Vincent GACHE

Next level IIoT Security

Mon, 17 Aug 2020 21:51:00 GMT

IIoT - Industrial Internet Of Things - is the dedicated IoT sector for industries. Because of the industry 4.0 revolution, everything is moving fast. Every day brings new products, new software, platforms and services. Most companies work hard to embrace the current digital era, some think of it, while the others are not aware or interested yet.

This kind of projects mobilizes a lot of resources, time and money. At the same time, the company Information System is getting more complicated and a lot of devices are becoming “smart” through internet accessibility. That provides a lot of tremendous advantages. But it also weakens the security of the company’s system by expanding the attack surface.

IIoT suffers from a lack of experience in cybersecurity

The Industrial IoT Market is highly competitive and features the presence of a large number of foreign and regional players. The market has witnessed growing rivalry between vendors based on the pricing model, differentiation of technology, brand name, service quality, product differentiation, and technical expertise. Source

Security is not a priority for IIoT device makers because of price competitivity, device complexity and the lack of experience in cybersecurity. For sure the price competitivity is a big factor.

Nowadays, there can be large gaps while dealing with cybersecurity. Indeed, while large companies invests in one or many cybersecurity teams, for small companies on the other hand, it’s another story. The complexity of securing an IIoT network is growing accordingly to the quantity of devices connected and data collected.

IIoT extra complexity

IT sector has been experiencing cyber threats for a long time, facing security breaches through various attack vectors and threats like virus, Botnet, Social Engineering, ransomware, phishing, DDoS, etc. And that’s still a very challenging job.

IIoT security imply a new level of complexity with the heterogenity of devices, constant network reconfiguration because of adding or removing devices, scaling, latency, privacy, OT (Operational Technologies) and IT (Information Technologies) network interconnectivity and lack of standards. And that’s even more challenging when you know that, for many IIoT projects the goal is to make automated smart decisions in real-time.

And because of the IIoT concept nature you have to also consider the following threats :

Reverse Engineering
DDos
Man in the Middle
Replay Attack
Brute Force
Buffer Overflow
Botnet
Ransomware
Malicious Attack
Resource Exhaustion
SQL Injection
Metadata Spoofing
Hardware tampering Source - Industrial IoT Security Threats and Conerns by Considering Cisco and Microsoft IoT references Models by Zeinab Bakhshi, Ali Balador and Jawad Mustafa

And those threats need to be addresses in an environement where we are struggling with the rise of botnets and ransomwares, outdated legacy security, infrequent security updates, user privacy, …

Source: Trend Micro

We have a notorious example of an OT system compromised through the IT network. The December 2015 cyberattack against a power grid in Ukraine allowed to infect and shutdown critical systems and disrupt power in many houses.

The complexity of Information System is growing fast, and if you add the IIoT complexity, it can become a nightmare. Industries and companies adopting the IIoT have to plan and operate like tech companies in order to manage both physical and digital components securely.

Is Machine Learning an option ?

Machine learning (ML) is an application of artificial intelligence (AI) that provides systems the ability to automatically learn and improve from experience without being explicitly programmed - Source Blog Expert System

Basically, machine learning is a bunch of computer algorithms which are getting better through experience. It can be trained with massive dataset to generate a constantly evolving model which can be use to predict outcomes.

NB: I do not like to use the “smart” word speaking of ML. Smart can usually be used for the people who created ML Algorithms.

This is used in a wide variety of applications :

predictive maintenance,
industrial vision or computer vision,
Siri, Alexa or Google Assistant,
Image recognition,
…

The very interesting part of this technology is the capacity to adapt models in real-time depending of dataset and dynamic parameters. Theoretically speaking we can imagine training models for an IT + OT Security System.

The ML system would be able to detect both known and unknown attacks. About the known ones you can train models to predict attacks by learning attack patterns or events from examples. About the unknowns one, it can detect unusual event, series of events, behaviors, or patterns and alert accordingly.

With ML you can train models which can adapt security rules quickly depending of the changing environment: adding/removing devices, apps, cloud services, … in IT and OT systems.

