Back
Network Computing: What You Need to Know About Securing Industrial IoT Networks
Larry Trowell, NetSPI’s Director of IoT and Embedded Pentesting, was featured in Network Computing’s latest article on securing Industrial IoT (IIoT) networks. Read a preview below or view it online here.
+++
Misconfiguration, ransomware, and alert fatigue could lead to downtime on industrial IoT networks in industries such as manufacturing and energy.
As IT, cloud, and industrial networks come together in industrial environments like shipping ports, oil refineries, and factories, organizations are facing new security threats.
In fact, Cisco says 35% of its customers mention security as a top obstacle to IoT. In addition, in the report “The State of Industrial Security in 2022” from Barracuda Networks, 93% of businesses reported that an IIoT/OT security project had failed.
In an Industrial IoT (IIoT) environment, networks, switches, routers, and wireless equipment connect to sensors on physical machinery. Because IIoT networks incorporate automation, they could bring new efficiencies by collecting data at the edge and enabling visibility into issues ahead of time. This process is called the Fourth Industrial Revolution, or Industry 4.0.
“Industrial IoT is basically bringing the [operational technology (OT)] and the IT together to get deeper insights in process telemetry and to use that to really improve the efficiency or deliver new services,” explains Anand Oswal, senior vice president and general manager of network security at Palo Alto Networks, in an interview.
These devices are typically built on a flat Layer 2 segmented architecture, according to Oswal. Flat networks link devices to a single switch rather than separate switches, and Layer 2 is the data layer in the International Organization for Standardization (ISO) reference model for system interconnection.
As “things” get connected, network operators must pay more attention to the attack surface, Oswal notes.
“Threats move laterally, and exposure of formally isolated OT systems may cause potential cyber threats from the IT domain and back and forth,” Oswal says. “Many of these IoT systems are part of larger operations. If these systems are disrupted, there could be loss of important data telemetry that lead to production decisions, poor analytics, or stoppage of operations,” Oswal notes. It could also lead to loss of life.
The Pace of Patching in Industrial IoT
Industries like manufacturing and oil and gas use older legacy systems that are lacking in security systems and were not designed for patching, explains Larry Trowell, director at penetration-testing company NetSPI.
“While these systems get the job done well when maintained, they were not necessarily built with modern security in mind,” he says.
…
You can read the full article at https://www.networkcomputing.com/network-security/patching-vs-uptime-what-you-need-know-about-securing-industrial-iot-networks.
