IoT and IT Security – Risks and Opportunities

The “Internet of Things”—also known as IoT (Internet of Things)—is becoming increasingly important in the industrial sector as part of the digital transformation, as this technology offers significant economic advantages. However, in addition to the opportunities it presents, the IoT also poses dangers and risks due to security vulnerabilities, the identification and remediation of which are often neglected. The advancement of Industry 4.0 is driving new technical developments that offer the opportunity to integrate IT security as early as the design phase. However, to develop effective IT security strategies and implement the associated modernization, it is essential to understand the fundamentals of the IoT.

Basics of Digital Integration

In its original sense, the IoT refers to devices connected to the Internet that do not fall into traditional IT categories such as desktop PCs, servers, or mobile devices. With IPv6 and the abundance of addresses it provides, the foundation was laid to assign each device in the world its own IP address, thereby making it addressable. From a technical perspective, however, even before the term “Internet of Things” was widely known, there were already smart production facilities and telecommunications systems connected to the Internet. Nor is the massive increase in the number of endpoints within networks anything new in and of itself.

Over the past few decades, digitalization has repeatedly driven innovation. For example, in the early 1990s, networked PCs brought about lasting changes to office work; by 1995, approximately 200 million devices of various types were connected to one another. Ten years later, with the widespread adoption of portable notebooks and netbooks, that number rose to one billion. In 2010, smartphones made their debut in the connected world, resulting in approximately 10 billion devices being online. Thanks to the IoT, that number has more than doubled again to date.

Several innovations contributed to the proliferation of connected devices, making today’s level of connectivity possible in the first place. For example, the prices of all kinds of connectable sensors have fallen significantly, making it economically feasible to link different devices together into digital ecosystems. The aforementioned transition from IPv4 to IPv6 also helped enable the management of a very large number of addressable end devices within a network. And last but not least, broadband and mobile networks have been expanded, allowing large volumes of data to be exchanged from and to any location.

All of these factors have laid the groundwork for modern cloud computing, big data analytics, and machine-to-machine (M2M) connections. However, the explosive growth in the number of IoT devices requires the development of appropriate security strategies.

IoT Vulnerabilities and Patch Management

It is important to always keep in mind that any device connected to a publicly accessible network, such as the Internet, is vulnerable to attack and can be compromised. This has always been true in traditional IT, but it is even more so in the Internet of Things. Every device may have vulnerabilities and security flaws that need to be identified. Identifying these vulnerabilities and addressing them with security updates is a major challenge. Therefore, it is important that, once devices are put into service, updates from manufacturers can be installed and patches are made available quickly. However, there is a major vulnerability here, as there are in fact many devices that do not allow for the installation of software updates. Such devices quickly become known in hacker circles and thus present a high risk of attack.

Professional patch management is immensely important, especially in industrial settings. And this is precisely where many organizations are still falling short. Time and again, known security vulnerabilities remain unpatched even though software updates are available. Particularly in the case of IoT infrastructures already in operation, the rollout of security-related updates is delayed, or entire subsystems are even overlooked during software updates. This makes it easy for cybercriminals to identify security vulnerabilities and exploit them.

Therefore, it is essential to have a comprehensive overview of the entire IT infrastructure. Every endpoint, no matter how small or inconspicuous, must be accounted for. Furthermore, every endpoint must be checked for potential vulnerabilities and, if necessary, brought up to date with software updates. As soon as devices are identified that cannot be patched, they must be disconnected from the production network unless they can be replaced. Here, it makes sense to rely on automated tools that regularly perform inventory checks and security scans.

Edge Computing for Greater Security in the IoT

Brief Definition: Edge computing is a distributed, open IT architecture characterized by decentralized processing power that lays the foundation for mobile computing and IoT (Internet of Things) technologies. In edge computing, data is processed by the device itself or by a local computer or server, rather than being transmitted to a data center.

As the number of IoT devices grows, so does the risk of potential network attacks. IoT devices are often connected to one another via cloud computing. Because of its centralized infrastructure, this system is particularly vulnerable to outages or DDoS attacks. With edge computing, applications and processes are distributed across various end devices, making it difficult and time-consuming for hackers to infiltrate the production network. In addition, edge computing is capable of filtering or encrypting security-related information to meet compliance and security requirements. Edge computing significantly reduces the amount of data that can be intercepted, which in turn makes it easier to comply with security standards.

The data collected from the respective IoT end devices can be filtered cost-effectively right at the source and does not need to be sent to a central data center. Storing and processing data on the end devices reduces bandwidth requirements, helps cut costs, and contributes to enhanced security. In addition, edge computing enables the scalability of the entire system: if necessary, additional resources can be provisioned directly on-site.

5G as a Safety Factor

With its high data transfer rates and extremely low latency, the new 5G mobile communications standard offers the perfect conditions for the IoT—it has never been easier to wirelessly integrate end devices into a production network. However, this technology also presents new security challenges, as it makes it more difficult to identify all IoT devices, and there will inevitably be end devices that operate exclusively on 5G and do not need to log in to the production network separately. While this also reduces the risk of a hacker attack, it makes it more difficult for companies to monitor their own devices on the 5G network, as these are usually connected directly to the cloud. In this context, man-in-the-middle attacks are increasingly coming into focus, as are attack scenarios designed to specifically drain the batteries of end devices—such as critical sensors—and thereby render them inoperable. It is important to recognize that as mobile networks like 5G continue to evolve, so do the devices themselves, making it all the more crucial to focus on the security of the devices themselves.

IoT and IT Security – An Outlook

The popularity of IoT devices is growing exponentially, and more and more companies are leveraging Internet of Things applications to their advantage—with blockchain, robotics, and AI being the most common applications. However, as IoT technology advances, so do its complexity and the number of risks involved. After all, the IoT is not only permeating personal spheres but also affecting corporate networks. Studies have shown that in 2019, many common devices such as printers, IP cameras, and routers were compromised without their users’ knowledge. Manufacturers—particularly those in the Far East—typically develop their devices with a tight profit margin, which means that the firmware they contain does not receive new updates. Furthermore, devices of this type remain in use for much longer than, for example, smartphones or traditional computing devices. The spread of 5G further exacerbates this situation because it leads to more IoT devices and, consequently, more attacks on them.

However, 2020 can also be described as the year of enhanced IoT security, which protects both manufacturing companies and customers alike. As a result, manufacturers of IoT devices are experiencing a steadily increasing demand for security and ongoing maintenance of their products. This leads to an almost inevitable conclusion for the future: Manufacturers who prioritize privacy and security will gain a significant competitive advantage in the future.