These first two aspects of using data to positively impact operations is what we are all familiar with and use in some way, shape, or form; however, what IIoT envisions is not just an increase in the data collection and analysis at the first two stages, but integrating the process data with the enterprise data to make really interesting decisions that so far have not been made before.
Consider a company enjoying a market explosion. The assembly line can be programmed to manufacture higher volumes of the product, or completely bypass sub-assemblies adding features not valued by the market. Now, combine both the operating and financial data to provide more insight to the CFO. The agility of the company and its ability to pivot, change, and continue to grow can be exponential. Indeed, it is an attractive proposition, and many are eager to move forward, quickly. So quickly that security has not been keeping up with the new IIoT systems.
INDUSTRIAL IOT EXPOSES SYSTEM VULNERABILITIES
There are a few ways that IIoT systems are vulnerable to attacks. Among the two most prominent are cloud storage and network architecture.
Putting data on the cloud (public or private) is an integral component of the IIoT. But, this comes with huge security implications. Traditionally, industrial control system (ICS) vendors have maintained that their systems have a built-in air gap. This is no longer true when these systems have a direct or indirect connection to the Internet. IIoT is going to drive the understanding that ICSs need to have embedded authentication and security features.
Let’s look next at the network architecture that enables the IIoT. Fig. 3 provides a top-level view of how the field devices in a factory or a manufacturing process are ultimately connected to the network.
There has always been the control network, a host of field sensors, actuators or servo drives (and other such devices) connected to PLCs or DCSs. Typically, this control network is a bunch of isolated networks. But increasingly, the control networks that manage different sections of a factory or process are connected together, creating the plant network.
A plant network lets supervisors see the entire plant operation and deduce how the different sections of a plant interact with each other. Information at this level allows for the optimization of the entire plant or an oil field operation. Ultimately, this plant network information is integrated with the enterprise/business network to enable the real promise of IIoT.
Each level of operation within the control network needs to have its security needs assessed—security is different at each level. If you start at the top, the domain of IT, what you have are secure switches and servers that are (hopefully) updated with the latest software and patches:
At the plant level, security is not up to date. However, IT still does have some control.
At the control network layer, the PLC architectures are decades old. Generally, updates are rare, and frequent patches cannot be applied to systems that are responsible for 100% factory uptime. Security is generally weak here.
At the field level, which is generally never discussed, security is virtually nonexistent. Field devices are open, trusted, and cannot really have any encryption implemented because interoperability is paramount. If we look at field slave devices, such as sensors and actuators, these systems have zero security features (for the most part) and work on protocols developed almost 30 years ago during the 1970s through the 1990s.