Industrial and Consumer Internet of Things: Cyber Security Considerations, Threat Landscape, and Countermeasure Opportunities

Abstract

shown in Figure 1. IT and OT networks have the same Confidentiality, Integrity, and Availability (CIA) priority in the network/information security model but ranked in different priority order, IT -(CIA) and OT -(AIC) [6]. This implies that certain compromises have to be reached in some legacy OT use cases in prioritising safety and availability against security. An IT system may trade availability with security by shutting down systems in the event of cyber-attacks. In contrast, OT may trade availability with security when not connected to the internet. Industrial cybersecurity is the process of protecting Industrial Control Systems (ICS) from cyber-attacks. Industrial cyber threats could come from the inside or outside of an organisation and relate to industrial safety concerns for protecting critical infrastructure. Privacy and security are some of the most significant challenges for applying IoT in the industries. The types of security vulnerabilities recorded in generic IoT networks are increasingly seen in the industrial domains [5]. Notable examples include the Stuxnet discovered in 2010 by the VirusBlockAda that affected the Iranian uranium facility in 2014 [7], the Mirai botnet that affected millions of network routers and IP cameras in 2016 [8], the Distributed Denial of Service (DDoS) attack that took down the Finland heating system in 2016 [9], Brickerbot that leveraged the default password and user names on IoT devices in 2017 [10], and the 2021 Colonial Pipeline ransomware and data breach cyberattack that impacted computerised devices [11]. The security systems developed for consumer IoT networks cannot be directly deployed to industrial networks because of the differences in communication requirements. The communication requirements of Cyber-Physical Systems (CPS) and generic IoT is different and not clearly defined [1] but they are expected to handle data processing with higher levels of CIA. Similarly, emerging IoT innovations are enabling the successful convergence of IT and OT networks with no formal boundary [12].