This blog on the pillar of resiliency is 2 of 5. Want to read up on the previous blogs?
Click on the link below. 
Week1: i-PRO’s Internet of Things Cybersecurity Pillars to build a strong security program 

Have a question? Contact us at
CybersecurityExpert@i-pro.com

Resiliency refers to our ability to withstand, recover from, and prepare for potential issues in our environments. Simply put, will your devices be there when you need them the most? Will your security system work when the power goes out? Will your cameras survive high winds and severe storms? How quickly can you bring manufacturing or services back online in the event of a cyber-attack? These are the types of questions that will help you determine your organization’s resiliency.

Today’s organizations rely on Industrial Internet of Things (IIoT) devices to control power, security, fire suppression, Heating Ventilation and Air Conditioning (HVAC), manufacturing, and much more. Our businesses, our security, and sometimes even our lives rely on these devices to function properly. As security professionals, we must make sure that we build resiliency and redundancy into these systems, and in the networks that surround them. 

One of the ways that we can help build resiliency into our systems is to imagine the worst-case scenarios and tabletop those scenarios. What is a tabletop exercise? A tabletop exercise is where an organization gathers its key stakeholders and imagines something terrible like a severe weather condition (hurricane, tornado, floods), loss of power, loss of communication, or cyber-attack. For example, a tabletop exercise might include key stakeholders from IT, HR, Sales, Finance/Accounting, Engineering, Development, Customer Service, and Operations department – all sitting at one table. Then we ask those stakeholders to tell us what happens to their customers, employees, equipment, etc. in the event of a catastrophe. Doing these tabletop exercises frequently will help your organization identify gaps in resiliency.

Some of the actions that you can take to make your organization’s IIoT devices more resilient are:

Build or purchase devices with strong protection

• Purchase devices from companies that do vulnerability testing and fix issues in devices. Many IoT/IIoT devices are developed quickly and cheaply, so consider how long the company has been around and what their reputation is for maintaining their products after they have been released

• Look for IIoT devices that use encryption to protect data in transit and data that is stored on the device

• Devices should support secure protocols and standards like 802.1x integration

Build secure network topologies to protect the devices

• IIoT devices should always be carefully controlled through physical, technical, and administrative controls set by your organization. NIST is a great free resource to help get you started

• IIoT devices should never be publicly accessible and should be properly segmented to ensure that they are protected from hackers
  Purchase devices that are made to withstand your unique conditions (salt, high winds, dust, explosion proof, lightening, high temperature)

• Take weather and atmospheric conditions into consideration when purchasing IIoT devices and be sure the device is rated or tested to withstand your unique conditions. For example, if deploying a device to coastal Florida, you may want something rated for salt exposure, high winds, and lightening

Backup device configuration data

• Having backups can ensure that if a device breaks or becomes corrupted that you can easily restore it or bring in another device
  Consider redundant devices with secure failover

• Redundant devices provide backups in case a device fails for whatever reason

• Failover refers to what the system does when a device fails. By using failover systems, the function that the IIoT provides will continue to work while the failed device is being replaced or fixed. For example, what happens to your electromagnetic lock when the power fails? Does the door remain locked, or will it unlock?

Consider battery backups or generators

• Devices that supply critical functions should at minimum have an uninterruptable power supply (UPS) to help protect against short power outages

• Generators may also be a good idea if the device needs to continue to function during a prolonged power outage

In summary, building resilience in IoT/IIoT requires a partnership between the manufacturer of the device, the physical security expert at the organization, and the cybersecurity expert. Manufacturers are responsible for producing quality products that meet security standards. They must be willing to update their products when vulnerabilities are discovered in a timely fashion. The physical security experts must make sure devices are adequately protected, installed, and implemented. Cybersecurity folks must make sure the devices have the proper technical controls in place to be protected from cyber-attacks.

Join us next week when we will discuss cyber hygiene!

Have a question? Contact us at
CybersecurityExpert@i-pro.com