Commentary: Alvin Lee, Ensign InfoSecurity’s Head of Infrastructure Security
Both industrial Internet of Things (IIoT) and operational technology (OT) belong to the category of cyber-physical systems (CPS) as they share an infrastructure that straddles between the physical and digital world. As such, the cyber risks that these systems are exposed to will continue to grow as more IoT devices become connected to the OT systems. This greatly expands organisations' digital attack surfaces that threat actors can exploit to infiltrate critical infrastructures. At the same time, many OT systems are traditionally designed to focus on safety and reliability, with very little consideration on security by design. Consequently, the confluence of OT and IT systems introduces a plethora of vulnerabilities to IoT/OT infrastructures, and exposes them to an unprecedented level of cyber risk.
The CPS’ vulnerability to cyber attacks, and the huge damage these attacks can potentially inflict on the physical world make these systems very attractive targets to certain groups of threat actors. Any successful cyber attack against IIoT and OT systems can result in grave, real-world consequences, including the loss of lives, safety failures, service disruptions and production downtime.
In 2020 alone, Israel’s water management facilities were hit by two cyber attacks, where the command and control systems of wastewater treatment plants, pumping stations, and sewage were compromised. Honda Motor also experienced a cyberattack that brought global operations to a halt, including the car factories in Ohio and Turkey, as well as at motorcycle plants in India and South America.
Evidently, organisations will need to adopt new cyber security approaches to mitigate the IIoT and OT risks and strengthen their security posture. It begins with formulating a long-term, effective strategy that embraces a fundamental Zero-Trust mindset for users of IIoT and OT systems, and other devices.
Creating a Zero Trust architecture requires organisations to have an in-depth understanding of all IIoT and OT systems on the network, including the identity of every device that touches the network, business context, traffic flows and resource dependencies. This enables organisations to make context-based segmentation decisions that would reduce business risk without unduly impacting availability. Organisations can consider using agentless device visibility and continuous network monitoring for IIoT and OT devices to achieve this.
Organisations should also look at enforcing privileged access to critical IT and OT infrastructure; and segment IIoT devices and OT systems into appropriate zones and conduits to reduce the impact radius in the event of a cyber breach. Additionally, organisations should look at containing vulnerable devices, legacy applications and operating systems that cannot be patched or taken offline within separate zones to reduce the attack surface.