It is this diversity of form, function and technology, and the proliferation of multiple standards or protocols that has limited the ability of IT and security teams to integrate the security of IoT technologies into the enterprise.

According to Amit Bareket, VP for Secure Service Edge at Check Point Software Technologies, the challenge lies in the transformation of corporate networks due to mobility and cloud computing. He explained that this shift has redefined the Internet as the new corporate network.

“Employees accessing cloud resources from outside the office necessitates opening up corporate resources to the internet, introducing significant security risks,” he added. “Traditional network security measures are often inadequate in this new landscape.

“There's a pressing need to rethink security strategies to effectively mitigate various cyber threats, as evidenced by recent high-profile attacks like the oil pipeline incident in the United States. This shift will undoubtedly remain a top priority for every CIO and CISO over the next five years.”

Amit Bareket

Securing OT is not that easy

Bareket commented that part of the security challenge lies in the sheer number of devices that need to be connected to the network. Finding all the devices remains a challenge, he opined.

Reflecting on the transitions many organisations had to undergo during the COVID-19 pandemic, he pointed out that the rapid transformation caught many off guard. He cited the global shutdowns that occurred during the pandemic.

“Suddenly, businesses that never envisioned remote operations have to thrust themselves into a new reality where remote work became the norm almost overnight,” he commented. “This abrupt shift left CIOs and CISOs grappling with uncertainty: Would we revert to the old ways, or was this the new normal? It became increasingly clear that remote work was here to stay, challenging our preconceptions about the pace of change.”

He added that what was initially projected to take 5—10 years unfolded within a single year. “I think today we stand in a strong position with robust solutions to meet the demands of this new landscape,” he continued.

SASE to the rescue

Secure Access Service Edge (SASE) is the convergence of connectivity and security helping organizations to achieve a consistent security posture by implementing a decentralised concept where security is provided directly at the source, with the management of all involved components done in the cloud. Bereket says SASE is just a secure network over the internet. SASE is a secure network infrastructure over the internet, encompassing various components such as users, cloud resources, and IoT devices.

Unlike traditional endpoints, IoT devices cannot typically accommodate agent or app installations, necessitating a network-level approach to security. He used Check Point's integration with SD-WAN devices and gateways as an example claiming it facilitates the creation of a unified network under the SASE platform.

“This integration provides visibility into IoT devices and enables security enforcement at the network level. Check Point's IoT security features, including device discovery and policy enforcement, play a crucial role in securing these devices within the SASE framework,” he continued.

SASE promises to bring IoT into the security framework of the organisation.

Asked whether IT leaders have heard the SASE story and are incorporating the technology into the overall network architecture he opined it has already happened.

“It’s evident that the internet is now the new corporate network. It is here to stay,” he started. He recalled a recent conversation with a major bank: “It was clear that they recognise this shift and understand that embracing solutions like SASE is inevitable,” he revealed.

“The pace of digital evolution will only accelerate, with forecasts from Gartner projecting a 30% year-over-year growth in the market for the next three years. By 2027, this market is expected to reach US$25 to US$28 billion from US$9 billion in 2024, further emphasising the significance of this shift in networking and security paradigms,” he concluded.

Click on the PodChat player and listen to Bareket elaborate on the intersection of IoT and SASE in OT security.

1. What are the top challenges faced in OT security in 2024?
2. What are the key components of OT security?
3. For a long time, the security of operational technology has been kept out of the IT portfolio. Given the recent rise in attacks against critical and industrial systems, do you see a convergence of IT and OT security and who will lead the charge?
4. How does IoT fit into SASE (and vice versa)?

The post PodChats for FutureIOT: The intersection of IoT and SASE in OT security appeared first on FutureIoT.

A recent Kaspersky study found that AI and IoT are already used by 61% and 64% of companies respectively, while 28% and 26% of companies plans to adopt them within two years. Data spaces are used by 27% of businesses, with more than half (54%) intending to adopt them soon.

Other interconnected technologies (digital twins, AR, VR, web 3.0, 6G), are used by 8-20% of companies participating in the survey, but more than 70% are considering integrating them into their business processes soon.

