Representative End User Clients
Representative Automation Clients
Representative Software Clients
I attended a 2-day IoT Security event this week in Boston. While ARC market research covers industry, this event featured end users and suppliers from many different verticals and from all along the value chain. But all were focused on improving the security of IoT applications. The value for industrial people here was the ability to share (and learn from) other market segments, some of which have already learned some hard lessons about IoT security, especially at the device level. I found a high degree of commonality in concerns about IoT security across the full spectrum of verticals and applications.
For example, one session described a consumer medical IoT application that was deployed for the Apple/iOS platform. It had teething problems with updates. A physical medical device or pharmaceutical product is recalled by the manufacturer when a major defect is found. But how can a supplier recall an app from the Apple store? This can't be done. Rather, the app needs to validate itself at run time as a defect-free version and receive external authorization to run and perform its service. This kind of security by design could readily be transferred to the IIoT world. After all, many industrial devices operate continuously for months or even years at a time. The extra processing and communication required for this type of validation is not significant when the device's operating cycle becomes longer.
Another common issue was managing the IoT supply chain, especially with respect to software. An excellent presentation by Paul Koster of Philips Lighting on their Hue lighting product line emphasized the need to reduce the attack surface for all types of devices. Philips also pointed out that the security of encryption keys needed to be maintained end-to-end, from the factory through the operating life of the devices. Again, though the Hue products target consumers, the security practices they have developed (after a painful hack in Hue's case) should be considered by industrial OEMs who are preparing their products for the far greater connectivity required by the IIoT.
Shell Technology Ventures Shares Panel with Suppliers
One session in the event was dedicated to industrial IoT applications. This featured a panel with a representative from Shell Technology Ventures (Carl Stjernfeldt) along with several suppliers of hardware and software security solutions. In Shell's view of the IIoT "as we get more connectivity we can get more value from our processes. One thing I will guarantee is that in 10 years we will have many more sensors than we have today both fixed on machines and by sensorizing our people wherever they are."
The long project and equipment operating life-cycle of the Oil & Gas industry presents a formidable barrier for Shell, however. Another barrier is management of risk along the supply chain. While surely oil & gas production operations can benefit from greater information sharing and collaboration with their suppliers, these suppliers are unable to share in the additional operational risks that such connectivity may create. Finally Shell noted that while the firm employed over 94,000 people there were many supplier/partner firms who provide key personnel and services, so all types of solutions need to be extensible beyond the reach of Shell's enterprise infrastructure.
The suppliers on the panel, including device security solution providers (such as Atmel, Infineon, and Verisign) were asked to comment on what are the most common security mistakes made by industrial device OEMs. Generally the answer was that OEMs had very limited deep expertise in device security (after all, this is a scarce resource everywhere). This makes it difficult for them to make optimum make/buy decisions. As a result, they often made mistakes such as building their core software technology around "black box" software components that they were not deeply familiar with. They also cited lack of security principles and threat modeling at the design stage of products. They believed that any emphasis on perimeter security as a solution was indicative of a lack of experience. As connectivity grows, perimeter security fails to work. Finally, they said OEM executives needed to stop viewing device security as a pure cost center.
Security is Top of Mind
What is an indisputable take-away here is that security is the top concern of everyone in the IoT value chain, whether industrial or any other market segment. As OEMs plan for the IIoT, they need to fundamentally re-think their entire design process. OEMs will need to know much more about their supply chains going forward, especially their software supply chain. They also need to design their products to operate securely in an environment of ubiquitous connectivity. Given how long many industrial systems stay operational, ubiquitous connectivity will be fully realized during the life of the industrial products being designed now.
For example, one session described a consumer medical IoT application that was deployed for the Apple/iOS platform. It had teething problems with updates. A physical medical device or pharmaceutical product is recalled by the manufacturer when a major defect is found. But how can a supplier recall an app from the Apple store? This can't be done. Rather, the app needs to validate itself at run time as a defect-free version and receive external authorization to run and perform its service. This kind of security by design could readily be transferred to the IIoT world. After all, many industrial devices operate continuously for months or even years at a time. The extra processing and communication required for this type of validation is not significant when the device's operating cycle becomes longer.
Another common issue was managing the IoT supply chain, especially with respect to software. An excellent presentation by Paul Koster of Philips Lighting on their Hue lighting product line emphasized the need to reduce the attack surface for all types of devices. Philips also pointed out that the security of encryption keys needed to be maintained end-to-end, from the factory through the operating life of the devices. Again, though the Hue products target consumers, the security practices they have developed (after a painful hack in Hue's case) should be considered by industrial OEMs who are preparing their products for the far greater connectivity required by the IIoT.
Shell Technology Ventures Shares Panel with Suppliers
One session in the event was dedicated to industrial IoT applications. This featured a panel with a representative from Shell Technology Ventures (Carl Stjernfeldt) along with several suppliers of hardware and software security solutions. In Shell's view of the IIoT "as we get more connectivity we can get more value from our processes. One thing I will guarantee is that in 10 years we will have many more sensors than we have today both fixed on machines and by sensorizing our people wherever they are."
The long project and equipment operating life-cycle of the Oil & Gas industry presents a formidable barrier for Shell, however. Another barrier is management of risk along the supply chain. While surely oil & gas production operations can benefit from greater information sharing and collaboration with their suppliers, these suppliers are unable to share in the additional operational risks that such connectivity may create. Finally Shell noted that while the firm employed over 94,000 people there were many supplier/partner firms who provide key personnel and services, so all types of solutions need to be extensible beyond the reach of Shell's enterprise infrastructure.
The suppliers on the panel, including device security solution providers (such as Atmel, Infineon, and Verisign) were asked to comment on what are the most common security mistakes made by industrial device OEMs. Generally the answer was that OEMs had very limited deep expertise in device security (after all, this is a scarce resource everywhere). This makes it difficult for them to make optimum make/buy decisions. As a result, they often made mistakes such as building their core software technology around "black box" software components that they were not deeply familiar with. They also cited lack of security principles and threat modeling at the design stage of products. They believed that any emphasis on perimeter security as a solution was indicative of a lack of experience. As connectivity grows, perimeter security fails to work. Finally, they said OEM executives needed to stop viewing device security as a pure cost center.
Security is Top of Mind
What is an indisputable take-away here is that security is the top concern of everyone in the IoT value chain, whether industrial or any other market segment. As OEMs plan for the IIoT, they need to fundamentally re-think their entire design process. OEMs will need to know much more about their supply chains going forward, especially their software supply chain. They also need to design their products to operate securely in an environment of ubiquitous connectivity. Given how long many industrial systems stay operational, ubiquitous connectivity will be fully realized during the life of the industrial products being designed now.