[Whitepaper] Integrating Security Into the IoT Strategy in the New Converged Environment

Consumers want their work, home and mobile devices to communicate together to provide information that was previously not available from isolated systems. This desire is at the root of the Internet of Things (IoT). The rise of IoT started when consumers began to interconnect devices — ranging from personal computers, smartphones, tablets and wearables, to home appliances and home security systems — via the cloud, so that valuable personal and work information could be easily accessed, no matter what the users were doing or where they might be located.

Similarly, commercial and industrial organizations want to gather information across sensors, devices and control systems, often in different locations, in order to provide more intelligence about the operational status of the overall manufacturing process and to make better decisions about operations and maintenance. Hence, the emergence of the Industrial Internet of Things (IIoT), which by definition is an extension of IoT for industrial applications, such as plant floor control and maintenance.

IIoT is one of the fastest-growing innovation sectors across all segments (consumer and commercial) of the IoT market. Most of this growth has been due to significant developments in IoT, networking and big data analytics technologies that improve productivity and efficiency in the operational environment. In the operational environment, IIoT devices generally are network-ready sensors, controllers, actuators, drives and operator displays providing a stream of data, often to the cloud, for big data analytics. However, IIoT devices have not caught up with the security needs in this highly networked, interconnected world.

This paper is aimed at providing guidance to help organizations, IoT and IIoT solution providers, and the industry at large to better understand this new converged environment. It is also intended to improve the planning, designing, implementing and deployment of IoT devices, while ensuring that security is integrated into the IoT strategy across all levels of the organization.

In the mid-1990s, organizations began interconnecting their control systems to improve productivity, maintenance and safety. Some of this interconnectivity was to the internet via sensors, endpoint devices, human-machine interfaces (HMIs), and programmable logic controllers (PLC) or remote terminal units (RTU) connected to gateways — the precursors to IoT. While this interconnectivity helped improve reliability and efficiency, security was not a key consideration in the planning, design and implementation of networked control systems. The lack of adequate security planning resulted in increased attack surfaces and successful cyberattacks across many industries.