The Internet Of "vulnerable" Things?

Today's world is hyperconnected, and organisations are under increasing pressure to collect, collate, analyse and share data in a smart and seamless way. However, smart and secure are often not synonymous with each other.  The Internet of Things (IoT) is becoming an increasingly prominent and important facilitator of hyperconnectivity because it involves connecting computing devices and digital machines to everyday objects.

Today's world is also increasingly volatile and risky, and organisations need to remain constantly vigilant against cyber attacks, particularly in relation to the IoT. One of the key questions for most organisations is therefore, how can we be both hyperconnected and secure?

Hyperconnectivity Versus Security

Cyber security extends to an organisations network infrastructure and beyond. Industrial control systems (ICS) are an integral part of the operational technology of an organisation, and work alongside an organisation's IT network and any IoT devices.

As IoT devices become more prevalent, cyber attacks are increasingly directed at ICS or other similar systems in an attempt to compromise an organisations wider network. A targeted attack through an organisations network may have far reaching impacts beyond the walls of its own facilities, e.g. power outages, major health and safety risks, a communication shutdown preventing an emergency response, and preventing the supply of clean water.

Are IoT Devices The Weakest Link?

The recent British government Cyber Security Breaches Survey highlighted that almost all organisations have some form of digital exposure, and that network-connected devices were more common amongst businesses than last year. Ericsson has also predicted that connected IoT devices will consist of around 29 billion by the end of this year.

However, the increasing reliance on IoT devices does not mirror the surrounding security aspects, which are receiving less focus.

In many organisations IoT devices will be embedded into the processing of data which is sensitive and critical to the organisation and its infrastructure. If the lack of focus on security measures continues, the IoT devices, and as a result the data they process and the networks of which they form part, will become increasingly vulnerable to cyber attacks.

Should Regulators Intervene?

The UK Government has recognised at a consumer level that there is a need for minimum security standards for IoT products being sold, with the Queen's Speech announcing that new laws will also aim to impose obligations throughout the supply chain. However, the UK Government has not gone so far as imposing minimum security standards on the industrial IoT or other interconnected systems within an organisation. This seems strange, because organisations usually present a more diverse threat profile than consumers, and r organisations also typically have more knowledge, responsibility and control of networks and cyber security.

In the absence of a minimum standard, Chief Technology Officers and boards should consider how to build and invest in a "security-by-design" mindset within their organisation, and how to future proof any IoT, ICS or other devices through monitoring and maintenance.

Doing so will not only strengthen an organisation's security arrangements, it is also likely to extend the period during which IoT devices can be used, and therefore potentially decrease expenditure on new hardware. 
This may be an uphill battle for some organisations – the Cyber Security Breaches Survey noted that 44% of businesses in the UK see cyber security as only a "fairly high" priority. The DCMS have further found from the survey that there is a lack of understanding of what constitutes cyber risk management, compounded by a lack of expertise and perceived complexity of cyber security matters at a board level.

Organisations are buried under a growing mountain of information, and leaders are struggling to find the right balance between enforcing compliance, providing flexibility to encourage innovation, and giving employees access to the right information at the right time.

What Can Be Done?

Organisations should take a holistic and proactive approach to their cyber security. Research demonstrates that most tend to take a reactive approach rather than being proactive in recognising the strategic risks that may impact the organisation. 

Whilst it may be difficult to do so in the short-term, organisations should try to view investment in cyber security in a more positive light. They should view the investment as a business enabler, not just an extra cost.

Even after such a change in perspective, negotiating sufficient budget for cyber security against other competing priorities can still seem like a battle. This is often a particularly difficult issue where organisations do not outsource IT or other security solutions. This leaves the organisation heavily reliant on an often small group of its own employees, and those employees often don't have a voice loud enough to influence the board and Executive team, or to communicate the importance of cyber security across middle management.

For example, penetration testing of existing systems, or adding a further level of requirements or assurance as part of supply chain due diligence, will pay dividends in the future, but many of an organisation's senior leaders may not recognise that. 

