CS1907

industrial cyber security
MULTIPLE CHALLENGES
How do you stop a wave of innovation from
becoming a tsunami? Cyber security
specialists will know this dilemma well,
acknowledges Mike Nelson, VP of IoT
Security, DigiCert. "The IoT promises to
revolutionise not just how we live at home,
but how we do business and, more
importantly, how we provide those critical
resources that society runs on: gas, water,
electricity and so on. Given the opportunities
that are being offered to seemingly every
level of society - who could say no? Then
again, a cyberattack on a Fitbit is a very
different thing to a cyberattack on a water
treatment facility."
Securing each, he adds, will take very
different efforts and before we even start
doing that we're presented with several
problems. "First, critical assets were built for
failure, not attack. The legacy systems that
run those facilities have often been doing
so for many years and were never created
to withstand a cyberattack, let alone an
attempt to penetrate their pitiful security by
the concerted effort of a nation state. As we
fill in the decades-old airgap between critical
assets and the internet, we are introducing
them to a whole environment full of threats
that they are largely unprepared for."
Secondly, there’s the simple, well-known
fact that the IoT is insecure. Just behind the
rapturous applause for the IoT's arrival has
been a quieter, but no less impassioned,
warning about its vulnerabilities, Nelson
states. "Throughout this period, there has
been little oversight - government or
otherwise - as manufacturers have produced
insecure devices and retailers have sold them
on to an eager public. That insecurity could
have to do with the whole device or it could
have been inserted along the often long and
labyrinthine supply chain that these devices
are assembled on. Even if a manufacturer
says their product is secure, there are plenty
of potential points of failure from the factory
floor to the customer's hands."
And we are only beginning to address
these problems now, he says. "A variety of
governments and industry bodies are
attempting to introduce regulation and
standards that seek to protect this wave of
innovation. Though these efforts are
encouraging, they are not going to patch
over mistakes already made and they won't
pay the security debts that have already been
racked up by the over-eager adoption of
insecure technology. Hopefully, the
regulation stick will lead to better, more
standardised, approaches to IoT security."
That insecurity is not going to be solved
soon and new vulnerabilities will always crop
up, but device manufacturers can use
technology available now to protect devices,
suggests Nelson. "Public Key Infrastructures
[PKI] with digital certificates, for example,
are already being used to secure IoT
devices from the factory floor to use
across distributed networks. PKIs' ability to
authenticate device identities, protect the
integrity of code and firmware updates, and
encrypt data are proven to be scalable and
are interoperable. Well-run PKIs can police
the connections between large networks of
devices and that makes them a good fit for
industrial IoT."
MULTIPLE CHALLENGES
The supply chain for IoT products is often
so complex that it's hard to trace - let alone
make reasonable security judgements about.
"Just because a vendor can vouch for the
integrity of its supplier and that supplier can
vouch for the integrity of its manufacturers,
it doesn't mean that trust, or even security
considerations, are present at all of the
critical stages of development," says Scott
Gordon, CMO, Pulse Secure. That problem
becomes bigger when we're talking about
the IIoT (Industrial Internet of Things) - "not
because the supply chain is less trustworthy,
but because human safety is inextricably
linked to cyber security".
Defending these often undependable
devices is just as much of a problem for the
Mike Nelson, DigiCert: critical assets were
built for failure, not attack.
John Titmus, CrowdStrike: firmware and
hardware-level visibility is the best option
for protecting the supply chain.
www.computingsecurity.co.uk @CSMagAndAwards July/August 2019 computing security
31