guidance to organizations implementing IIoT, the DHS published guidelines to “provide a strategic focus on security and enhance the trust framework that underpins the IoT ecosystem.” Among the measures discussed are “considered connectivity” and “defense in depth”.
Enforcing Data Privacy and Security Procedures
IIoT ecosystems need to aggressively enforce cybersecurity strategies for personal networks as well as third-party networks. Recent security procedures from the following companies have fallen short of good practice, putting millions of people at risk.
In 2016, hackers used stolen credentials to gain remote access to the Ukrainian power grid and cut power to 30 substations, affecting 225,000 customers. The hackers even installed custom firmware, deleted master boot records, and shutdown telephone communications.
Another major IIoT attack occurred when hackers breached Target’s network by using malware to penetrate a HVAC company that was working for them. Personal data from over 100 million customers was stolen.
With the rising popularity of connected cars, new vulnerabilities also arise. In 2015, researchers were able to imitate BMW servers and send remote unlocking instructions to vehicles. Jeep also failed security inspections when researchers were able to remotely access vehicles and control everything from the GPS, to steering, to brakes and even engine control. Consequently, 1.5 million Jeep vehicles were recalled.
Defense in Depth for IIoT Organizations
IIoT organizations are advised to adopt a defense in depth approach to help them stay ahead of privacy and security risks. Organizations must have a complete understanding of the function and scope of each individual device. If not, organizations run the risk of activating direct connections to the Internet when they are not needed.
Next, organizations must make a conscious decision about every IIoT connection. At times, connecting to a local network to allow the content of critical information to be analyzed before it is sent is sufficient. Industrial Control Systems (ICS) are complex and critical. It is essential to protect them using defense in depth principles.
Additionally, organizations must build in remote management capability. Manufacturers, critical network infrastructures and service providers must be able to disable network connections or specific ports remotely when needed.
Managed VPNs for Remote Connectivity
IIoT systems are highly attractive to cybercriminals who regard them as the most vulnerable point in the network.
Protection of remote connections on IIoT systems is best managed with Virtual Private Network (VPN) software.
VPNs form a secure connection at the remote IIoT gateway, integrating seamlessly with existing infrastructure and encrypting all data traffic passing to and from individual devices. With VPNs, device patching, updating, authentication and connectivity can all be managed remotely which minimizes any potential threat of cyberattacks.
All IIoT devices accessing a network should have up-to-date firmware and implement network security technologies, such as intrusion prevention systems (IPS) and firewalls along with VPN software.
Not only does VPN software integrate easily with existing corporate systems, it also secures data traffic at device-level. This ensures information stays encrypted and private as it passes between cloud applications, IIoT and mobile devices that access them.
Overall, the issue of IIoT or machine-to-machine (M2M) security is primarily focused on organizations taking adequate precautions to manage and protect data privacy.
To achieve defense-in-depth, IIoT organizations must reevaluate on-demand/always-on access, along with command line or API control. In addition, authentication in the form of software/hardware network certification and central management for remotely configuring devices are vital.
By frequently reviewing network connections, securing every remote connection with VPN management, and ensuring IT operatives follow in depth privacy and security practices, companies will be able to mitigate cybersecurity threats.
About ARC Advisory Group (www.arcweb.com): Founded in 1986, ARC Advisory Group is a Boston based leading technology research and advisory firm for industry and infrastructure.
For further information or to provide feedback on this article, please contact firstname.lastname@example.org
About Your Guest Blogger:
Julian Weinberger, CISSP, is Director of Systems Engineering for NCP engineering. He has over 10 years of experience in the networking and security industry, as well as expertise in SSL ‐ VPN, IPsec, PKI, and firewalls. Based in Mountain View, CA, Julian is responsible for developing IT network security solutions and business strategies for NCP.