96 Percent of IT Security Professionals Expect an Increase in Cybersecurity Attacks on Industrial Internet of Things

Study reveals most organizations take additional precautions to secure IIoT

Portland, Ore. – March 13, 2017 – Tripwire, Inc. today announced the results of a study conducted in partnership with Dimensional Research. The study looked at the rise of Industrial Internet of Things (IIoT) deployment in organizations, and to what extent it is expected to cause security problems in 2017.  

IIoT are the connected devices in critical infrastructure segments such as energy, utilities, government, healthcare and finance. Tripwire’s study revealed that:

• Ninety-six percent of those surveyed expect to see an increase in security attacks on IIoT in 2017.

• Fifty-one percent said they do not feel prepared for security attacks that abuse, exploit or maliciously leverage insecure IIoT devices.

• Sixty-four percent said they already recognize the need to protect against IIoT attacks, as they continue to gain popularity among hackers.

“Industry professionals know that the Industrial Internet of Things security is a problem today. More than half of the respondents said they don’t feel prepared to detect and stop cyber attacks against IIoT,” said said David Meltzer, chief technology officer at Tripwire. “There are only two ways this scenario plays out: Either we change our level of preparation or we experience the realization of these risks. The reality is that cyber attacks in the industrial space can have significant consequences in terms of safety and the availability of critical operations.” 

“As Industrial companies pursue IIoT, it’s important to understand the new threats that can impact critical operations. Greater connectivity with operational technology (OT) exposes operational teams to the types of attacks that IT teams are used to seeing, but with even higher stakes,” said Robert Westervelt, security research manager at IDC.  “The concern for a cyber attack is no longer focused on loss of data, but safety and availability. Consider an energy utility as an example - cyber attacks could disrupt power supply for communities and potentially have impact to life and safety.”

The study’s respondents were also asked how they expect their organizations’ deployment of IIoT devices to change, and how it will affect their level of vulnerability. Tripwire found that: 

• Ninety percent expect IIoT deployment to increase.

• Ninety-four percent expect IIoT to increase risk and vulnerability in their organizations.

• When respondents were broken down by company size, both larger companies (96 percent) and smaller companies (93 percent) expect a significant increase in risk caused by the use of IIoT.

Meltzer continued, “The Industrial Internet of Things ultimately delivers value to organizations, and that’s why we’re seeing an increase in deployments. Security can’t be an industry of ‘no’ in the face of innovation, and businesses can’t be effective without addressing risks. The apparent contradiction of known risks and continued deployment demonstrates that security and operations need to coordinate on these issues. While IIoT may bring new challenges and risks, the fundamentals of security still apply. Organizations don’t need to find new security controls, rather they need to figure out how to apply security best practices in new environments.”

For more, see Security and Privacy in Internet of Things (IoTs): Models, Algorithms, and Implementations.

Three Critical 2017 Predictions for Global Cyber Security

Three Critical 2017 Predictions for Global Cyber Security

Leo Taddeo, Chief Security Officer, Cryptzone

The US will take a more aggressive position on international cyber security that will lead to cyber escalation between Nation States.

Typical to any transition of Presidential power, we’re in a honeymoon period between Nation States. Make no mistake, however: the first thing our adversaries are doing is figuring out where to “pick a fight” to see what they can get away with. 

For example, Russia has a track record of positive initial meetings with President-elects, while they test how much they can extract from them. But soon enough, Russia’s concerns will be intractable and Trump will be forced to face reality: Russia will not change its behavior.

We are already seeing Russia test Trump. Just this week, Putin said about Russia’s military, “We can say with certainty: We are stronger now than any potential aggressor. Anyone!” These kinds of comments will not sit well with an aggressive President-elect, and a Cabinet full of former US military.

With relations strained between Trump and the Obama Administration, negotiations between the US and Russia have already been sent into a tailspin. All of this will lead to cyber escalation.

While Trump has been playing nice – some say too nicely – with Russia, he’ll eventually overact and take proactive measures, which is more his style.

Another “Russia intractable” is the Ukraine. Because the US having influence in Ukraine is threatening to Russia, and the US won’t leave Ukraine’s fate in Russia’s hands, both countries will use cyber tools to try and get what they want: information.

China is another example. Cyber relations with China are already unstable with the incoming US leadership. Trump is taking China head on, with regular comments on its currency devaluation, abuse of trade policies and the volatile Taiwan relationship.

In response to a new, perhaps more hostile Trade Secretary,  China has indicated that “China like every other country is closely watching the policy direction the US is going to take.” 

In September 2015, Obama agreed with China that neither side would engage in cyber espionage in business. It was a gentleman’s agreement, based on goodwill, that isn’t binding or enforceable. From detectable cyber activity, there seems to have been a decrease in cyber espionage, supporting the notion that both sides have been honoring the agreement. If that goodwill doesn’t exist with China, and it seems that it does not in the President-elect’s approach, all bets are likely off.

The world is not equipped to handle sophisticated, multi-site cyber attacks, especially against financial institutions. Stolen money will be reinvested in “hacker R&D” creating future chaos. 

Countries and corporations are not prepared to deal with advanced cyber attacks. In the February 2016 Bank of Bangladesh hack against the SWIFT system, criminals stole $81M—and most of it is still unrecovered. Hackers are already re-investing these funds to develop techniques to target lesser protected institutions, which isn’t good news for network defenders.

The IoT is becoming even more commonplace and the lack of set standards and regulations leave us with more and more unsecured devices, widening the playing field of opportunity for hackers.

DDoS is becoming sexy again because we’re entering a different era in terms of volume, in part due to the number of IoT devices now online. We should anticipate an acceleration in DDoS attacks because some of these devices simply can't be fixed or properly secured. 

The October 2016 DYN DDoS attack is a good example of the above two trends. And the IoT botnet (Mirai) used in this attack shows signs of evolving as its source code was released publicly.

Companies will soon make the official transition to cloud, as they’ll stop viewing it as a risk and more of a sanctuary. They’ll also start establishing a “TSA-type security pre-check in line” to services for approved clients that will isolate channels for customers (i.e., they won’t be public facing) in order to avoid the Internet cesspool. 

Context is the next evolution of identity and people will, finally, stop caring about giving up privacy in order to prevent attacks. 

We’ll see identity finally move beyond a username and password: things like what device you’re on, why or what’s the context, enterprise vs. mobile origination, etc. that are seamless (invisible to the user) will take precedent and they’ll be embedded in use, and travel wherever users do.

The resource (device, company, network, app, etc.) will care about who you are in the move to cloud and BYOD environments. As part of this, users will give up privacy to access the resource.

This trade-off is fair. You must provide enough proof of who you are when asking for access to a valuable, shared resource. Users already sign end user license agreements, which most don’t read, and scroll as fast as possible to click accept, granting necessary access. The vast majority of the population views this as a fair and acceptable trade.

About the Author

Leo Taddeo, former Special Agent in Charge of the FBI's NY cybercrime office, is now member of the Citizens Crime Commission of NYC and CSO at Cryptzone.