The Internet Of "vulnerable" Things?

Today's world is hyperconnected, and organisations are under increasing pressure to collect, collate, analyse and share data in a smart and seamless way. However, smart and secure are often not synonymous with each other.  The Internet of Things (IoT) is becoming an increasingly prominent and important facilitator of hyperconnectivity because it involves connecting computing devices and digital machines to everyday objects.

Today's world is also increasingly volatile and risky, and organisations need to remain constantly vigilant against cyber attacks, particularly in relation to the IoT. One of the key questions for most organisations is therefore, how can we be both hyperconnected and secure?

Hyperconnectivity Versus Security

Cyber security extends to an organisations network infrastructure and beyond. Industrial control systems (ICS) are an integral part of the operational technology of an organisation, and work alongside an organisation's IT network and any IoT devices.

As IoT devices become more prevalent, cyber attacks are increasingly directed at ICS or other similar systems in an attempt to compromise an organisations wider network. A targeted attack through an organisations network may have far reaching impacts beyond the walls of its own facilities, e.g. power outages, major health and safety risks, a communication shutdown preventing an emergency response, and preventing the supply of clean water.

Are IoT Devices The Weakest Link?

The recent British government Cyber Security Breaches Survey highlighted that almost all organisations have some form of digital exposure, and that network-connected devices were more common amongst businesses than last year. Ericsson has also predicted that connected IoT devices will consist of around 29 billion by the end of this year.

However, the increasing reliance on IoT devices does not mirror the surrounding security aspects, which are receiving less focus.

In many organisations IoT devices will be embedded into the processing of data which is sensitive and critical to the organisation and its infrastructure. If the lack of focus on security measures continues, the IoT devices, and as a result the data they process and the networks of which they form part, will become increasingly vulnerable to cyber attacks.

Should Regulators Intervene?

The UK Government has recognised at a consumer level that there is a need for minimum security standards for IoT products being sold, with the Queen's Speech announcing that new laws will also aim to impose obligations throughout the supply chain. However, the UK Government has not gone so far as imposing minimum security standards on the industrial IoT or other interconnected systems within an organisation. This seems strange, because organisations usually present a more diverse threat profile than consumers, and r organisations also typically have more knowledge, responsibility and control of networks and cyber security.

In the absence of a minimum standard, Chief Technology Officers and boards should consider how to build and invest in a "security-by-design" mindset within their organisation, and how to future proof any IoT, ICS or other devices through monitoring and maintenance.

Doing so will not only strengthen an organisation's security arrangements, it is also likely to extend the period during which IoT devices can be used, and therefore potentially decrease expenditure on new hardware. 
This may be an uphill battle for some organisations – the Cyber Security Breaches Survey noted that 44% of businesses in the UK see cyber security as only a "fairly high" priority. The DCMS have further found from the survey that there is a lack of understanding of what constitutes cyber risk management, compounded by a lack of expertise and perceived complexity of cyber security matters at a board level.

Organisations are buried under a growing mountain of information, and leaders are struggling to find the right balance between enforcing compliance, providing flexibility to encourage innovation, and giving employees access to the right information at the right time.

What Can Be Done?

Organisations should take a holistic and proactive approach to their cyber security. Research demonstrates that most tend to take a reactive approach rather than being proactive in recognising the strategic risks that may impact the organisation. 

Whilst it may be difficult to do so in the short-term, organisations should try to view investment in cyber security in a more positive light. They should view the investment as a business enabler, not just an extra cost.

Even after such a change in perspective, negotiating sufficient budget for cyber security against other competing priorities can still seem like a battle. This is often a particularly difficult issue where organisations do not outsource IT or other security solutions. This leaves the organisation heavily reliant on an often small group of its own employees, and those employees often don't have a voice loud enough to influence the board and Executive team, or to communicate the importance of cyber security across middle management.

For example, penetration testing of existing systems, or adding a further level of requirements or assurance as part of supply chain due diligence, will pay dividends in the future, but many of an organisation's senior leaders may not recognise that. 

An organisation should look to develop appropriate policies and train employees on recognising risks and being proactive. This should be communicated to a range of different audiences, in order for employees to understand a risk even when they have little or no relevant technical expertise. Any risk mitigation plans put in place by an organisation must include the risks posed by ICS and other IoT devices.. Such plans must cover as much ground as possible, from recognising the early signs of an attack or a breach, through to putting in place a formalised incident management plan.

