IIoT Cyber Attack Vectors and Best Mitigating Practices

The recent colonial pipeline hack and the cyberattack on the meat industry had severe repercussions on the U.S economy. The attackers used some vulnerable parts of the system exposed to the internet to gain unauthorized access and control of the IT infrastructure of those businesses. 

 

IoT/IIoT Increases Attack Vectors 

An attack vector is how a hacker gains network access with malicious intent, enabling attackers to exploit vulnerabilities. In simpler terms, any point in the IT infrastructure that a hacker can use to gain unauthorized access is an attack vector. This includes the hardware devices, network technology, software, standard operating procedures, and even the people in contact with the IT infrastructure. 

 

Figure 1. The most common attack vectors in critical infrastructure. Image used courtesy of Cipsec

 

With more attack vectors, the chances of successful cyberattacks become higher. The hacker only needs to identify the weakest link in the IT system. 

When industries massively adopt IoT- and IIoT-based infrastructure, innumerable devices will be connected to the internet. Every sensor, device, machine, input touchpoints, information displays, etc., will be directly connected to the network. All devices will be collecting and ferrying critical data that should not be compromised. Thus, the number of attack vectors hackers can exploit will grow exponentially, increasing the attack surface. 

Communication Channel Risk

Most legacy industrial networks use wired connections to communicate between devices. This requires physical access to the network. Physical tampering has to be done on network cables or network devices to intercept.

 

Figure 2. Types of critical infrastructures using industrial networks. Image used courtesy of Cisco

 

Industry 4.0 requires a low latency network with large bandwidths to operate. They are facilitated by 5G or WiFi 6E technologies. Both are wireless technologies that do not require a tangible, physical network. This makes intercepting the data transfer between the devices easier. Physical tampering is not required to intercept the network; physical proximity is sufficient.

Vendor Risk

Vendors may source the devices and software for IoT infrastructure. Consequently, these vendors may not provide adequate protection against cyberthreats, introducing vulnerability. The devices will have firmware and other endpoint software. When vendors do not constantly work to analyze device vulnerabilities, they will be open to attacks. Vendors should provide regular software updates and patches to fix any newly identified vulnerabilities.

Cloud and Edge Computing Risk

The two different computing models for industry 4.0 opens up two more kinds of risks. In the cloud computing model, all data travels to the central cloud system for processing. Gaining access to the system makes data exfiltration easier for attackers. Whereas in the edge computing model, data processing happens at each node. The points of data exposition are higher, but the amount of data that attackers can steal is limited to the data available at each node.

 

Figure 3. The difference between cloud computing and edge computing. Video used courtesy of Siemens

 

Human Risk

Reports from IBM have stated that cyber-attacks are often the result of human errors. Humans are fallible and are often exploited by attackers to gain unauthorized access. Employees of a firm can fall prey to phishing attacks or other forms of cyberattacks that eventually expose the IT infrastructure of the firm.

 

Cybersecurity Best Practices For IoT and IIoT

Cybersecurity threats are on the rise in recent years. Moving to industry 4.0 standards with IoT/IIoT infrastructure will introduce more vulnerability to the industrial infrastructure. Manufacturers must proactively adopt some best practices, such as those listed below, to prevent future attacks.

Risk Philosophy

All the different parts of a company will be networked and connected. If the company still has a decentralized approach to handle cybersecurity, it opens up vulnerabilities. Businesses must create a cohesive risk philosophy and plan to meet cybersecurity targets. Cybersecurity has to be implemented with a top-down approach to plug any open deficiencies.

Standard Operating Procedures 

The aim of developing a cybersecurity strategy is to prevent any possible attacks. To do this, businesses should be prepared for a cyberattack. When a company has clear operating procedures to follow after a breach has been detected, this avoids ambiguity in procedures and helps calm company composure instead of chaos after attacks. Having standard procedures helps minimize the damage of the attack.

Vendor Choice

Device and software vendors play a pivotal role in enhancing cybersecurity. Cyber threats are not constant in nature and evolve constantly. The devices, vendors, and respective software need to adapt to the changing landscape. Vendors can help keep the devices updated with regular software updates and patches. Make sure to choose vendors that guarantee future updates with a track record of doing so. 

Security Audits 

Security audits are conducted to expose vulnerabilities in the IoT infrastructure. Such audits can help to identify the avenues of improvement for cybersecurity. Conduct regular security audits at regular intervals to keep updated and increase the cyber resilience of IoT infrastructure. 

AI/ML For Cybersecurity

IoT/IIoT infrastructure results in an exponential increase in internet-enabled devices and generated data. The total network traffic will also dramatically increase. It is impossible to track all network traffic and devices manually. Artificial intelligence (AI) and machine learning (ML) algorithms can handle large volumes of data to identify potentially malicious activities. 

 

Figure 4. Robots can be programmed with AI or ML to continuously learn, but these are open attack vectors for malicious actors.

 

Such systems have to be employed for cybersecurity. This will also free up the time of cybersecurity personnel to focus on preventive activity by automating network monitoring.

Personnel Training

Human errors reportedly cause many cybersecurity breaches. Employees of a company are often the weakest link in the cybersecurity plans. They have to be trained on the methods used by hackers to gain access to IoT infrastructure. The personal activities of employees can also cause harm to the security of the company. Employees have to be trained about the best practices in the professional setting and personal life regarding cybersecurity.

IoT/IIoT can bring significant benefits to industries by enhancing production and reducing costs. The data advantages brought by industry 4.0 are also immense, but it also creates vulnerability to cyberattacks with an increasing number of attack vectors that hackers could exploit. Businesses have to take proactive measures to safeguard themselves from such threats. Cybersecurity has to be included in the planning phase by designing and implementing best security practices.