The Internet Of "vulnerable" Things?

Today's world is hyperconnected, and organisations are under increasing pressure to collect, collate, analyse and share data in a smart and seamless way. However, smart and secure are often not synonymous with each other.  The Internet of Things (IoT) is becoming an increasingly prominent and important facilitator of hyperconnectivity because it involves connecting computing devices and digital machines to everyday objects.

Today's world is also increasingly volatile and risky, and organisations need to remain constantly vigilant against cyber attacks, particularly in relation to the IoT. One of the key questions for most organisations is therefore, how can we be both hyperconnected and secure?

Hyperconnectivity Versus Security

Cyber security extends to an organisations network infrastructure and beyond. Industrial control systems (ICS) are an integral part of the operational technology of an organisation, and work alongside an organisation's IT network and any IoT devices.

As IoT devices become more prevalent, cyber attacks are increasingly directed at ICS or other similar systems in an attempt to compromise an organisations wider network. A targeted attack through an organisations network may have far reaching impacts beyond the walls of its own facilities, e.g. power outages, major health and safety risks, a communication shutdown preventing an emergency response, and preventing the supply of clean water.

Are IoT Devices The Weakest Link?

The recent British government Cyber Security Breaches Survey highlighted that almost all organisations have some form of digital exposure, and that network-connected devices were more common amongst businesses than last year. Ericsson has also predicted that connected IoT devices will consist of around 29 billion by the end of this year.

However, the increasing reliance on IoT devices does not mirror the surrounding security aspects, which are receiving less focus.

In many organisations IoT devices will be embedded into the processing of data which is sensitive and critical to the organisation and its infrastructure. If the lack of focus on security measures continues, the IoT devices, and as a result the data they process and the networks of which they form part, will become increasingly vulnerable to cyber attacks.

Should Regulators Intervene?

The UK Government has recognised at a consumer level that there is a need for minimum security standards for IoT products being sold, with the Queen's Speech announcing that new laws will also aim to impose obligations throughout the supply chain. However, the UK Government has not gone so far as imposing minimum security standards on the industrial IoT or other interconnected systems within an organisation. This seems strange, because organisations usually present a more diverse threat profile than consumers, and r organisations also typically have more knowledge, responsibility and control of networks and cyber security.

In the absence of a minimum standard, Chief Technology Officers and boards should consider how to build and invest in a "security-by-design" mindset within their organisation, and how to future proof any IoT, ICS or other devices through monitoring and maintenance.

Doing so will not only strengthen an organisation's security arrangements, it is also likely to extend the period during which IoT devices can be used, and therefore potentially decrease expenditure on new hardware. 
This may be an uphill battle for some organisations – the Cyber Security Breaches Survey noted that 44% of businesses in the UK see cyber security as only a "fairly high" priority. The DCMS have further found from the survey that there is a lack of understanding of what constitutes cyber risk management, compounded by a lack of expertise and perceived complexity of cyber security matters at a board level.

Organisations are buried under a growing mountain of information, and leaders are struggling to find the right balance between enforcing compliance, providing flexibility to encourage innovation, and giving employees access to the right information at the right time.

What Can Be Done?

Organisations should take a holistic and proactive approach to their cyber security. Research demonstrates that most tend to take a reactive approach rather than being proactive in recognising the strategic risks that may impact the organisation. 

Whilst it may be difficult to do so in the short-term, organisations should try to view investment in cyber security in a more positive light. They should view the investment as a business enabler, not just an extra cost.

Even after such a change in perspective, negotiating sufficient budget for cyber security against other competing priorities can still seem like a battle. This is often a particularly difficult issue where organisations do not outsource IT or other security solutions. This leaves the organisation heavily reliant on an often small group of its own employees, and those employees often don't have a voice loud enough to influence the board and Executive team, or to communicate the importance of cyber security across middle management.

For example, penetration testing of existing systems, or adding a further level of requirements or assurance as part of supply chain due diligence, will pay dividends in the future, but many of an organisation's senior leaders may not recognise that. 