An organisation should look to develop appropriate policies and train employees on recognising risks and being proactive. This should be communicated to a range of different audiences, in order for employees to understand a risk even when they have little or no relevant technical expertise. Any risk mitigation plans put in place by an organisation must include the risks posed by ICS and other IoT devices.. Such plans must cover as much ground as possible, from recognising the early signs of an attack or a breach, through to putting in place a formalised incident management plan.

The risks of supply chain cyber attacks remain high and changing perspectives and culture will not happen overnight. Despite the challenges, it remains essential that an organisation is able to detect and mitigate cyber risks quickly, in order to prevent the risks crystallising into operational disruption

Sarah Daun and Caroline Churchill are Partners at law firm Womble Bond Dickinson

You Might Also Read: 

EU Businesses Risk Fines For Not Complying With IoT Security Rules:

 

« Privileged & Protected - Managing Access At The Endpoint
The Role of Zero Trust Architecture In Minimising Cyber Risks »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

Cyber Security Supplier Directory

Cyber Security Supplier Directory

Our Supplier Directory lists 6,000+ specialist cyber security service providers in 128 countries worldwide. IS YOUR ORGANISATION LISTED?

Syxsense

Syxsense

Syxsense brings together endpoint management and security for greater efficiency and collaboration between IT management and security teams.

King & Spalding

King & Spalding

King & Spalding is an international law firm with offices in the United States, Europe and the Middle East. Practice areas include Data, Privacy & Security.

Wavestone

Wavestone

Wavestone is a strategy and technology consulting company with areas of expertise including digital transformation and cybersecurity.

Acalvio Technologies

Acalvio Technologies

Acalvio provides Advanced Threat Defense (ATD) solutions to detect, engage and respond to malicious activity inside the perimeter.

GreyCampus

GreyCampus

GreyCampus is a leading provider of training for working professionals in the areas of Project Management, Big Data, Data Science, Service Management, Quality Management and Information Security.

LinOTP

LinOTP

LinOTP is an enterprise level, innovative, flexible and versatile OTP-platform for strong authentication.

New Zealand Internet Task Force (NZITF)

New Zealand Internet Task Force (NZITF)

The New Zealand Internet Task Force (NZITF) is a non-profit with the mission of improving the cyber security posture of New Zealand.

Seconize

Seconize

Seconize empowers enterprises to proactively manage their cyber risks, prioritize remediations, optimize security spending and ensure compliance.

Perseus Cyber Security

Perseus Cyber Security

Perseus provides all-around digital protection for small and medium-sized businesses through state-of-the-art software solutions, flexible online training and emergency response.

Dellfer

Dellfer

Dellfer secures connected cars and other IOT devices through Intrinsic protection, enabling the most sophisticated cybersecurity attacks to be seen instantly and remediated with precision.

Sixgill

Sixgill

Sixgill, an IoT sensor platform company, builds the universal data service and smart process automation software allowing any organization to effectively govern its IoE assets.

WWPass

WWPass

WWPass is a global cybersecurity company that provides password-less authentication and client-side encryption technology.

FraudScope

FraudScope

FraudScope is an AI-assisted platform that accelerates the identification of fraud, waste, and abuse.

StartupXseed Ventures

StartupXseed Ventures

StartupXseed Ventures is a smart capital provider for Deep Tech, B2B, Early Stage Startups. We support, NextGen Tech Entrepreneurs, who have potential to deliver the outsized growth.

West Midlands Cyber Resilience Centre (WMCRC)

West Midlands Cyber Resilience Centre (WMCRC)

The East Midlands Cyber Resilience Centre supports and helps protect SMEs and supply chain businesses and third sector organisations in the region against cyber crime.

Palitronica

Palitronica

Palitronica build cutting-edge hardware and breakthrough software that revolutionizes how we defend critical infrastructure and key resources.

Strike Security

Strike Security

Strike Security offers a continuous penetration testing platform that combines automation with ethical hackers.