Utilising the ‘Internet of Things’, or IoT as it is more commonly known, cyber-physical systems monitor and control physical processes, feeding the resultant data back into dashboards that are supervised by people. When functioning correctly, the derived savings both in time and human labour are immense, but could it come at a hidden price?
What is Industry 4.0?
Cited as the next phase in modern manufacturing, Industry 4.0 is the integration of physical components with software components in operational technology (OT). This amalgamation unites the Industrial Internet of Things (IIoT,) in real time via the wireless web i.e. cloud computing, with cyber physical systems capable of monitoring the factory’s physical processes.
The implementations are far reaching - from creating smart grids, to guiding autonomous vehicles and creating robotic plants – all with minimal input from human operators.
The benefits from Industry 4.0 are equally enticing. For hostile working environments - such as dusty, hot or intoxicating conditions- health and safety risks could be improved upon, if not eradicated from the negation of human intervention. Similarly, improvements in efficiency and productivity could be realised from consistent monitoring and computer controlled assessments that potentially identify issues before they become a problem. Many organisations could potentially increase revenues, profit margins and their advantage over competitors.
However, as with any change in working practices, it’s not without its challenges.
The Lessons Learned from Mirai
The Mirai IoT malware powerfully demonstrated how damaging lax security practices can be. In October 2016, several high-profile websites were inaccessible due to a Domain Name Server attack. Consumer IoT devices – from digital video recorders, CCTVs, routers and various other appliances were all compromised by malicious code that used factory set credentials [default username and passwords that were left unchanged] to recruit the devices to a Botnet. This army of infected internet-connected devices was then used to launch the Distributed Denial of Service attack against the internet performance management company Dyn, rendering Amazon, Twitter, PayPal, Spotify and many other major websites inaccessible.
With Industry 4.0, physical entry terminals all have IoT embedded into them, which in turn are integrated with the credentials database – and it’s this integration that poses a risk, potentially providing an unlocked door that allows attackers to compromise these IoT devices, creating a cyber arsenal to mount attacks against the network and compromise internal management systems, or firing attacks out across the internet.
Are there warning signs to monitor for?
Currently, across all organisations and sectors, there are various attacks happening all the time, it’s just few are disclosed publicly – intentionally or otherwise.
The challenge is that it’s extremely difficult to identify attacks in an OT environment. While monitoring services exist for OT environments they have limited application due to the necessity for network zones, or segmentation. This means that sensors need to be placed at a number of different layers within the network in order to monitor activity. Another contributing factor is complacency, even if network traffic is being captured. Many organisations are completely focused on getting systems up and running again, rather than mining through vast data sets to determine categorically what went wrong.
Cyber-security best practices
As organisations adopt Industry 4.0 working practices, cyber security is increasingly paramount. As cyber criminals continue to ply their trade, looking for connecting IIoT devices to compromise, slamming these backdoors closed is a priority.
With that in mind, here are five cyber security best practices to minimise the risk of IIoT devices:
Default credentials: Mirai and Brickerbot highlight the risk posed from factory set usernames and passwords. Before connecting a device, ensure that these credentials have been reset.
Patching: When code flaws - i.e. zero day vulnerabilities, are found in software, updates will be released. Organisations need to determine how these can be implemented and rolled out to affected devices within the environment.
Network maps: Understand the complete profile of the network. This includes defining how OT and IIoT is connected and the risk that exists within the process.
Asset identification: Determine what processes and assets are critical to the organisations ability to operate and what the threat vectors might be.
Upskilling: Understand the blue-collar workforce and how working practices have changed. Many now use technology to perform tasks, so make them aware of the cyber threats they face. For example, engineers should not be able to just plug in a USB stick without first checking that it is free of malware and its operating system is up to date.
In cyberwar threat actors are continuously testing and probing to see what a target’s response is, and will enhance their threat to break through defences put in place actually work. It’s a continuous process of intelligence gathering and attack defence.
Compromising a nation’s key assets will greatly undermine the ability of the country to keep working. The WannaCry outbreak is one example that highlighted just how disruptive an impact this type of attack can have on nation states, as well as global businesses. Many victims of the ransomware attack were desktop computers running unsupported operating systems, and representing the human machine interface with key control systems running healthcare, infrastructure and major manufacturing systems.