Technology & Innovation

Preventing the Internet of Things turning into cyber arsenal

July 11, 2017

Global

July 11, 2017

Global
Andrew Cooke

Head of Consulting

Andrew Cooke is Head of Consulting in Airbus’ cyber-security business. He joined to lead their industrial controls cyber security team in July 2016, taking over the lead of the consulting practice as well in December 2016. Before joining Airbus Andrew spent fifteen years in a series of senior security roles in Atkins.

Andrew established Atkins’ Security and Intelligence practice in 2006 before moving to Abu Dhabi in 2009, to lead their Infrastructure Management Consultancy practice in the region. He returned to the UK at the beginning of 2013 and has been part of the team leading the development of Atkins’ Security business bringing together their extensive capability in the design and development of physical, personnel, cyber and industrial control systems security. 

 

 

 

 

Technical evolution has seen manufacturing move from manual production lines, through mass production via assembly lines, to the adoption of computers and automation. As working practices continue to evolve, our manufacturing plants are moving into what is being described as ‘Smart Factories’ or ‘Industry 4.0.’

Utilising the ‘Internet of Things’, or IoT as it is more commonly known, cyber-physical systems monitor and control physical processes, feeding the resultant data back into dashboards that are supervised by people. When functioning correctly, the derived savings both in time and human labour are immense, but could it come at a hidden price?

What is Industry 4.0?

Cited as the next phase in modern manufacturing, Industry 4.0 is the integration of physical components with software components in operational technology (OT). This amalgamation unites the Industrial Internet of Things (IIoT,) in real time via the wireless web i.e. cloud computing, with cyber physical systems capable of monitoring the factory’s physical processes.

The implementations are far reaching - from creating smart grids, to guiding autonomous vehicles and creating robotic plants – all with minimal input from human operators.

The benefits from Industry 4.0 are equally enticing. For hostile working environments - such as dusty, hot or intoxicating conditions- health and safety risks could be improved upon, if not eradicated from the negation of human intervention. Similarly, improvements in efficiency and productivity could be realised from consistent monitoring and computer controlled assessments that potentially identify issues before they become a problem. Many organisations could potentially increase revenues, profit margins and their advantage over competitors.

However, as with any change in working practices, it’s not without its challenges.

The Lessons Learned from Mirai

The Mirai IoT malware powerfully demonstrated how damaging lax security practices can be. In October 2016, several high-profile websites were inaccessible due to a Domain Name Server attack.  Consumer IoT devices – from digital video recorders, CCTVs, routers and various other appliances were all compromised by malicious code that used factory set credentials [default username and passwords that were left unchanged] to recruit the devices to a Botnet. This army of infected internet-connected devices was then used to launch the Distributed Denial of Service attack against the internet performance management company Dyn, rendering Amazon, Twitter, PayPal, Spotify and many other major websites inaccessible.

With Industry 4.0, physical entry terminals all have IoT embedded into them, which in turn are integrated with the credentials database – and it’s this integration that poses a risk, potentially providing an unlocked door that allows attackers to compromise these IoT devices, creating a cyber arsenal to mount attacks against the network and compromise internal management systems, or firing attacks out across the internet.

Are there warning signs to monitor for?

Currently, across all organisations and sectors, there are various attacks happening all the time, it’s just few are disclosed publicly – intentionally or otherwise.

The challenge is that it’s extremely difficult to identify attacks in an OT environment. While monitoring services exist for OT environments they have limited application due to the necessity for network zones, or segmentation. This means that sensors need to be placed at a number of different layers within the network in order to monitor activity. Another contributing factor is complacency, even if network traffic is being captured. Many organisations are completely focused on getting systems up and running again, rather than mining through vast data sets to determine categorically what went wrong.

Cyber-security best practices

As organisations adopt Industry 4.0 working practices, cyber security is increasingly paramount. As cyber criminals continue to ply their trade, looking for connecting IIoT devices to compromise, slamming these backdoors closed is a priority.

With that in mind, here are five cyber security best practices to minimise the risk of IIoT devices:

Default credentials: Mirai and Brickerbot highlight the risk posed from factory set usernames and passwords. Before connecting a device, ensure that these credentials have been reset.

Patching: When code flaws - i.e. zero day vulnerabilities, are found in software, updates will be released. Organisations need to determine how these can be implemented and rolled out to affected devices within the environment.

Network maps: Understand the complete profile of the network. This includes defining how OT and IIoT is connected and the risk that exists within the process.

Asset identification: Determine what processes and assets are critical to the organisations ability to operate and what the threat vectors might be.

Upskilling: Understand the blue-collar workforce and how working practices have changed. Many now use technology to perform tasks, so make them aware of the cyber threats they face. For example, engineers should not be able to just plug in a USB stick without first checking that it is free of malware and its operating system is up to date.

In cyberwar threat actors are continuously testing and probing to see what a target’s response is, and will enhance their threat to break through defences put in place actually work. It’s a continuous process of intelligence gathering and attack defence.

Compromising a nation’s key assets will greatly undermine the ability of the country to keep working. The WannaCry outbreak is one example that highlighted just how disruptive an impact this type of attack can have on nation states, as well as global businesses. Many victims of the ransomware attack were desktop computers running unsupported operating systems, and representing the human machine interface with key control systems running healthcare, infrastructure and major manufacturing systems.

 

The views and opinions expressed in this article are those of the authors and do not necessarily reflect the views of The Economist Intelligence Unit Limited (EIU) or any other member of The Economist Group. The Economist Group (including the EIU) cannot accept any responsibility or liability for reliance by any person on this article or any of the information, opinions or conclusions set out in the article.

Enjoy in-depth insights and expert analysis - subscribe to our Perspectives newsletter, delivered every week