Understanding the Risks of IIoT: Strategy Considerations for Securing the Digital Factory

What a secure IIoT strategy can do for manufacturers

Industrial control systems (ICS) have been described as the "Wild West" of cybersecurity. Industrial environments were traditionally closed off, or "air gapped," from core IT systems, but now typically feature a blend of information and operational technology (OT) systems. These often rely on plant networks, connected ICSs and Supervisory Control and Data Acquisition (SCADA) environments. For many organizations, these systems have been in operation for years without being subject to the same upgrade and replacement cycles as their IT systems are just getting connected to the outside world for the first time.

As this integration of IT and OT (creating the foundation of the digital factory) takes force, the risk of network breach can have significant – potentially catastrophic – consequences. According to Fortinet, nearly six in 10 organizations using SCADA or ICS industrial control systems have experienced a breach in those systems in the past year. Industrial leaders therefore need to be aware of the risks posed by ever-more connected environments – and plan accordingly.

Damage on an industrial scale

The process of digital transformation has brought greater complexity to corporate networks, in turn impacting network security. The convergence of IT with OT is accelerating, and consequently compliance and risk management are an increasing concern for many organizations.

According to Don Rogers, Industry Practice Manager, Manufacturing, WWT, "Industrial systems are at the heart of what matters most to manufacturers – making sufficient quantities of quality product in a safe and efficient manner. Connecting these previously isolated systems provides tremendous value for companies, but also exposes them to new risks.

There have already been several cases that show the potential impact of an industrial cyber breach. For example, the NotPetya attack in 2017 caused a global meltdown resulting in more than $10 billion in damage. This attack affected not only enterprise IT systems, but wreaked havoc on industrial systems. Nordic shipping company A.P. Møller-Maerskhad its entire global network brought to a standstill by the attack. This company alone experienced damage amounting to between $250 million and $300 million.

WannaCry, a precursor to NotPetya, also caused massive damage in manufacturing environments. Renault-Nissan reported disruption at five of its plants, where infected IT systems had to be unplugged from the network to prevent their spread.

And, as we have heard, the damage can extend beyond the logical realm. In Germany, a cyber attack on a steel mill resulted both in the locking of its IT systems, and in physical damage. Control systems were manipulated to such a degree that a blast furnace could not be properly shut down, resulting in destruction of equipment.

Shifting priorities to cyber security

The seriousness of these potential impacts mean priorities must change. Management of ICS has traditionally had a focus on availability and safety. Security hasn't been a major priority, principally because the vulnerabilities of these systems were relatively limited and deemed more hypothetical than real. Highly visible, costly and widely-publicized breaches in manufacturing have occurred, bringing greater awareness of the risks. A separate Fortinet study found that 48 percent of all data breaches are now caused by the hacking of web applications, and 90 percent of companies with connected OT environments have experienced a security incident.

According to Tony Atkins, Nozomi Networks UK&I Sales Director, "Today's business leaders are expected to protect the entire organization beyond enterprise IT systems, including OT environments. To keep critical systems running and protect the financial results and reputation of an organization, it is essential to improve industrial cyber security."

An analysis of the most prominent cyber attacks that occurred over the past five years across a variety of industries, conducted by Nozomi, shows that OT systems were frequently impacted. Industry sources confirm that regardless of the type of malware deployed, victims suffer business disruption, information loss, revenue loss and equipment damage. As these control systems are now connected into broader IT networks, security is emerging as a critical threat to safety and availability, pressing companies to develop and execute industrial cyber security strategies.

New systems, new threats

The inter-connected and inter-dependent nature of the digital factory leaves a fertile ground for attackers to exploit. Control systems are increasingly being targeted by IT-based threats developed with the specific purpose of conducting OT attacks. Cyber criminals attack ICS and SCADA systems with the goal of demanding a ransom after disrupting or taking control of critical industry infrastructure. As such, these OT systems are becoming the weakest link in the industrial security chain.

Digital factory connected architecture

Rick Peters, Director Operational Technology, Fortinet, says, "For cyber criminals it is often about gaining access through the simplest of means – even an unwitting insider. Social engineering attacks, often via email, have therefore proved popular means of gaining credentials and escalating privileges. Once within the network, the source attacker can bridge to an entirely different target environment beyond the OT system."

And it's not just external "hackers" that pose risk. Manufacturers must also be alert to the danger of third parties that provide support for their production lines – either remotely or in person at their plant. These third parties access the customer's network out of necessity, creating dependencies. If they are infected, the potential for contagion presents tremendous risk for the manufacturer.

Challenges in creating alignment around the digital factory

The challenge of designing security for a digital factory environment is compounded by the difficulty in aligning IT and OT teams. The former is typically well versed in cyber security, with tasks such as patching systems and maintaining firewalls and anti-virus software already part of their role. The latter has usually had a greater focus on maintaining the uptime of systems and ensuring operational safety.

Manufacturers need to change the conversation if they are to create a safe and secure environment. These teams must start to focus on the same business objectives and work to the same operating models.

The issue of alignment then extends to an executive level. Understanding and addressing operational risks requires many stakeholders – from boardroom to IT to manufacturing. These are stakeholders that typically haven't worked closely together before. They have diverse backgrounds, experiences, expertise and priorities. IT must quickly learn the business of manufacturing, and manufacturing must quickly learn the risks they face and how technology can be safely applied to address those risks.

It's therefore the responsibility of industrial executives to look at every element of their critical systems to understand how, when and where to implement stronger security controls. Boards and executives must champion the critical cyber aspect of manufacturing digitization and be prepared to make significant investments to protect what matters most: sustained operations of the machines that produce revenue and the safety of the workers operating the machines.

Securing the digital factory

Industrial systems today are more connected than ever. The nature of these connected networks – many of which are being exposed to cyber security risk for the first time – means an exploited vulnerability can have significant implications for both the organization's network and for the connected production systems. Industrial organizations therefore need to update and consolidate their security approaches in order to protect critical digital factory infrastructure.

The risks organizations face are far greater in an industrial context than those posed in other industries due to the hazardous nature of compromised machinery and physical infrastructure. As globally oriented attacks of the scale of NotPetya are when, not if, scenarios, decision makers must work to align OT and IT teams, and show they've taken every step to ensure they're not the weak link that creates the next major security epidemic.