New-Tech Europe Magazine | Q2 2021

So, where to begin? Critical infrastructure companies need to be able to identify and track threats from IoT/IIoT devices that cross IT and OT boundaries. But the reality is that OT networks have been a blind spot for IT security professionals for decades. As more legacy OT assets become internet- facing, and industrial companies add more internet-connected devices to their environments to drive automation and modernization, the challenge of mitigating risk will only grow. Due to lack of visibility and telemetry, OT and IT security teams are often in the dark, unaware of CPSs already deployed in their environment and their behavior. Proactive risk management requires being able to examine and address risk from different yet complementary perspectives to bring context to the overall security of an OT environment. Critical to accomplishing that is having a clear understanding of an organization’s asset risk posture and network traffic. Understanding asset risk posture begins with visibility into industrial control system (ICS) networks and endpoints, and centralizing IT, OT, IoT, and IIoT asset information without the need for added connectivity. This way, human-machine interfaces (HMIs), historians, and engineering workstations (EWs) can be enriched with information about IT threats and vulnerabilities, improving the security of these assets without impacting productivity or downtime. Contextual security information

related to network traffic is also key to identifying and tracking threats that cross the IT/OT boundary. Many attacks that impact OT environments begin on the IT network, so defenders require threat signatures for ICS devices and OT networks as well, in addition to those built for IT systems. Having a technology that secures CPSs, without the need for signature reconfiguration or manual updates, accelerates detection and response. IIoT devices are quickly becoming a hallmark of modern OT environments and an accelerator of competitive advantage. Let’s learn from insights into risks and costs, and from guidelines put forth in new regulations, to get ahead of the risk IIoT devices can introduce to industrial environments.

Gartner refers to the combination of these networks and assets as cyber-physical systems (CPSs) and predicts that the financial impact of attacks on CPSs resulting in fatal casualties will reach over $50 billion by 2023. They note that even without taking the actual value of a human life into the equation, the costs for organizations in terms of compensation, litigation, insurance, regulatory fines and reputation loss will be significant. Adding urgency to address the situation, Gartner expects that by 2024, 75% of CEOs will be personally liable for CPS incidents. How to Mitigate Risk To address the rising use and risk associated with IoT devices, the IoT Cybersecurity Improvement Act was officially signed into law on December 4, 2020. Recognizing a lack of uniformity in identifying vulnerabilities and supply chain risk introduced by IoT devices, the Act seeks to replace today’s largely ad hoc approach with standards and guidelines. The Act includes several provisions, but the bottom line is that any IoT device purchased with federal government funds must meet new, minimum security standards – and the deadlines are approaching quickly. While aimed at government agencies and the vendors and service providers they work with, critical infrastructure companies across all sectors would be wise to take their cues from the new law to enhance and formalize their IoT/ IIoT security best practices.

Yaniv Vardi, CEO of Claroty - the industrial cybersecurity company

New-Tech Magazine Europe l 23