Firms are diving deep into the IoT security challenges as CIOs need to be aware of the results of integrating Operational Technology (OT) devices, which often work in isolation, with other IT technologies
As per Gartner’s prediction, by 2020, almost 50% of OT service providers will create key partnerships with IT-centric providers for IoT offerings. But, this integration comes at the cost of risking security.
Also read: Future Tech Jobs That Do not Exist Yet
OT security threats are rising at an alarming rate
In August 2019, Bahrain’s Electricity and Water Authority reported hackers shutting down critical infrastructure systems. Unlike the common breaches or thefts that have become common, this attack was on a different scale, targeting the OT devices.
OT hardware and software devices monitoring or control physical devices mostly deal with computing technology which is entirely separate from the IT world. As entrepreneurs seek to collect information from OT devices aiming to modify and optimize the manufacturing process, many appliances are brought online. This creates problems of adapting to the new environment or the OT security challenges that come with it.
Historical problems faced
OT systems were designed to work in isolation, and never met the need for the same level of security as IT devices.
Their operators historically relied on an existing air gap between the networks of devices, but such gaps no longer exist. Also, the IT infrastructure is not yet prepared for the massive scale of OT devices joining its network. The IP/TCP protocol is 45 years old and is primarily created for connectivity, and not for OT security. The OT/IT convergence has expanded the attack surface, increasing risks exponentially.
Traditional solutions were architected and designed to protect simpler, smaller networks connecting servers to endpoints. These would be frequently updated as security vulnerabilities were discovered. These shortcomings have a massive impact because traditional OT devices are typically less secure than IT endpoints, and are harder to patch or update. They also allow for remote control of critical infrastructure — in addition to data exfiltration. It’s no longer regarding data loss, but also losing control of operations.
Also read: Organization Losing Confidence in IoT Security
Experts suggest that the current VPN layers and firewalls only protect north-south network traffic, such as incoming internet connections, but they miss out on east-west communication. This indicates that once hackers manage to penetrate a network, they can quickly escalate their attack and access the entire system. In cases of traditional security tools being used, the resulting network becomes too complicated – and the complexity is always in the hacker’s favor, as it leaves opens more opportunities for them to exploit.
New methods to protect
The Internet Engineering Task Force tackled the risks associated with TCP/IP having host identity protocol (HIP). It is an IPv6- and IPv4-compatible trust protocol that only responds to connections that have been authorized and authenticated, effectively enforcing micro-segmentation.
Changing an entire network of devices will require significant upgrades, which can be very expensive and time-consuming. And in this whole process, security should be given utmost priority.
IoT will continue to expand, and businesses will find more value in bringing their devices online and enjoy the automation, the analytics and data they can collect. But as the existing technologies were not prepared for this, CIOs need to be aware of the new challenges that come along with OT security and how to resolve them.
For more such updates follow us on Google News ITsecuritywire News. Please subscribe to our Newsletter for more updates.
