Finding a competitive edge in heavy industries and manufacturing today is as much about digitization and data analytics as it is about bringing new products and services to market. It has therefore become imperative for businesses in these sectors to invest in technologies that allow them to connect, control and monitor their industrial environments using sensors, gateways and other digital transformation tools. The Industrial Internet of Things (IIoT) has rapidly evolved from competitive advantage to a must have, and one way that companies can help speed up deployment of IIoT technologies is by embracing wireless.
Just as WiFi and the cell network made it easier to put relevant technology in the hands of the office worker, industrial wireless solutions are becoming a vital part of connecting machines to a network. This is more controversial than someone unfamiliar with the sector might think. Historically, industrial controls systems (ICS) and the like have been strictly wired environments for a very important purpose: reliability and security.
In the case of safety systems, wireless connectivity simply isn’t appropriate even now in some instances. Nuclear power stations, for example, are strictly wireless-free zones in many countries around the world, and for good reason. Wireless IIoT solutions are fast to deploy, but companies must gauge whether they are an appropriate solution based on a number of different factors.
The pros and cons of industrial wireless
From a security point of view these factors are not easy to evaluate: by their nature, wireless interfaces increase the attack surface for threat actors looking to exploit such systems. The risk of attackers who attempt to break into systems for the purposes of installing malware or stealing or altering data are very real. New threats which can eavesdrop, take control or sabotage IIoT networks are emerging almost daily. The risk of production loss or, if they interfere with safety systems, physical harm have been well documented. Wireless connectivity opens up even more attack vectors, however. In many cases, simply disrupting the flow of data, using malicious signal jamming for example, could be enough to bring operations to a halt for a significant period of time.
Compounding the concern, there’s plenty of evidence that companies aren’t yet well enough prepared to deploy IIoT securely. A recent report published by UK manufacturers’ organisation EEF revealed that some 48% of members surveyed had been affected by a cybersecurity incident, many of which went on to suffer financial loss or disruption to their businesses as a result. Yet it also found that 45% of those surveyed did not believe that they had the ability to engage in appropriate risk assessment, and 12% had no process measures in place at all to deal with a threat.
There are other sectors which may be in even worse shape. A recent report by the World Economic Forum found that 48% of mining operators believed they would be unable to even identify a sophisticated cyber-attack, let alone prevent it. Industrial wireless systems, then, are an essential opportunity, but they should never be deployed without a thorough assessment of potential risks, alongside adequate measures to mitigate against them.
Deploying industrial wireless safely
Standards are, for once, ahead of practice. The WirelessHART and ISA100 wireless communications protocols have been developed specifically for ICS, automation and sensors, and have been widely adopted by vendors over the last eight or nine years. Both WirelessHART and ISA100 are very robust standards, designed for high availability and resilience to interference, which utilise strong encryption to protect the theft of data in transit, and integrity checking mechanisms that when applied correctly reduce the risk of data tampering too.
These protocols have been thoroughly tested and stand up to scrutiny. Both WirelessHART and ISA100 offer a great deal of reassurance to industrial organizations that their deployments will be secure. Even with these strong frameworks in place, however, companies need to exercise a degree of caution. Any security protocol is only as dependable as its implementation allows, and solutions must be suitable to their applications.
Poor implementation, for example, could leave vulnerabilities that allow threat actors to manipulate sensor data in transit without detection, in turn giving the appearance that machinery is operating within acceptable parameters no matter what. Given the inherent danger of industrial environments, vendor-backed guarantees that communications between IIoT devices is secure should not be taken at face value.
For example, communications between wireless devices may be robustly protected, but poor configuration can leave vulnerabilities between gateways and SCADA networks. These require appropriate testing and security hardening to ensure proper network segmentation is in place between critical ICS devices and other services. Equally critical but easy to leave unresolved is the importance of contingency planning: what happens in the event that an attacker does manage to hijack a system? How is a breach detected, and what fall-backs are in place to mitigate against disruption?
In the US, the National Institute of Standards and Technology (NIST) has recently published its Guide to Industrial Wireless Systems Deployments, and quite rightly it emphasises the importance of proper candidate evaluation and selection prior to deployment. This involves rigorous testing of solutions and the ability to implement not just safe and proper deployment, but full secure lifecycle management of a solution too.
NISTs guidelines are thorough and include advice on testing reboot times for devices and conducting risk assessments for the intrinsic safety of a system in the event of a failure or attack on the wireless network.
As EEF’s findings suggest, however, many industrial firms are simply not able to carry out this evaluation by themselves. They must learn to rely on a trusted, independent partner who can carry out thorough risk assessment and appropriate hardening of security appropriate to these difficult environments. The key to strong security and protecting wireless solutions isn’t just the right skills, it’s also the right support too.
Related: Learn More at SecurityWeek’s ICS Cyber Security Conference