An organisation should look to develop appropriate policies and train employees on recognising risks and being proactive. This should be communicated to a range of different audiences, in order for employees to understand a risk even when they have little or no relevant technical expertise. Any risk mitigation plans put in place by an organisation must include the risks posed by ICS and other IoT devices.. Such plans must cover as much ground as possible, from recognising the early signs of an attack or a breach, through to putting in place a formalised incident management plan.

The risks of supply chain cyber attacks remain high and changing perspectives and culture will not happen overnight. Despite the challenges, it remains essential that an organisation is able to detect and mitigate cyber risks quickly, in order to prevent the risks crystallising into operational disruption

Sarah Daun and Caroline Churchill are Partners at law firm Womble Bond Dickinson

You Might Also Read: 

EU Businesses Risk Fines For Not Complying With IoT Security Rules:

 

« Privileged & Protected - Managing Access At The Endpoint
The Role of Zero Trust Architecture In Minimising Cyber Risks »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

MIRACL

MIRACL

MIRACL provides the world’s only single step Multi-Factor Authentication (MFA) which can replace passwords on 100% of mobiles, desktops or even Smart TVs.

NordLayer

NordLayer

NordLayer is an adaptive network access security solution for modern businesses — from the world’s most trusted cybersecurity brand, Nord Security. 

ManageEngine

ManageEngine

As the IT management division of Zoho Corporation, ManageEngine prioritizes flexible solutions that work for all businesses, regardless of size or budget.

BackupVault

BackupVault

BackupVault is a leading provider of completely automatic, fully encrypted online, cloud backup.

CYRIN

CYRIN

CYRIN® Cyber Range. Real Tools, Real Attacks, Real Scenarios. See why leading educational institutions and companies in the U.S. have begun to adopt the CYRIN® system.

Centre for Secure Information Technologies (CSIT)

Centre for Secure Information Technologies (CSIT)

CSIT is a UK Innovation and Knowledge Centre (IKC) for secure information technologies. Our vision is to be a global innovation hub for cyber security.

Mi3 Security

Mi3 Security

Mi3 Security provide solutions to secure the escalating use of mobile apps and BYOD on networks.

Commissum

Commissum

Commissum specialise in information assurance and security testing services.

Logscape

Logscape

Logscape provides a big data analytical tool for log file analysis and operational analytics.

Maryman & Associates

Maryman & Associates

Maryman & Associates are specialists in computer forensic investigations, incident response and e-discovery services.

Siepel

Siepel

Siepel manufactures high quality shielded rooms and anechoic chambers dedicated to TEMPEST, NEMP & HIRF.

Compass Security

Compass Security

Compass Security is a specialist IT Security consultancy firm based in Switzerland. Services include pentesting, security assessments, digital forensics and security training.

Quokka

Quokka

Quokka (formerly Kryptowire) is the source for mobile security and privacy solutions, staying steps ahead of the threat and delivering peace of mind.

Cingo Solutions

Cingo Solutions

Cingo Solutions is a Managed Detection & Response company providing specialized data security services.

Blockchains LLC

Blockchains LLC

Blockchains is committed to changing the world for the better. Using blockchain and other innovative technologies, we’ll build new systems, new security, and new interactions.

Tangible Security

Tangible Security

Tangible employs the most sophisticated cyber security tools and techniques available to protect our clients’ sensitive data, infrastructure and competitive advantage.

CYDEF

CYDEF

CYDEF provides comprehensive, state-of-the-art cybersecurity protection that is accessible and affordable to organizations of any size.

Responsive Technology Partners

Responsive Technology Partners

Responsive Technology Partners provides superior IT support services including cybersecurity and compliance, telephony, cloud services, cabling, access control, and camera systems.

Schillings

Schillings

Shillings defends your rights to privacy, reuptation and security. We fight passionately against breaches of your privacy, attacks on your reputation and threats to your security.

ShellBoxes

ShellBoxes

ShellBoxes are a leading Web3 company focused on providing top-notch blockchain security and development services.

Crygma

Crygma

CRYGMA Quantum-Resistant Cryptographic Machines, the new standard in data encryption.