Steve Durbin
Managing Director, Information Security Forum
Cyberattacks continue to become more innovative and sophisticated. Unfortunately, while organizations are developing new security mechanisms, cybercriminals are cultivating new techniques to evade them. Along with the growth in the intricacy of cyberattacks, our dependence on the internet and technology has expanded as well.
The Internet of Things (IoT) has exploded into today’s connected world; from enabling the digital organization, to making domestic life richer and easier. However, with those promises come inevitable risks; the rush to adoption has highlighted serious deficiencies in both the security design of IoT devices and their implementation.
Coupled with increasing governmental concerns around the societal, commercial, and critical infrastructure impacts of this technology, the emerging world of IoT has attracted significant attention.
While IoT is often perceived as cutting edge, similar technology has been around since the last century. What has changed is the ubiquity of high-speed, low-cost communication networks, and the declining cost of computing and storage. Combined with a societal fascination with technology, this has resulted in an expanding market opportunity for IoT devices, which can be split into two categories: consumer and industrial IoT.
Consumer IoT
Consumer IoT products often focus on convenience, or adding value to services within a domestic or office environment, focusing on the end user experience and providing a rich data source that can be useful in understanding consumer behavior.
The consumer IoT comprises a set of connected devices, whose primary customer is the private individual or domestic market. Typically, the device has a discrete function that is enabled or supplemented by a data-gathering capability through on-board sensors and can also be used to add functionality to common domestic items, such as refrigerators.
Today’s “smart” home captures many of the characteristics of the consumer IoT, featuring an array of connected devices and providing a previously inaccessible source of data about consumer behavior that has considerable value for organizations.
While the primary target market for IoT devices is individuals and domestic environments, these devices may also be found in commercial office premises –- either an employee has brought in the device or it has been installed as an auxiliary function.
Industrial IoT
Industrial IoT deployments offer tangible benefits associated with digitization of processes and improvements in supply chain efficiencies, through near real-time monitoring of industrial or business processes.
The industrial IoT encompasses connected sensors and actuators associated with kinetic industrial processes, including factory assembly lines, agriculture, and motive transport.
While these sensors and actuators have always been prevalent in the context of operational technology, connectivity and the data processing opportunities offered by cloud technologies mean that deeper insight and near real-time feedback can further optimize industrial processes. Consequently, the industrial IoT is seen as a core piece the digitization of industry.
Examples of industrial usage relevant to the IoT extend from manufacturing environments, transport, utilities and supply chain, through to agriculture.
The IoT is a reality
IoT has become a reality, and is already embedded in industrial and consumer environments. It will further develop and become a critical component of not just modern life, but critical services.
Yet, at the moment, it is inherently vulnerable, often neglects fundamental security principles, and is a tempting attack target. This requires a change.
There is growing momentum behind the need for change, but a lot of that momentum is governmental and regulatory-focused, which, as history tells us, can be problematic. IoT can be seen as a form of shadow IT, often hidden from view and purchased through a non-IT route. Hence, responsibility for its security is often not assigned or misassigned.
There is an opportunity for information security to take control of the security aspects of the IoT, but this is not without challenges: amongst them are necessary skills and resources. Nevertheless, there is a window of opportunity to tame this world by building security into it. As most information security professionals know, this represents a cheaper and less disruptive option than the alternative.
In the face of rising global security threats, organizations must make systematic and wide-ranging commitments to ensure practical plans are in place to acclimate to major changes in the near future. Employees at all levels of the organization will need to be involved, from board members to managers in non-technical roles.
Enterprises with the appropriate expertise, leadership, policy, and strategy in place will be agile enough to respond to the inevitable security lapses. Those who do not closely monitor the growth of IoT may find themselves on the outside looking in.
