A New Kind of Security Risk Is Emerging. Take These 3 Steps to Protect Your Business.
SOURCE:Entrepreneur|BY:Chongwei Chen
As connected products blur the line between digital vulnerabilities and physical safety, manufacturers must make a fundamental paradigm shift.
Opinions expressed by Entrepreneur contributors are their own.
Key Takeaways
Vulnerabilities in connected products can lead to physical harm, not just data leaks. Security must be designed into products from the start.
Connected devices should process and store as little data as is required for them to perform their key functions. This ensures your business and your customers’ data are protected.
Attacks and accidents will happen despite your best efforts, so you must have a strategy in place that will help you bounce back after a disaster.
When it comes to making connected products, conversations about safety and security features have changed. Your ability to contain threats no longer depends on the corporate firewall. Everything is vulnerable to some degree, from your smart appliances to vehicles on the road and industrial machinery. The lines between data security and physical safety are also now blurred than they have ever been.
We live in an era of convergence. Traditionally, IT security systems had a focus on protecting data centers and enterprise networks. Operational Technology (OT) is different in that it works in the Industrial IOT (IIoT) landscape and works with the physical world, including machinery, environment and industry. When these two areas are combined, there is a more complex possibility for attacks, and the digital vulnerabilities can be catastrophic if not managed properly.
In other words, exposures of vulnerabilities are now longer just amounting to leaked data. There is a possibility of physical harm through harming systems, cars and pharmaceutical equipment.
Strategic phase 1: Securing the product lifestyle (design to decommission)
Security is no longer something that is just optional. It is something that you clearly need for the long- and short-term survival of your business. Security by design is something that is becoming especially important today. It involves moving around security testing towards the left as you complete your development pipelines.
Your aim must always be to remove any vulnerabilities before a single prototype is built. This will be much better and more beneficial than discovering a problem during the final pre-production penetration test.
You must always aim to thoroughly check all supply chain weak links. All aftermarket parts, including chipsets, sensor modules and open source OS layers, can introduce their own weaknesses. For this reason, a very thorough post-introduction checking process is needed, which includes software bill of materials (SBOM) creation and verification of component security standards being met.
We are living in a world where there are connected and interlinked product systems. As a result, maintaining close control over your cloud gateway cannot always ensure that data is properly managed and safe. Companies should always aim to implement control at a device level of at the edge.
Intelligence should be collected and scrutinized locally through what is termed a decentralized data strategy. This will save time, bandwidth and ensure that the sensitive data that is being processed can be done as efficiently as possible.
Being a digital minimalist these days makes life less stressful and far easier. Devices should always be intended to store and process as little data as is required for them to perform their key functions. Digital minimalism ensures that your customers’ data is always protected, and it will also protect your business. Staff will find it far easier to maintain critical systems, and key stakeholders and customers will be impressed by how you conduct your operations.
Proper authorization is a key element of edge governance. You should try and always ensure that machine-to-machine identity management is used. This allows all devices and gateways to have a strong identity. It will allow you to protect yourself and ensure that any device that is lost, stolen or compromised can be quickly removed from the network without any critical data being lost. It will thus not be a target for further compromise or criminal activity.
Strategic phase 3: Operational resilience and response
Despite our best efforts in almost anything, be it software or car development, accidents will happen. We should not only aim to become good at preventing attacks but also aim to become effective when it comes to bouncing back after a disaster.
A system must be put in place whereby any device that is compromised or problematic can be quickly removed from the system without causing downtime and compromising other linked devices.
When an accident happens, forensics and recovery in OT environments are of paramount importance. Strategies to ensure quick recovery should include having remote log retrieval capability and thorough auditing ability, which can survive a reboot.
These days, having a plan in place for disasters is not only optional but also something that is included in regulatory scrutiny. Frameworks like the UN R155 in automotive cybersecurity and the growing FDA guidance for medical purposes mean that continuously developing security is needed in terms of market access. They will often scrutinize for signs of secure development lifecycles, transparent data processing and business plans.
There is a need for a fundamental paradigm shift. For any entrepreneur in the manufacturing industry, device-level data safety and cybersecurity need to be recognized as being extremely vital to the smooth running of business operations. Investing in these things ensures that you can build customer trust and develop long-term business potential.
Key Takeaways
Vulnerabilities in connected products can lead to physical harm, not just data leaks. Security must be designed into products from the start.
Connected devices should process and store as little data as is required for them to perform their key functions. This ensures your business and your customers’ data are protected.
Attacks and accidents will happen despite your best efforts, so you must have a strategy in place that will help you bounce back after a disaster.
When it comes to making connected products, conversations about safety and security features have changed. Your ability to contain threats no longer depends on the corporate firewall. Everything is vulnerable to some degree, from your smart appliances to vehicles on the road and industrial machinery. The lines between data security and physical safety are also now blurred than they have ever been.
We live in an era of convergence. Traditionally, IT security systems had a focus on protecting data centers and enterprise networks. Operational Technology (OT) is different in that it works in the Industrial IOT (IIoT) landscape and works with the physical world, including machinery, environment and industry. When these two areas are combined, there is a more complex possibility for attacks, and the digital vulnerabilities can be catastrophic if not managed properly.