The expanding use of AI and IoT has the potential to expose organisations to new vulnerabilities. According to the research, 13-14% of organisations from the region think AI and IoT are ‘very difficult’ or ‘extremely difficult’ to protect, while only 6% of the AI users and 10% of the IoT owners believe their companies are fully protected.

According to Adrian Hia, managing director for Asia Pacific at Kaspersky, “Undoubtedly, new technological tools play a vital role in improving the efficiencies and productivity of enterprises in the region. However, there are loopholes, particularly in cybersecurity, that need to be addressed. Our recent study showed more than half of the companies are using AI and IoT in their organisations, but 21% of them think AI and IoT are somewhat difficult to protect. It shows that there is a skills and knowledge gap that needs to be patched with urgency.”

Recommendations going forward

Given the scale of change that interconnected technologies is likely to bring, organisations must develop a strategy to implement and protect them. Kaspersky recommends four effective ways to ensure organisations are prepared to protect interconnected technologies:

Adopt secure-by-design principles. By integrating cybersecurity into each stage of the software development lifecycle, secure-by-design software and hardware become resilient against cyberattacks, contributing to the overall security of digital systems. Cyber Immune solutions based on KasperskyOS, for instance, allow companies to minimize the threat surface and significantly decrease the ability of cybercriminals to perform a successful attack.

Train and upskill your workforce. Building a cyber-aware culture requires a comprehensive strategy that empowers employees to gain knowledge and put it into practice. With Kaspersky Expert training, InfoSec professionals can advance their skills and defend their companies against attacks.

Upgrade your cybersecurity solutions and use centralized and automated platforms such as Kaspersky Extended Detection and Response (XDR). As companies adopt interconnected technologies, they need cybersecurity solutions with more advanced features, enabling them to collect and correlate telemetry from multiple sources and provide effective threat detection and rapid automated response. 

As many AI solutions are built on containers, it’s important to secure the infrastructure they are integrated in with cybersecurity products – such as Kaspersky Container Security – that allows companies to detect security issues at every stage of the app lifecycle, from development to operation.

Meet regulations to avoid legal problems or reputational damage, by ensuring your cybersecurity practice meets changing standards and legal requirements.

The post AI and IoT are opening new vectors of cyberattack appeared first on FutureIoT.

Church & Dwight (C&W), the company behind the brand Arm & Hammer, plans to strengthen the consumer goods company’s cybersecurity program. The goal was to gain a deeper understanding of its manufacturing risk profile by identifying critical assets, vulnerabilities, and security gaps.

It has chosen Rockwell to help build resiliency and minimise risks in its operational technology (OT) manufacturing security practices. The two collaborated to develop a remediation roadmap, new security policies, and other measures to minimize risks.

With several global consumer brands under its umbrella, C&W recognised the critical impact and importance of a strong OT security posture and enlisted Rockwell.

“We selected Rockwell Automation because we were looking for a new partner to help us uplevel our OT and manufacturing security posture. We knew we needed the best of the best who understood our vision,” said David Ortiz, chief information security officer (CISO) at Church & Dwight. “Throughout our work with Rockwell Automation on our OT cybersecurity program, we’ve gained a thorough understanding of our cybersecurity landscape and the tools needed.”

Commenting on the collaboration, Mark Cristiano, global commercial director at Rockwell, says: “We have implemented new security controls and processes and have already seen a dramatic shift in the company's OT practices. We are proud to leverage our best-in-class partnerships to help Church & Dwight achieve its cybersecurity goals.”

As a longtime Rockwell Industrial Solutions customer, C&W expanded its partnership in 2020 to advance their Manufacturing Cybersecurity Program initiative. Since then, Church & Dwight has achieved its cybersecurity objectives in mitigating risks and understanding its OT landscape.

Once threat detection capabilities were in place, Church & Dwight implemented continuous monitoring through managed OT services from Rockwell.

These managed services integrate and support Church & Dwight’s current IT Security Operations Centre, bridging the gap between IT and OT networks, and mitigating cyber risks across the enterprise.

The post Leader Church & Dwight uplevels OT and manufacturing security posture appeared first on FutureIoT.

