The Internet of Things (IoT) refers to the physical devices around the world, collecting and sharing data, via the internet. For example, things like cell phones, a lightbulb that’s turned on via a cell phone app, or even a Nest thermostat in your home. What was once isolated is now exponentially bigger and better connected. This has also greatly increased the attack surface which correlates to ransomware becoming a $6 trillion industry.

This week’s Reimagining Cyber podcast episode, “IoT, Not Just Alphabet Soup,” with guest Kate Scarcella, Chief Security Architect with CyberRes, goes into a deep-dive into IoT, the ramifications of the field’s exponential growth, why securing it is critical, and how Operational Technology (OT) is different.

Wild Wild West

The vast growth and expansion of IoT devices has us living in the Wild Wild West, says Scarcella.

“While there are a few legislative initiatives that would help us to identify IoT vulnerabilities and threats, we're basically living in what I call the Wild Wild West. It's not unusual in building access control networks known as BACnet to find no authentication,” Scarcella says. 

Protecting IoT devices is critically important because things like smarter buildings are building Smarter Cities, and all you need is one access point. Traditional security controls are not thought of through the IoT lens.

“Oftentimes, with IoT, no password authentication is needed. And information, if it is provided, is in clear text,” Scarcella explains.

As IoT evolves, the security controls need to, too.

Riding the wave of securing IoT Devices

“IoT is literally like a tidal wave,” Scarcella says. In order to “ride the wave” shifting from traditional security controls will be key. Starting with an agent like the Endpoint Detection Response we have on our laptops is a step in the right direction. Going one step more, and adding Artificial Intelligence (AI) and Machine Learning (ML) is even better.

“We really need to embrace Artificial Intelligence and Machine Learning. We cannot just have an agent on an IoT device without AI and Ml,” Scarcella says. 

By using an agent coupled with AI and ML, a strong security infrastructure will be built. With the amount of data being run and devices being used (over 14 billion, says Scarcella), stronger parameters are needed.

OT vs. IoT

When we think of traditional IT, we think of confidentiality, integrity, and availability. With OT, we reverse the thought process, says Scarcella. First, we have to make sure the devices are available and the valves are always working, she explains.

“So, as an example, we have valves that can open and close the amount of, you know, chlorine in the water. And everything is very, very exact. And if anything should go wrong, then, as we have seen with some incidents recently, it really does impact us.”

OT is based on availability, then integrity, and lastly, confidentiality. This can be challenging as those responsible for OT don’t always see eye-to-eye with those in IT (responsible for IoT).

By evolving how you protect your OT and IoT, you’ll be better prepared against attacks and be more cyber resilient as an organization.

How are you securing your IoT devices? Share in the comments below!

You can find the latest episode of Reimagining Cyber on Apple, Soundcloud, Stitcher, Google Play, and Spotify. Give it a listen, and let me know what you think. Log in or register to comment below.

CyberRes is a Micro Focus line of business focused on helping companies protect, detect, and evolve their security framework and helping organizations become more cyber resilient. To learn more, visit CyberRes.com.