How organisations can mitigate IoT and IIoT security risks

The digital industrial revolution in the wake of the COVID-19 pandemic has sparked intense growth for the Internet of Things (IoT) and Industrial Internet of Things (IIoT) markets. However, these game-changing technologies have security risks that must be addressed for organisations to reap the full benefits. As organisations increasingly rely on IoT and IIoT to manage critical business systems, finding the right security approach is essential.

IoT and IIoT come with inherent risks because they are often deployed faster than they can be secured. This puts organisations in danger of cyber threats such as device hijacking, data breaches or siphoning, device theft, spoofing, and denial of service attacks. These types of attacks have severe operational, financial, safety and reputational outcomes for organisations.

This is especially concerning because organisations trust technology to gather sensitive data, connect virtual and physical environments, manage production workflows and predictive maintenance, including safety aspects, and dynamically interact with each other. When trusting technology to this extent, it is critical to ensure organisations have the right policies to mitigate risks and reduce the impact of a cyber breach.

A key issue is that IoT and IIoT devices were not designed to be secure, with many having passwords hard-coded into their firmware, making it difficult for security to be patched or updated. Even if security is installed on a device, it can be circumvented in most cases by exploiting a wide range of known vulnerabilities. When IoT or IIoT devices are compromised, IT teams may find it challenging to detect an event before it impacts systems and data.

There are five ways to mitigate IoT and IIoT security risks. As part of this approach, it is important to consider the IoT/IIoT environment holistically and not as separate components or devices.

1. Segment the production environment so that all IIoT and wireless devices sit outside of the supervisory control and data acquisition (SCADA) or industrial control system (ICS) network. In many cases, micro-segmentation is required to only permit authorised communications between devices.
2. Control network access by consistently monitoring what is connecting to the network and verifying each device's security posture before it can be connected.
3. Demand seamless visibility across all networks and devices the business uses for security monitoring and management. This should be centralised so that all devices, networks, risks, traffic, and policies can be viewed and managed across both the production and IT environments in real-time.
4. Use an intrusion protection system (IPS) to help detect attacks and provide virtual patching of IoT and IIoT devices. At the same time, deploy active protection solutions and deception technology to counter unknown threats.
5. Use automatic secure remote access through zero trust so everyone on the network is verified and applications remain secure no matter where authorised users are located.

When adopting security solutions, it's important to ensure they can automatically scale with business needs. This includes adapting to network changes, anticipating and proactively managing threats, and providing real-time threat intelligence.

A new generation of security tools is achieving this by delivering better visibility of the network environment while automatically responding to compromised devices or suspicious activity. These tools directly meet operational and regulatory needs by providing centralised management and a unified context-aware security policy that delivers granular control and visibility across all devices and networks. In this way, both current and emerging IoT and IIoT security solutions can ensure the integrity and protection of assets in the automated organisation, futureproofing it against emerging cyber threats.

*Wavelink is a Fortinet distributor