Cyber Defense eMagazine May 2019

Whether it’s malicious outsiders or employee sabotage, the stakes are much higher in the industrial
internet of things, where business continuity and personal safety are both at risk. And the rapid increase
in IIoT devices has expanded the attack surfaces and threat vectors the cybersecurity industry is facing
on a daily basis.
IIoT Cybersecurity: A Great Concern
Cybersecurity is not always considered as a top priority during an IIoT product's design phase. Because
the IIoT is a burgeoning market, many product designers and manufacturers are more concerned with
rapidly getting their products to market, instead of taking the necessary steps to build cybersecurity in
from the start. From default passwords to a lack of computing resources necessary to implement effective
cybersecurity, many IIoT devices do not or cannot offer adequate cybersecurity protection features.
As a result, bad actors are scanning for IIoT vulnerabilities at a frenetic pace. In fact, according to “The
CEO’s Guide to Securing the Internet of Things,” experts have seen a dramatic 458 percent increase in
IoT vulnerability scans against devices since 2013, with scans representing adversaries looking for
weaknesses in your network defenses.
While the analysis and distribution of collected information and data is essential for device developers
and manufacturers to derive predictive models, managing the overwhelming amount of data remains a
privacy concern as well. The expectation of the public is when companies handle data, they will handle
it securely. Unfortunately, as recent high-profile examples have illustrated, that notion is not aligned with
reality.
Today, the IIoT focus is primarily on integration and convergence across industrial verticals. As such,
implementing a robust cybersecurity program for IIoT requires a complicated combination of architecture,
technical and integration controls as well as adaptation of traditional cybersecurity platforms. And while
executing a credible approach to cybersecurity is one thing, the ongoing operational management of
authentication credentials and operations, especially for large deployments of non-homogenous devices,
is equally important.
Automation
Traditional cybersecurity does not always work with IIoT device deployments. For example, IIoT platforms
struggle to verify the authenticity of 10,000 IIoT devices when they don’t have associated users to enter
a user name and password. A major challenge is keeping IIoT devices updated and secured throughout
their lifecycles.
As IIoT device adoption increases, automation becomes an essential component of cybersecurity.
Automation is crucial when you think about the vast number of connected devices and applications in our
daily lives. Because it’s impractical to manage the configuration of 10,000 devices manually, we need to
step out of the traditional IT mindset that a human is going to “touch” a device to harden it from a
29