Industry executives and experts share their predictions for 2023. Read them in this 15th annual VMblog.com series exclusive.
Why You Need to Pay Attention to IoT and IIoT Cybersecurity in 2023
By Irfan Shakeel, VP of Training and Certification Services, OPSWAT
In the past few years, we have seen a massive technological advancement of Internet of Things (IoT) devices. And it’s not just within the private sector; there have been advancements in the business and industrial sectors as well. These developments come with great benefits, but hold many security challenges as well. As such, it’s important to look at where the cybersecurity road leads for IoT and Industrial Internet of Things (IIoT) devices in 2023.
The Security Risks of Connected Devices
When it comes to IoT, particularly those devices that make our everyday lives more pleasant and convenient, interconnection is the key.
An IoT device can be anything from a fitness watch to a smart TV or even your remote garage door opener, all of which can be controlled via the Internet. They store little to no data at all, so security is not a priority when they are designed. Although they are simple, IoT devices lack proper security measures and rely on internet connectivity. Consequently, they are lucrative targets for cybercriminals.
IoT devices risks are hidden from the user’s point of view, and most of us wouldn’t consider them as possible threats to private data or sensitive information. But indeed they are.
For instance, an internet-connected fish tank once served as a tool for breaching an undisclosed North American casino. This is one example of outside-the-box cyberattacks, which are becoming more frequent. In this case, the hacker breached the internet-connected sensor management system of an everyday fish tank to access the internal network of the casino.
Due to negligence, a lack of awareness of the risk, or even gullibility, users can easily fall victim to data and identity theft, man-in-the-middle attacks, social engineering, or botnet exploitation.
Mirai is an excellent example of the latter. This botnet is specifically designed to look for unsecured IoTs connected to the internet. Then, it seizes control over the related computer and makes it a part of a botnet to carry out Denial of Service (DoS) and Distributed Denial of Service (DDoS) attacks. This malware is infamous for bringing down the Domain Name System (DNS) provider, Dyn, in 2016, originally as a way to help college students corner the Minecraft market.
Covid-19 also gave a real boost to the rise of IoT devices. According to Statista, in 2019, there were 8.6 billion such devices worldwide. IoT sensors were used to reduce work-related risks during the pandemic, and as a result, this number rose to 13.14 billion by 2022. It is estimated that the figure will exceed the 15 billion mark in 2023, which means that 15 billion unsecured IoT devices will be out there, providing possible attack vectors for malware and cybercriminals.
IoT Brings Security Challenges to Industries
Operational Technology (OT) environments are mostly air-gapped to ensure a secure network, while internet-connected Information Technology (IT) environments are protected by properly set-up cybersecurity measures such as firewalls. According to Allied Market Research, in 2016 the IIoT market was valued at USD 116 billion, and the predicted value for 2023 will be USD 197 billion. This is a 70% market expansion in a period of seven years. Today, more and more IIoT devices connect the OT and IT environments and are responsible for critical industrial functions. Breaching such a system through IIoT can have far-reaching consequences, and the growth of the IIoT market increases the potential targets for attackers.
According to Forrester, some 72% of global telecommunications decision-makers at enterprises are implementing, expanding, or planning to implement IoT solutions across all major industry categories, but we know that the industrial and business application of IoT devices opens another battleground for cybercriminals. The high number of applied IoT and IIoT devices and their poor security provides a bridge into any otherwise secured industrial IT environments.
2023: The Year to Focus on IoT Security
The main concern about IoT and IIoT devices is that they have not yet been considered a severe cybersecurity threat, and this allows for serious cybersecurity attacks. While the number of these devices is growing rapidly, necessary protective measures are falling far behind. This is a major concern since the exploitation of these devices brings the effectiveness of already existing cybersecurity measures into question.
Due to the extensive use of IoT devices, the focus on user experience has risen significantly in the past couple of years, which has increased the focus on security. Recognizing the current weaknesses in this area, 2023 will see the large-scale emergence of IoT and IIoT security investments and growing governmental legislation.
The first significant sign of a top-to-bottom initiative is the 2021 US President’s Executive Order (EO) 14028 on Improving the Nation’s Cybersecurity, which, among others, urges labeling efforts for consumer IoT devices. While some may argue that manufacturers should build better security into the devices, usability is oftentimes prioritized – making security an afterthought. The idea of labeling communicates the need to address the growing risks of IoT devices, and the main idea behind the initiative is to protect customers from themselves; hence, manufacturers should inform consumers – just like on a pack of cigarettes – about IoT-related cybersecurity risks.
According to Statista, while IoT security spending was “only” USD 912 million in 2016, it reached 3.1 billion in 2022 and is expected to top around 6 billion in 2023, which shows the security concerns of the market and the need for minimum regulatory standards.
It is high time to consider the risks of IoT and IIoT – which pose a major security threat to our society and industrial segment – when planning out cybersecurity measures. While it may not be on our immediate radar, most of the cybersecurity measures we painstakingly implement and manage can fail due to design-related flaws of IoT and IIoT devices. It is past time to demand better security from device manufacturers and ensure that organizations in the industrial industry understand how to secure them better and why it is a business imperative to do so.
##
ABOUT THE AUTHOR
Irfan Shakeel, VP of Training and Certification Services, OPSWAT
Irfan Shakeel is a cybersecurity thought leader, entrepreneur, and trainer; he is currently working as VP of Training & Certification services at OPSWAT. Irfan has enabled more than 150K students to get into cybersecurity; he has founded a pioneer training platform called ehacking.
