Table of Contents
- Summary
- Industrial IoT (IIoT) Security Primer
- Report Methodology
- Decision Criteria Analysis
- Evaluation Metrics
- Key Criteria: Impact Analysis
- Analyst’s Take
- Methodology
- About GigaOm
- Copyright
1. Summary
The convergence of operational technology (OT) and information technology (IT) brings not only benefits but challenges as well. Industrial plants and systems are designed for long service life, often 10 years or more. The retrofitting of so-called brownfield plants holds major security risks in the course of digital transformation. These plants are typically run with predominantly proprietary programs and protocols, which are difficult to secure. Networking this old stock with multiple new devices, sensors, measuring stations, and manufacturing robots presents a variety of new threats, making industries such as manufacturing, logistics, energy and utilities, automotive, healthcare, and agriculture highly vulnerable to cyberattacks—and an attractive target for cyber criminals. Outages or production downtimes caused by compromised software, data, or communication channels can result in major economic and material damage. Attacks on critical infrastructure (such as energy or water supply, transportation, healthcare, and telecommunications) threaten public safety.
Previously negligible vulnerabilities now can be easily exploited. Insecure mobile and web interfaces represent additional gateways and attack surfaces. The number of open ports in industrial internet of things (IIoT) environments is alarming. Additional risks can be found in the use of outdated firmware and code libraries, lack of limitations on access rights, and insufficient authentication with shared and default passwords.
Still, the greatest danger to industrial plants is not the vulnerabilities in systems but the OT operators themselves. Often forced by external factors to digitize, many OT operators lack the necessary understanding and awareness of the risks of a networked world. This lack of understanding about IIoT security should not be underestimated—most personnel, such as machine builders and plant installers, will know more about safety than security.
At the same time, many IT security solution providers don’t understand OT needs. Due to long investment and depreciation cycles, manufacturers and vendors of IIoT security products must support a variety of legacy standards in addition to the current ones, and the proprietary protocols used in industrial networks and equipment.
Security solutions should be implemented as an additional, preferably transparent, layer. Visibility is the most important tool in the fight for effective security. You can only protect what you know.
How to Read this Report
This GigaOm report is one of a series of documents that helps IT organizations assess competing solutions in the context of well-defined features and criteria. For a fuller understanding, consider reviewing the following reports:
Key Criteria report: A detailed market sector analysis that assesses the impact that key product features and criteria have on top-line solution characteristics—such as scalability, performance, and TCO—that drive purchase decisions.
GigaOm Radar report: A forward-looking analysis that plots the relative value and progression of vendor solutions along multiple axes based on strategy and execution. The Radar report includes a breakdown of each vendor’s offering in the sector.
Solution Profile: An in-depth vendor analysis that builds on the framework developed in the Key Criteria and Radar reports to assess a company’s engagement within a technology sector. This analysis includes forward-looking guidance around both strategy and product.