The risks of supply chain cyber attacks remain high and changing perspectives and culture will not happen overnight. Despite the challenges, it remains essential that an organisation is able to detect and mitigate cyber risks quickly, in order to prevent the risks crystallising into operational disruption

Sarah Daun and Caroline Churchill are Partners at law firm Womble Bond Dickinson

You Might Also Read: 

EU Businesses Risk Fines For Not Complying With IoT Security Rules:

 

« Privileged & Protected - Managing Access At The Endpoint
The Role of Zero Trust Architecture In Minimising Cyber Risks »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

ON-DEMAND WEBINAR: What Is A Next-Generation Firewall (and why does it matter)?

ON-DEMAND WEBINAR: What Is A Next-Generation Firewall (and why does it matter)?

Watch this webinar to hear security experts from Amazon Web Services (AWS) and SANS break down the myths and realities of what an NGFW is, how to use one, and what it can do for your security posture.

The PC Support Group

The PC Support Group

A partnership with The PC Support Group delivers improved productivity, reduced costs and protects your business through exceptional IT, telecoms and cybersecurity services.

LockLizard

LockLizard

Locklizard provides PDF DRM software that protects PDF documents from unauthorized access and misuse. Share and sell documents securely - prevent document leakage, sharing and piracy.

CSI Consulting Services

CSI Consulting Services

Get Advice From The Experts: * Training * Penetration Testing * Data Governance * GDPR Compliance. Connecting you to the best in the business.

DigitalStakeout

DigitalStakeout

DigitalStakeout enables cyber security professionals to reduce cyber risk to their organization with proactive security solutions, providing immediate improvement in security posture and ROI.

Mielabelo

Mielabelo

Belgian consulting firm providing services in the security and compliance of information systems and IT service management.

Hyper Recruitment Solutions

Hyper Recruitment Solutions

Hyper Recruitment Solutions is a specialist and highly compliant recruitment consultancy dedicated to the Science and Technology sectors.

DeviceLock

DeviceLock

DeviceLock is a leading provider of endpoint device/port control and data leak prevention software.

KE-CIRT/CC

KE-CIRT/CC

KE-CIRT/CC is the national Computer Incident Response Team for Kenya.

Wibu-Systems

Wibu-Systems

Wibu-Systems is a leading provider of solutions for the Digital Rights Management (DRM) and anti-piracy industry.

Neoteric Networks

Neoteric Networks

We deliver a no nonsense procedure to implementing technology. The technology selection process ensures that all customers enjoy an engineered methodology implementing technology.

BehavioSec

BehavioSec

BehavioSec uses the way your customers type, swipe, and hold their devices, and enables them to authenticate themselves through their own behavior patterns.

Security & Intelligence Agency (SOA) - Croatia

Security & Intelligence Agency (SOA) - Croatia

SOA is the Croatian security and intelligence service. Areas of activity include Cyber Security and Information Security.

Cybersecurity Defense Initiative (CDI) - University of Arkansas

Cybersecurity Defense Initiative (CDI) - University of Arkansas

The Cybersecurity Defense Initiative is a national cybersecurity training program, developed for technical personnel and managers who monitor and protect our nation's critical cyber infrastructures.

Snode Technologies

Snode Technologies

Snode's Guardian cybersecurity platform uses AI and machine learning to monitor, detect and proactively respond to all threats on every device within your network.

Lewis Brisbois

Lewis Brisbois

Lewis Brisbois offers legal practice in more than 40 specialties, and a multitude of sub-specialties including Data Privacy & Cybersecurity.

Redhorse

Redhorse

Redhorse provides top-tier consulting to help clients address mission-critical government problems in National Security, Networking Technology, Energy and the Environment.

UM6P Ventures

UM6P Ventures

UM6P Ventures is an African based early-stage ventures firm operating two funds; a Digital Transformation fund and a Deeptech Ventures fund.

Galvanick

Galvanick

Galvanick enables your operations and IT teams to protect your industrial systems and networks against digital threats.

Netia

Netia

Netia is a Polish telecommunications company providing a range of business services including network solutions, communications, data centre and cloud, and cybersecurity.

Thero6

Thero6

Thero6 develop dynamic financial analysis algorithms that help prevent coin collapses and theft of cryptocurrency funds by identifying the transaction absolutely throughout the chain.