As a young leader and entrepreneur, under his supervision NCG, today is the preferred partner to our customers. Sunil’s dynamic leadership and go-to-market strategy has helped NCG grow multifold and emerge as an industry leader in technology services. Driven by Sunil’s vision of improved services, NCG today is designing and delivering cutting-edge technology solutions that impact the industry and businesses. With over 25 years of leadership experience, Sunil focuses on identifying strategic opportunities to build and grow businesses. With his guidance, the Organisation and the practice have received several awards and rankings from leading industry analysts. A sports enthusiast and a believer in people, Sunil spends his leisure time mentoring and developing people and ideas.
Today, several manufacturing factories, utilities, and even agricultural sites have hundreds of IIoT devices & technologies that help control and modernize their operations. In addition, industrial facilities have been gradually increasing reliance on the industrial internet of things (IIoT), creating or upgrading facilities with integrated operational technology (OT) and information technology (IT) to improve productivity and efficiency of systems.
Though, moving to IIoT-integrated facilities might increase the risk of cyberattacks and other vulnerabilities. OT is concerned with the physical elements of industrial production, including systems for checking if a specific tank is overflowing or ensuring that a valve opens when it should.
These were customarily closed/manually operated systems, but now they are increasingly being brought online. Along with traditional enterprise and office functions, a key concern of IT is the flow and sometimes collection and analysis of data that comes from within and outside of the industrial facility. Traditional IT has many gateways, a large and vulnerable surface that is exposed to constantly evolving threats.
Essentially more connected endpoints mean more potential gateways to gain access to networks and infrastructure systems. Although IIoT is very much viable, few characteristics like Haphazard Modernization, Unique Production networks, Vulnerable communication protocols, and increased deployment of the new device make it a choice of hacker’s target segments.
It is of utmost importance for these facility controllers to take security seriously when adopting IIoT Technologies, and few critical areas of importance which should be properly addressed are as below :
- Endpoints and Legacy Devices: New devices like sensors, analytics platforms, and services to be connected to older machines. Since these new devices are connected with either a new firmware, a physical or web interface, or a network service – These become a possible point of entry for attackers.
- Vulnerable Systems: Many Industrial control systems (ICS) like (Supervisory Control and Data Acquisition (SCADA), Telemetry, and HMI, which are not made for cyber and have dependencies on multiple vendors for patches and upgrades.
- Proprietary Software: Most Industrial Facilities have a range of proprietary software from multiple vendors, which are hard to update and patch since complete control is in the hands of the vendors.
- Communication Protocols: Machine to Machine (M2M) protocols are used in Industrial facilities to exchange data. Most secure protocols must be used to reduce risk and give any external access to critical data and information.
IIoT must be secured. Using Cloud-Based end-to-end holistic systems which are built for cyber is the best way forward. The ideal IIoT System for SCADA, Telemetry, and HMI would need to be Secure, Resilient, Scalable and should be able to eliminate the risks associated with IIoT through:
- Sustainable Software Maintenance: On-Premise, ICS systems are challenging to maintain and rely upon for sustainability and scalability. Cloud-based systems are easily upgradeable, affordable, and can be more secure in many ways.
- Role-Based access to systems and End Points: Cloud-based ICS systems with strong 2 level authentication are highly secure. Moreover, the key should be role-based. Not just anyone should be allowed to operate and control anything manually/remotely.
- Secured Network & Communication Channels: Data Exchange, Remote access controls, and external communication should be protected with solid firewalls, encryption, and intrusion detection. Security threats such as data theft, vulnerability exploitation, and malware infection can be prevented with the right cybersecurity solutions for networks, gateways, and endpoints.
- Holistic ICS: A Package solution is deemed to be essential where one vendor can supply a holistic solution inclusive of systems like Cloud Servers, Data Acquisition Hardware, Telemetry, Operation Software, HMI’s, Cybersecurity, and Data Analytics.
- Adapting Tested, Proven, and Certified Systems: It is impeccable to have high-security standards, and facilities must choose systems that have been tested with the best track records (Like never been hacked), systems that are certified by certain agencies (Like RealiteQ is certified by Water Security Unit of Water Authority, Israel)
- Cloud Infrastructure: The IT infrastructure should be maintenance-free for the facilities; it should be the prerogative of a vendor to provide a secure and maintenance-free cloud infrastructure to reduce cost, time, and workforce burden.
It is undeniable that physical device security and network security are essential for a successful and sustainable amalgamation of OT and IT.
Cybersecurity is not a new concept, but in many cases, legacy industrial systems and devices may have never been connected to the internet before. As a result, stakeholders responsible for operational technology might be starting from where information technology was over twenty years ago. Fortunately, the Industrial Internet of Things is still early enough in its evolution for organizations to take on board what needs to be done if “x” happens, which is fortunate because failing to secure the IIoT could be devastating.