The Darktrace approach to locking down the IIoT
Sponsored Feature Internet connectivity has changed everything, including old-school industrial environments. As companies modernise their operations, they’re connecting more of their machinery to the web. It’s a situation that’s creating clear and present security concerns, and the industry needs new approaches to dealing with them. Industrial Internet of Things (IIoT) adoption is speeding ahead. Research from Inmarsat found that 77 per cent of organisations surveyed have fully deployed at least one IIoT project, with 41 per cent of them having done so between the second quarters of 2020 and 2021. The same research also warned that security was a primary concern for companies embarking on IIoT deployments, with 54 per cent of respondents complaining that it stopped them using their data effectively. Half also cited the risk of external cyber attacks as an issue. IIoT solutions are pivotal to the convergence of IT and OT (operational technology). OT platforms, often industrial control systems (ICS), help companies manage their physical devices like presses and conveyor belts that power manufacturing production or the valves and pumps that keep municipal water flowing. In doing so they generate huge amounts of data that is useful for analytics purposes. But getting that information into the appropriate enterprise tools means bridging the gap between IT and OT. Operators also want those OT systems to be accessible remotely. Giving conventional IT applications the ability to control those devices means they can be linked with the same back-end processes defined in IT systems. And enabling remote access for technicians unable or unwilling to make a multi-kilometre round trip just to make an operational change can also save time and money. This need for remote access sharpened during the COVID-19 crisis when social distancing and travel restrictions stopped technicians from making any on-site visits at all. Inmarsat found that the pandemic was a root cause of accelerated IIoT adoption for example, with 84 per cent reporting that they have or will accelerate their projects as a direct response to the pandemic. So for many, the convergence of IT and OT is more than just convenient; it’s essential. But it has also created a perfect storm for security teams. An externally accessible ICS system accessible increases the attack surface for hackers. ICS attacks in action
Sometimes that IT/OT convergence can be as simple as someone installing remote access software on a PC at a facility. That’s the set up which allowed hackers to access control systems via an installation of a remote access tool at the municipal water plant in Oldsmar, Florida in 2021 before trying to poison local residents with sodium hydroxide. The PC that the attacker compromised had access to the OT equipment at the plant. The town’s sheriff reported that the invisible intruder had dragged the mouse cursor around in front of one of its workers. It isn’t clear what caused hackers to try and poison innocent Floridians, but some attacks have financial motives. One example is the EKANS ransomware attack that hit Honda in June 2020, shutting down manufacturing operations across the UK, the US, and Turkey. Attackers used the EKANS ransomware to target internal servers at the company, causing major disruption at its plants.