Consumer goods company, Church & Dwight recognized the critical impact and importance of a strong OT security posture and enlisted Rockwell. The goal was to gain a deeper understanding of its manufacturing risk profile by identifying critical assets, vulnerabilities and security gaps.

To strengthen the company’s cybersecurity program, Church & Dwight has chosen Rockwell Automation to help build resiliency and minimize risks in its operational technology (OT) manufacturing security practices.

“We selected Rockwell Automation because we were looking for a new partner to help us uplevel our OT and manufacturing security posture. We knew we needed the best of the best who understood our vision,” said David Ortiz, Church & Dwight CISO.

Rockwell’s global commercial director, Mark Cristiano, says: "Over the course of our partnership with Church & Dwight, we have implemented new security controls and processes and have already seen a dramatic shift in the company's OT practices. We are proud to leverage our best-in-class partnerships to help Church & Dwight achieve its cybersecurity goals.”

The post Church & Dwight to Increase manufacturing cybersecurity resilience appeared first on FutureIoT.

Enterprises continue to embrace IoT strategies to streamline operations, boost efficiency, and improve customer experiences. From hospitals to manufacturers to public sector agencies, IoT device fleets are critical for meeting these modernization goals.

However, the acceleration in connected device deployment opens new windows for cybercriminals and exposes networks to potential breaches.

Kenan Frager, VP of Marketing at Asimily, warns that vulnerable IoT devices continue to be a glaring cybersecurity weak spot for many enterprises. He opines that businesses are lured by the benefits the devices offer but do not take the necessary effort to check if such technologies are sufficiently secure.

“Regardless of industry, an attack on IoT infrastructure can and will result in operational downtime, loss of IP, loss of revenue, and reputational harm.”

Kenan Frager

He notes that regulatory compliance adds another layer of pressure, with steep fines and sanctions looming for breaches that affect HIPAA, PCI DSS, NIST, SOC 2, and other increasingly stringent mandates.

Report findings

Breach tactics continue evolving: Cybercriminals seeking confidential proprietary data to sell for financial gain look for and infiltrate vulnerable and often-unsecured IoT devices to establish initial access to an enterprise’s network.

That tactic supports ransomware attacks as well, with criminals gaining access via IoT endpoints, encrypting data, and extorting ransoms. In other cases, nation-state-sponsored groups are motivated to shut down or disrupt the services of their targets.

A common tactic is harvesting vast fleets of vulnerable IoT devices to create botnets and utilize them to conduct DDoS attacks. Attackers also know they can rely on unresolved legacy vulnerabilities, as 34 of the 39 most-used IoT exploits have been present in devices for at least three years.

Routers are the most targeted IoT devices, accounting for 75% of all IoT infections. Hackers exploit routers as a stepping stone to access other connected devices within a network. Security cameras and IP cameras are the second most targeted devices, making up 15% of all attacks.

Other commonly targeted devices include digital signage, media players, digital video recorders, printers, and smart lighting. The Asimily report, IoT Device Security in 2024: The High Cost of Doing Nothing also highlights the especially consequential risks associated with specialised industry equipment, including devices critical to patient care in healthcare (including blood glucose monitors and pacemakers), real-time monitoring devices in manufacturing, and water quality sensors in municipalities.

Cyber insurers are capping payouts. Cybersecurity insurance is becoming more expensive and difficult to obtain as cyberattacks become more common. More insurers are now requiring businesses to have strong IoT security and risk management in place to qualify for coverage—and increasingly denying or capping coverage for those that do not meet certain thresholds.

Among the reasons why cyber insurers deny coverage, a lack of security protocols is the most common, at 43%. Not following compliance procedures accounts for 33% of coverage denials. Even if insured, though, reputational damage remains a risk: 80% of a business’s customers will defect if they do not believe their data is secure.

Manufacturing is now the top target: Cybercriminals are increasingly focusing their attention on the manufacturing, finance, and energy industries. Retail, education, healthcare, and government organizations remain popular targets, while media and transportation have been de-emphasized over the past couple of years.

“There’s a clear and urgent need for more businesses to prioritise a more thorough risk management strategy capable of handling the unique challenges of the IoT,” said Shankar Somasundaram, CEO, Asimily.

