How to Secure Industrial IoT (And Why You Should Assume You Can't Prevent a Data Breach)

The Industrial Internet of Things (IIoT) is already driving massive productivity gains in the Manufacturing and Energy & Utilities industries through decreased waste, automated quality control, predictive maintenance (increasing overall equipment effectiveness) and optimized energy consumption...just to name a few.

At the same time, internet-enabled equipment and IoT devices present a cybersecurity vulnerability, particularly to ransomware, that can cause a business to go offline for days (or even weeks). The cyberattacks on Colonial Pipeline, which shut down the largest system of gas pipelines to the East Coast and is still causing major delays and other repercussions, is just the latest example. Even before this event, ransomware accounted for the largest share of cybersecurity attacks against enterprises across all industries.

Unlike traditional malware hacks in which perpetrators try to go unnoticed in order to siphon valuable information, such as financial accounts or trade secrets, ransomware organizations want their work to be noticed -- they are seeking to disrupt core operations in the most disruptive way possible, forcing victims to pay or else be unable to conduct all business. This has made IIoT a particularly significant target to ransomware organizations.

Whereas in the analog age “equipment downtime” was primarily the result of maintenance and mechanical failures, IIoT creates new security challenges such as software bugs or malicious attacks shutting down the assembly line. These disruptions have large financial repercussions, as these enterprises continue incurring fixed labor and plant costs while losing revenues and possibly missing contractual SLAs, affecting key customer and vendor relationships.

While prevention is still the main line of cybersecurity defense, security solution architects recognize that it is near impossible to build a complex system that is both 100% secure from outside threats and provides the flexibility to take advantage of the latest technology in the sector. As a result, the strategy for connected devices is shifting from prevention to harm reduction as security professionals work to build redundant and resilient systems to minimize disruptions to overall production.

Their main question has become: assuming a data breach, how do you minimize data exfiltration and, just as importantly, how do you get back to business as quickly as possible?

Data engineering and AI have become key tools for security teams creating resilient systems. For example, engineers will stand up a digital twin recreating their cloud-to-edge environment for security analysts to wargame different attack scenarios. This enables them to proactively identify security issues and vulnerabilities (e.g., a patch or update which hasn’t been installed in a specific system), as well as flag bottlenecks in complex processes as candidates for creating redundancies.

Assuming a hacker organization gets into the network, however, how do you prevent them from causing harm once they’re in? At Databricks, a modern, effective approach we’ve seen from our customers is automating key portions of security analysis around the functions carried out in their network. Some of our customers, for example, conduct their ETL on Databricks for specific kinds of commands to their infrastructure, automatically appending qualities like command provenance or previous alerts. Security analysts then have actionable information on the security risk and whether to flag the command for further inspection or allow it to execute. This data enrichment process for security has saved one of our customers close to an hour for each of these events, which occur dozens of times during the day, so that they can continue operating their business efficiently, but securely.

Additionally, the solution for future systems is to isolate and distribute the data and software running their factory floors. That is, organizations will conduct the bulk of data storage and processing in the cloud to take advantage of security best practices around partitions and redundancy. Let’s see what this looks like in action:

Complex machine learning (ML) model development (say, for example a computer vision ML model identifying poor output coming out of the production line) happens in the cloud, which is then deployed in a pickle file at the edge where processing latency matters most. This way, if individual pieces of smart equipment, or even the entire factory floor, are blocked by a ransomware attack, it becomes easier to reboot the entire system and redeploy the machine learning models to the edge devices.

As 5G and IoT continue to revolutionize the factory floor, we will continue to see new attack vectors for malicious actors seeking to disrupt production. But by designing their systems with the assumption of failure, manufacturers, energy companies and utilities (or any enterprise dependent on network-enabled equipment) can use data engineering and AI to limit disruption to their production.

You can see our listing of security-related sessions at Data + AI Summit here.