You can read the JCSE (Journal of Computer Sciences and Engineering) paper about Machine Learning DDoS (Distributed Denial of service) Detection Using Stochastic Gradient Boosting. M Devendra Prasad, Prasanta Babu and C Amarnath improved the performance of their models to reach 100% detection by using a dataset of diversified DDoS flows with more than 10 million bidirectional flows and meticulously tuning the hyperparameters. Basically they gave more data to feed the beast and generate a more accurate detection model.

I think there are many flaws using ML for cybersecurity especially when the attacker knows that’s the company is using this kind of technology. Again Machine Learning is made of algorithms. You can beat an algorithm. But I find this approach very intersting for answering the complexity of IT & OT systems.

By the way, some of the technology leader companies already uses ML for security purposes like Google and Apple with facial recognition for authentication on your smartphones ;)

If you want to read some papers about IoT security and Machine Learning:

IoT Security techniques Based on ML - https://arxiv.org/pdf/1801.06275.pdf
Machine Learning in IoT Security Current Solutions and Future Challenges - https://arxiv.org/pdf/1904.05735.pdf

Solving IIoT Security Challenge

We have seen that the security challenge is not just about IIoT. It’s all about IT and OT environments. There is a clear lack of knowledge about complex security and risk mitigiation by the OT staff.. On the other hands IT specialists are not familiar with OT environments.

IIoT is made of multiple constantly growing and evolving components. Each one can be the next security breach.

So we all need to step up and change/adapt our approaches.

Firstly, the device makers needs to adopt a secure-by-design methodology and stop adding bad security layers as an after thought. We have a lot of great cybersecurity experts outhere. Just contact them, they will be glad to help you.

Secondly, we need to train the communication between OT and IT teams. They need to identify the industrial assets and implement accordingly a risk, threat and security management process.

Finally, discover, find, adapt, use, the best tools, technologies and skills to help you in this process.

As a reminder, when industrial systems are hacked the effects can be catastrophic.

IIoT is about smart data

Sat, 08 Aug 2020 16:51:00 GMT

I am quite sure you already have heard about IoT during the past years. In this post, I will not discuss about IoT for public. My focus is on IoT for industry in the industry 4.0 era called IIoT for Industrial Internet Of Things. IoT is a new concept for the industry sector. My definition of IIoT could be:

Extract more and more smart data from your industry send it to a suitable storage and do something with it to improve your decision making.

I will present you what is IIoT with the smart data concept and what you should do with it.

Define the goal of your IIoT project

Before diving in the technical stuff, you need to define the goal of your project. If you are in industry sector, you don’t want to do an IIoT project just because everyone is doing it or it is a trend. You will invest in this kind of project just if you have a problematic to solve and that is strategic for your company. Usually, IIoT is all about competitivity through efficiency and effectiveness.

Depending of your needs and your organisation you have to define your goal(s) with your project. It could be to display KPIs (Key Performance Indicator) on a real-time dashboard (Like OEE - Overall Equipment Effectiveness, a standard more measuring manufacturing productivity) to help your field agents to be more efficient, simply be able to send an alarm to the operator smartphone, send smart data to ERP, CRM, MES, SCADA, Business Intelligence, …

Here is some known IIoT projects:

Get KPIs and OEE in real time to point the weaknesses in your production process in a very early stage.
Send production data to ERP and CRM to make better decisions and have a better communication with sales and production.
Create an automated machine learning model to prevent machine failure and organize maintenance
Become more flexible on your production lines.
Be energy efficient on your production line
…

Your imagination is the limit. You need to define KPIs to know when you have successfully reach your goal.

Let’s now see how you can work with your data to achieve your newly defined goal.

Data acquisition, gateway and cloud

Nowadays, you can get all the data you need from machines you want in almost every way you can imagine. You can use Digital or Analog DAQ (Data Acquisition), Ethernet DAQ module, Smart sensor, Wireless DAQ, IoT gateways, … to extract the data. In fact, there is a big chance that the data you are looking for is already extracted from machine, sensor or PLC. Because data acquisition in industry is a reality for a long time, way before the IoT concept. So you will always find a way to get the data.