“While organisations often struggle with the sheer volume of vulnerabilities in their IoT device fleets, crafting effective risk KPIs and deploying tools to gain visibility into device behaviour empowers them to prioritise and apply targeted fixes.”

Shankar Somasundaram

He added that this approach, coupled with a deeper understanding of attacker behaviour, enables teams to distinguish between immediate threats, manageable risks, and non-existent dangers.

“The right strategy equips organizations to focus efforts where they matter most, maximising their resources while ensuring the security of their IoT ecosystem at scale,” he concluded.

The post Rising risks from accelerated use of unchecked IoT in enterprise appeared first on FutureIoT.

In the report, 2023 Strategic Roadmap For Digital Workplace Infrastructure and IT Operations (I&O), the analyst suggested that a successful digital workplace strategy strikes a cost-effective balance between hardware, employee support and cybersecurity while focusing on improving the digital employee experience.

Key findings of the report

Digital employee experience (DEX) is a major component of overall employee experience. This necessitates a greater focus on continually measuring and improving employee sentiment, technology adoption and solution performance.

Gartner posits that many digital workplace leaders are increasing investments in endpoint analytics and self-healing.

Traditional, siloed operating models are prone to gaps in DEX and are ill-equipped to support increased cybersecurity and operational demands, yet many organisations fail to adjust their structure.

Over 80% of digital workplace leaders have increased prioritisation on environmental sustainability. Success requires modern operations, selecting sustainable vendors, adopting new tooling and developing comprehensive reporting.

Gartner says I&O plays a crucial role in enabling and supporting the digital workplace and must improve its business acumen and ability to:

• Adapt to ever-evolving employee, HR and line-of-business demands
• Upskill team members
• Evolve operating models
• Keep pace with and prepare for the future
• Free up resources to focus on employee enablement
• Improve DEX
• Eliminate technical debt

The post What the digital workplace will look like in 2024 appeared first on FutureIoT.

Juniper Research predicts that enterprises’ increasing use of cellular networks, including for smart manufacturing and autonomous vehicles, will necessitate further investment into AI that automates key network processes.

These use cases require various degrees of high throughput, low latency and geographical coverage. Therefore, to maximise networks’ efficiency and reduce operational expenditure, the report urged operators to accelerate the incorporation of AI into core networks.

AI Investment critical for network performance & security

The report found that, as operators expand established 5G networks and build future 6G networks, AI must play an essential role. It identified performance optimisation and network security as the most important use cases; accounting for over 50% of global operator spend on AI by 2028.

Additionally, the ever-increasing virtualisation of network functions and demand for cellular data will drive operators to implement AI to decrease operational costs. It predicted that the ability to automate real-time network analysis and adjust network conditions accordingly will be crucial to minimising the costs associated with network management and service provision.

Research author Frederick Savage commented: “As operators compete on the quality of their networks, AI will be essential to maximising the value of using a cellular network for connectivity. High-spending users will gravitate to those networks that can provide the best service conditions.”

The post AI Investment critical for network performance and security appeared first on FutureIoT.

The latest Nozomi Networks Labs OT & IoT Security Report revealed that “network scans” topped the list of network anomalies and attack alerts, followed closely by “TCP flood” attacks which involve sending large amounts of traffic to systems aiming to cause damage by bringing those systems down or making them inaccessible.

“TCP flood” and “anomalous packets” alert types exhibited significant increases in both total alerts and averages per customer in the last six months, increasing more than 2x and 6x respectively. 

"These trends should serve as a warning that attackers are adopting more sophisticated methods to directly target critical infrastructure, and could be indicative of rising global hostilities,” said Chris Grove, director of cybersecurity strategy at Nozomi Networks.

He posited that the significant uptick in anomalies could mean that the threat actors are getting past the first line of defence while penetrating deeper than many would have initially believed, which would require a high level of sophistication. “The defenders have gotten better at protecting against the basics, but these alerts tell us that the attackers are quickly evolving to bypass them,” he added.

Alerts on access control and authorization threats jumped 123% over the previous reporting period. In this category “multiple unsuccessful logins” and “brute force attack” alerts increased 71% and 14% respectively.

