How connected assets create security blind spots

At what pace has the con­nect­ed asset envi­ron­ment accel­er­at­ed in recent years?
It’s expand­ing rapid­ly. There’s been a dra­mat­ic increase in both the num­ber and types of devices on net­works, many of which com­pa­nies depend on as a crit­i­cal part of what makes their busi­ness run. By 2025 the num­ber of con­nect­ed assets will go beyond any­thing we could have imag­ined just a few years ago. The biggest change is the migra­tion away from tra­di­tion­al assets – com­put­ers fill­ing up the net­works and doing the work – to a whole host of oth­er devices. As many as 75% will be non-IT assets con­tain­ing embed­ded soft­ware. It’s not just con­trollers that hap­pen to be online. It’s also indus­tri­al robots, for instance, in facil­i­ties that organ­i­sa­tions rely on. Most com­pa­nies haven’t been able to keep up with this pace of change.

How many of these con­nect­ed assets are designed for secu­ri­ty-first?
They weren’t real­ly designed with secu­ri­ty in mind at all. If you have any infra­struc­ture net­work, man­u­fac­tur­ing net­work or even just a busi­ness that’s been around for longer than 20 years, you will no doubt have lega­cy devices. If you’re in the ener­gy sec­tor, as one exam­ple, lega­cy devices made 20 years ago are what run your busi­ness, and they were cer­tain­ly not designed with secu­ri­ty in mind. They were sim­ply built to func­tion, and they’re unman­age­able by agents today. The sav­ing grace has been that attack­ers are gen­er­al­ly only now start­ing to gain the spe­cial­ist knowl­edge to under­stand these kinds of devices that run fac­to­ries, con­trol dams, water treat­ment facil­i­ties and the like. Until fair­ly recent­ly busi­ness­es were kept rea­son­ably pro­tect­ed, at least rel­a­tive to how exposed they are. But that’s chang­ing very fast.

Just how exposed are com­pa­nies to these kinds of threats?
If com­pa­nies knew how exposed they were on a foun­da­tion­al lev­el, they wouldn’t be so wor­ried about the niche, high-skill attacks from nation states. They’d be far more wor­ried about the open­ings and gaps that are mak­ing them vul­ner­a­ble to less-skilled attack­ers. While com­pa­nies pri­ori­tise the sub­set of tra­di­tion­al­ly well-safe­guard­ed assets, bad actors are keen­ly focused on the vast­ly expand­ed attack sur­face of assets inside and out­side the perime­ter. Assets not active­ly mon­i­tored by secu­ri­ty tools or tracked across the attack sur­face are effec­tive­ly invis­i­ble, and if unchecked bring an uncal­cu­lat­ed risk of expo­sure. Fee­ble in-depth defences from the edge to the data cen­tre give adver­saries the upper hand. The increas­ing fre­quen­cy and sophis­ti­ca­tion of oper­a­tional tech­nol­o­gy (OT) attacks is a wake-up call to all asset oper­a­tors, con­trols engi­neer­ing teams, IT net­work oper­a­tions and cyber­se­cu­ri­ty teams.

In which indus­tries are you see­ing at a par­tic­u­lar­ly height­ened risk expo­sure?
Man­u­fac­tur­ers and health­care providers are key sec­tors for IoT, but we are also see­ing retail expe­ri­ence a surge. Even though retail is not man­u­fac­tur­ing, retail­ers have dis­tri­b­u­tion facil­i­ties and their lack of IoT secu­ri­ty means they are a tar­get. If you’re in ener­gy or man­u­fac­tur­ing, you’ve had this under­stand­ing of lots of dif­fer­ent devices in your envi­ron­ment for a while. But big retail­ers with thou­sands of stores effec­tive­ly don’t know what’s in them. They’re not used to work­ing with those devices, but they are get­ting breached through them.

What are poten­tial con­se­quences of a cyber­at­tack on con­nect­ed assets?
There are a cou­ple of pri­ma­ry goals for cyber­crim­i­nals. Ran­somware is typ­i­cal­ly an eco­nom­i­cal­ly moti­vat­ed attempt to lock up your data until you pay to get it back. That can be very cost­ly finan­cial­ly. But nation state attacks, or real­ly tar­get­ed attacks, don’t always have eco­nom­ic motives. Like with the famous Not­Petya attack, attack­ers might be sim­ply try­ing to destroy the data to thwart oper­a­tions. On infra­struc­ture attacks, specif­i­cal­ly, the goal could be to dis­rupt or alter what’s hap­pen­ing with, for instance, water treat­ment. Stuxnet is the most famous OT cyber attack and it ruined a large chunk of Iran’s nuclear cen­trifuges. As well as caus­ing sig­nif­i­cant eco­nom­ic, oper­a­tional and rep­u­ta­tion­al dam­age, cyber­at­tacks on con­nect­ed assets can also cause envi­ron­men­tal haz­ards and even threat­en people’s safe­ty.

Why do com­pa­nies need to shift from data-cen­tric secu­ri­ty to asset-cen­tric secu­ri­ty?
For a long time enter­pris­es tried to imple­ment a data-cen­tric approach to secu­ri­ty but this has most­ly failed due to the unstruc­tured nature of data. Data-cen­tric secu­ri­ty sounds great until you realise it requires a whole bunch of teams in your organ­i­sa­tion to go through each device and try to code the indi­vid­ual bits of data on it as high risk or not sen­si­tive. It is incred­i­bly dif­fi­cult to cat­a­logue and cat­e­gorise data, and beyond the reach of most organ­i­sa­tions. They might have start­ed the project, but they cer­tain­ly haven’t fin­ished it. Asset-cen­tric secu­ri­ty is a more real­is­tic way of get­ting at data-cen­tric secu­ri­ty. Through this approach, it’s far eas­i­er to cat­e­gorise an asset. You can say this asset is part of a sys­tem that we know has sen­si­tive data some­where in it. That’s far sim­pler than say­ing ‘here’s the sen­si­tive data on this asset’ and then doing that thou­sands of times. Mov­ing to an asset-cen­tric approach allows for far quick­er imple­men­ta­tion of secu­ri­ty con­trols, which then bet­ter address­es the needs of the mod­ern enter­prise, reduces time to val­ue and increas­es the ROI on the secu­ri­ty invest­ment.

How is Armis help­ing organ­i­sa­tions to secure their con­nect­ed assets?
Armis’s uni­fied attack sur­face man­age­ment plat­form pro­vides com­plete vis­i­bil­i­ty with intel­li­gence to secure every asset across the attack sur­face. We have the abil­i­ty, in an auto­mat­ed way, to dis­cov­er assets, iden­ti­fy what they are and also iden­ti­fy what they’re doing. That last piece is crit­i­cal to under­stand­ing the risk of your assets. If it’s an inter­net-con­nect­ed serv­er, you know the risk is much high­er and the data it has on it is less pro­tect­ed. If it’s a serv­er that’s talk­ing to a bunch of data­bas­es, you have an idea that the serv­er is part of a com­plex sys­tem with sen­si­tive data on it. Hav­ing an auto­mat­ed way, with human read­able device con­text, to cat­a­logue and cat­e­gorise asset risk is a huge, foun­da­tion­al part of secu­ri­ty. If you can’t iden­ti­fy and quan­ti­fy risk and see where the gaps are in your envi­ron­ment, it’s sim­ply a mat­ter of time until you are breached and feel the full force of a severe cyber­at­tack.

For more infor­ma­tion, vis­it armis.com

Pro­mot­ed by Armis