Once you know how to get the data to the Edge (computing done near the data source) or OT network (Operational Technology network) you need to send it to a convenient storage. If you have the appropriate budget, send it to a smart storage it is even better, but not mandatory.

One important point, in order to have a successful IoT project, is the communication between OT Team and IT team. Usually, they use a different vocabulary and sometimes it could be quite hard to have a fluent communication between them. Without this point, you will have a lot of pain to extract securely the data from one network to the other.

You also have another solution to extract data from your OT network: Mobile gateway which use some wireless technology like 3G/4G, LTE-M/NB-IoT, 5G, LoRaWan/Sigfox, … With this kind of platform, you just send the data wherever you want.

After that, you need to store the data. Choose carefully the solution depending of your needs:

Public and Hybrid cloud is a solution for large collection of data, or sometimes it is convenient if you have data from many different locations
Private cloud or PaaS/SaaS platform if you want to use a specific solution/application
A simple local or hosted server if you do not have a big amount of data or depending of your future usage.

I just present 3 solutions, but you can mix them as much as you want.

Now let us dive in the intersting and hard part of IoT: Extract smart data.

Get smart & important data

What is smart data ? it is not the opposite of dumb data. It is more the idea of getting only relevant data that you need, not raw data that needs to be processed before being useful.

So now why you just want smart data ? for saving money.

Every bit transferred and stored cost money. It is even more true with the cloud.

Remember that extract, translate, send, store and analyze the data cost money. And more data you have more money you need. So I strongly recommend to make a list/map of the data you need before starting the project. Then you can be even more cost effective if you translate and clean your data early. Sometimes invest in a rugged computer or IoT gateway with some logic capabilities is more interesting than sending raw data to your storage.

Because cloud CPU time and Data transfer is expensive, you want to send the smartest data possible, not more, not less. You want to lighten as much as possible your data payloads before sending them to any storage service.

The lighten process depends on your needs and of the devices you extract the data from. As an example if you use a Wireless DAQ module to extract average temperature from a sensor you could also find in the payload some data like:

Status of the wireless
Wireless quality
last reboot data of your device
…

In this use case, you just need the unique identifiant of your sensor, the average temperature and the full timestamp (date & time) of the data.

To manage this part, you might need to get Smart data acquisition modules for the field part, smart IoT gateways for the OT part, Distributing Edge computing, Device-to-cloud DAQ or even your own tailor made solution. Theoretically, you can work on your data wherever you want as long as it is done before your storage service. When you get informations from a sensor or PLC, it is pure raw data, you need to translate it to human readable data. And as I said, the earlier you translate the data to the needed format, the better it is. Depending of your OT architecture and the level of connectivity of your equipment, the Edge computing could be a great solution. And it is not just about being cost effective. If you have an ecology policy and want to be energy effective, based of your amount of data, you have to consider every solutions.

Now that you have the data you need. You can start working on it. In the core of your project: Do something automated and smart with your data to achieve your goal.

Do something with your data

IIoT is not only about technologies. It is about transforming your data in decisions. Technologies just serve reaching your goal.

Once you have collected your smart data your projec is really starting. And that’s the tricky part. You have smart data but it is still raw data. They don’t make any sense. You have to create one or many processes to give sense to your data for reaching your goal. Usually you will need to mix data flow from your information system and your production data to extract what you need.

And for this step, you have many actors on the market. Some are well known from the industry market like Advantech, Nexcom, Schneider, Bosch, Siemens, ABB and some are new like Google, Azure, Amazon, Alibaba and many other small to middle size company. They are all working on offering smart solutions to make your life easier. Some of them are offering very specialized application for specific business. Others are providing generic solutions and framework to analyse globally. You can even mix some of them.

Depending of your goal, you will find those solutions useful, or not. If not you will have to find a partner to help you build your solution.