Security: The Key to Successful IIoT Deployment
Security: The Key to Successful IIoT Deployments
The Industrial Internet of Things (IIoT) has been a hot topic of late. One key consideration that will impact its acceptance rate and ultimate success is security. A successful attack on an IIoT system could result in the loss of sensitive data, interruption of operations, and destruction of systems. This will result in damage to brand and reputation, material economic loss and damage to critical infrastructure. Worse, there could be damage to the environment, injury or loss of human life. A secure IIoT solution is comprised of a variety of elements, including secure products, secure protocols, a secure network, ongoing security monitoring, and employees with cybersecurity expertise.
Secure Protocols
IIoT systems may feature new connection techniques that will require secure communication protocols. It is important to consider two key concepts when discussing secure protocols – encryption and data integrity/authenticity. Encryption can be used to secure protocols, but it can inhibit other security appliances like Intrusion Detection Systems. Data integrity and authenticity can be provided without encryption, enabling intrusion detection systems.
Legacy systems utilized insecure communications protocols. Communications protocols are evolving to incorporate security enhancement - DNP3 has moved to DNPV5, OPC-UA, Modbus® is evolving to Modbus Secure, and EtherNet/IP™ is becoming EtherNet/IP Secure. Selection of secure protocols is required to enhance solution security.
Permeation of Trust in the IIoT Lifecycle
Trust in the IIoT lifecycle refers to both the integrity of each element in a system and the integrity of data generated by the system. Trust impacts supply chain, installation, configuration, regular usage, and eventual decommissioning - requiring regular monitoring to ensure that trustworthiness is preserved throughout the product lifecycle.
Let’s use an example to illustrate the permeation of trust model. Assume an end user is purchasing a PLC with secure features. The PLC vendor purchases microprocessors and memory from component vendors who ship their products to manufacturing sites. Product software can be developed at vendor development facilities or purchased from partners. Products are fabricated and shipped to warehouses. Equipment can then be shipped to distributors or system integrators prior to shipment to end users. In this example, we have multiple organizations handling the hardware/software. There is the potential for security issues to be introduced at any of these locations. End users must have trust in the integrity of the supply chain providing system components. Permeation of trust between system operators and suppliers is key to the security of IIoT systems.
Acquiring Cybersecurity Expertise
One challenge facing many industrial end users is cybersecurity expertise. Industrial personnel have developed core competencies focused on optimizing processes. Small- to medium-sized companies in particular may have difficulty internally building cybersecurity expertise. Equipment vendors and system integrators can be leveraged to cost-effectively provide cybersecurity expertise. Vendors effectively merge industrial control and cybersecurity expertise – many IT-based consultants lack OT expertise. Vendors will also have the expertise to guide end users in the selection of data that should be pulled from the process.
Another key consideration is training to effectively operate a system after it has been activated. Tips to effectively operate, monitor, and update processes need to be implemented. Guidance on proper corporate security policies is also critical.
Cloud Considerations
Cloud services enable external computing power to be utilized to analyze and control OT infrastructure. In a cloud architecture, data from thousands of devices is stored, analyzed, and accessed from a server. The cloud infrastructure can be located within the corporate network, or outside the network operated by a partner. Many end users are implementing an internal cloud model. Data pulled from the IIoT would be gathered and stored on equipment residing in the corporate network. Housing data on internal equipment connected to a network controlled by the end user helps to safeguard potentially critical data.
Using an external partner creates a number of trust boundaries that can impact security and privacy. Information must be protected for both privacy and security. For example, stolen credentials could allow attackers to access critical data. Moreover, attacks on other cloud customers hosted by the partner may propagate.
About the Author: Fabrice Jadot first joined Schneider Electric in 1997, focusing on motor control within R&D as part of the variable speed drives activity, which became a joint venture with Toshiba in 2000 named Schneider Toshiba Inverter. In 2012, he joined the corporate side of the company as the Strategy and Innovation Platforms VP, dealing with cross-business technology platforms in the domain of digital services, supervisory control, and embedded control. Today, he is the Chief Technology Officer for Industry business driving automation system architecture, cybersecurity, and automation digital transformation (Industrial Internet of Things, Industry 4.0, etc.). In 2015, he became a board member of ODVA, an international association comprised of members from the world's leading automation companies. He enjoys traveling, especially visiting historical sites and architectures, along with wine tasting and walking.