{"id":36811,"date":"2020-08-26T18:00:13","date_gmt":"2020-08-26T18:00:13","guid":{"rendered":"https:\/\/www.microsoft.com\/security\/blog\/?p=91757"},"modified":"2020-08-26T18:00:13","modified_gmt":"2020-08-26T18:00:13","slug":"rethinking-iot-ot-security-to-mitigate-cyberthreats","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/rethinking-iot-ot-security-to-mitigate-cyberthreats\/","title":{"rendered":"Rethinking IoT\/OT Security to Mitigate Cyberthreats"},"content":{"rendered":"
<\/div>\n

We live in an exciting time. We\u2019re in the midst of the fourth industrial revolution\u2014first steam, followed by electricity, then computers, and, now, the Internet of Things.<\/p>\n

A few years ago, IoT seemed like a futuristic concept that was on the distant horizon. The idea that your fridge would be connected to the internet, constantly uploading and downloading data and ordering things on its own, like new filters or groceries, seemed laughable. Why would anyone want or need such a thing?<\/p>\n

Now, IoT and other embedded and operational technologies (OT) are far more pervasive in our lives than anyone could have imagined. Robotics, chemical and pharmaceutical production, power generation, oil production, transportation, mining, healthcare devices, building management systems, and seemingly everything else is becoming part of a smart, interconnected, machine-learning powered system. Machines can now monitor themselves, diagnose problems, and then reconfigure and improve based on the data.<\/p>\n

The threat is real<\/h2>\n

It\u2019s an exciting time, but it\u2019s also an alarming time, especially for CISOs (Chief Information Security Officers) working diligently to employ risk mitigation and keep their companies secure from cyberthreats. Billions of new IoT devices go online each year<\/a>, and as these environments become more connected with digitization initiatives, their attack surfaces grow.<\/p>\n

From consumer goods to manufacturing systems to municipal operations like the power grid<\/a>, it all needs data protection. The threat is very real. Take the Mirai botnet hack<\/a>, for example. 150,000 cameras hacked and turned into a botnet that blocked internet access for large portions of the US. We have also seen destructive and rapidly spreading ransomware attacks, like NotPetya<\/a>, cripple manufacturing and port operations around the globe.  However, existing IT security solutions cannot solve those problems due to the lack of standardized network protocols for such devices and the inability to certify device-specific products and deploy them without impacting critical operations.  So, what exactly is the solution? What do people need to do to resolve the IoT security problem?<\/p>\n

Working to solve this problem is why Microsoft has joined industry partners to create the Open Source Security Foundation<\/a> as well as acquired IoT\/OT security leader CyberX<\/a>. This integration between CyberX\u2019s IoT\/OT-aware behavioral analytics platform and Azure unlocks the potential of unified security across converged IT and industrial networks. And, as a complement to the embedded, proactive IoT device security of Microsoft Azure Sphere, CyberX IoT\/OT provides monitoring and threat detection for devices that have not yet upgraded to Azure Sphere security. Used together, CyberX and Azure Sphere can give you visibility to what\u2019s happening in your environment while actively preventing exploitation of your connected equipment. The goal is to achieve the mission of securing every unmanaged device to help protect critical operations.<\/p>\n

Both Microsoft and CyberX have managed to help protect a large number of enterprises around the world\u2014including leading organizations in manufacturing, pharmaceuticals and healthcare, power utilities, oil and gas companies, data centers, and more, at a global scale.<\/p>\n

This success is due to taking a completely different approach, an innovative solution that prioritizes ease of deployment and use\u2014to provide a security solution custom-built for OT and industrial control systems. So, what do you need to do that?<\/p>\n

Let\u2019s sit in a plant. Imagine that the process keeps on running, so from an operational perspective, all is fine. But even if operations are moving smoothly, you don\u2019t know if someone is trying to hack your systems, steal your IP, or disrupt your day-to-day processes\u2014you wouldn\u2019t know that until the processes are disrupted, and by then, it\u2019s too late.<\/p>\n

To catch these threats, you need to understand what you have, understand the process interaction, validate access to the resources, and understand root cause analysis from other breaches. From a technology perspective, to gain this level of understanding, you need automated and intelligent asset visibility, behavioral analytics capable of understanding OT\/IoT behavior, vulnerability management, and threat hunting. To defend against these threats, you will want to deploy an IoT device security solution that implements critical security properties, including defense in-depth, error reporting, and renewable security, that will help keep your connected devices and equipment protected over time.<\/p>\n

Where to go from here<\/h2>\n

For any business looking to learn more about IoT\/OT security, a good place to start is by downloading CyberX\u2019s global IoT\/ICS risk report<\/a>. This free report provides a data-driven analysis of vulnerabilities in our Internet of Things (IoT) and industrial control systems (ICS) infrastructure.<\/p>\n

Based on data collected in the past 12 months from 1,821 production IoT\/ICS networks\u2014across a diverse mix of industries worldwide\u2014the analysis was performed using passive, agentless monitoring with patented deep packet inspection (DPI) and Network Traffic Analysis (NTA). The data shows that IoT\/ICS environments continue to be soft targets for adversaries, with security gaps in key areas such as:<\/p>\n