This trend highlights the continued challenges in unauthorized access attempts, showing that identity and access management in OT and other challenges associated with user passwords persist.

The top critical threat activity seen in real-world environments over the last six months:

1.            Network Anomalies and Attacks – 38% of all alerts

2.            Authentication and Password Issues – 19% of all alerts

3.            Access Control and Authorization Problems – 10% of all alerts

4.            Operational Technology (OT) Specific Threats – 7% of all alerts

5.            Suspicious or Unexpected Network Behaviour – 6% of all alerts

ICS vulnerabilities

With this spike in network anomalies top of mind, Nozomi Networks Labs has detailed the industries that should be on highest alert, based on analysis of all ICS security advisories released by CISA over the past six months.

Manufacturing topped the list with the number of Common Vulnerabilities and Exposures (CVEs) in that sector rising to 621, an alarming 230% increase over the previous reporting period. Manufacturing, energy and water/wastewater remained the most vulnerable industries for a

third consecutive reporting period – though the total number of vulnerabilities reported in the

The energy sector dropped 46% and Water/Wastewater vulnerabilities dropped 16%. Commercial Facilities and Communications moved into the top five, replacing Food & Agriculture and Chemicals (which both dropped out of the top 10).

Healthcare & Public Health, Government Facilities, Transportation Systems and Emergency Services all made the top 10.

In the second half of 2023:

• CISA released 196 new ICS advisories covering 885 Common Vulnerabilities and Exposures (CVEs) – up 38% over the previous six-month period
• 74 vendors were impacted – up 19%
• Out-of-Bounds Read and Out-of-Bounds Write vulnerabilities remained in the top CWEs for the second consecutive reporting period – both are susceptible to several different attacks including buffer overflow attacks

Data from IoT Honeypots

Findings reveal that malicious IoT botnets remain active this year, and botnets continue to use default credentials in attempts to access IoT devices. From July through December 2023, it was revealed that:

• An average of 712 unique attacks daily (a 12% decline in the daily average compared to the previous reporting period) – the highest attack day hit 1,860 on October 6.
• Top attacker IP addresses were associated with China, the United States, South Korea, India and Brazil.
• Brute-force attempts remain a popular technique to gain system access – default credentials remain one of the main ways threat actors gain access to IoT. Remote Code Execution (RCE) also remains a popular technique – frequently used in targeted attacks, as well as in the propagation of various types of malicious software.

The post Beware of network anomalies and attacks appeared first on FutureIoT.

“We are not only making 5G networks smarter, simpler, and more secure for our customers’ IT departments. We are also allowing our customers’ security organisations to take control over how their employees leverage generative AI tools, protecting them from misuse that could lead to a damaging data leak or a malware infection,” said Donna Johnson, CMO at Cradlepoint.

AI capabilities include:

NetCloud AIOps Dashboard – Simplifies the ongoing operations of enterprise networks leveraging 5G SASE capabilities. The NetCloud AI model aggregates learning into a single dashboard that identifies areas of performance degradation, isolates the cause of the issue, and pinpoints the affected sites, users, and applications. With a unique focus on cellular networking, NetCloud AIOps will turn cellular signal quality indicators, such as proximity to cell tower, signal quality, and signal strength into actionable insights to enhance performance.  

AI-based NetCloud Assistant (“ANA”) – Uses natural language processing to assist NetCloud users with everyday queries about the operation of their network. From providing recommendations on cellular endpoints for specific use cases, to effectively troubleshooting network performance issues, ANA will be an invaluable assistant to simplify day-to-day operations.

Network Traffic Analysis – Provides centralised flow-level visibility for traffic analysis and forensics. This service will evolve later this year to leverage AI to establish a baseline of normal traffic patterns for the most common 5G use cases (distributed IoT, vehicles, sites) and flag any anomalies indicating the signs of a breach. 

GenAI Data Loss Prevention – With 79% of organisations reporting generative AI adoption without established policies, this solution applies access policies to block confidential data, personally identifiable information, or other sensitive data from being submitted to the generative AI site which can be potentially exposed in future responses. Ericom’s remote browser isolation technology also protects against weaponised responses infecting employee assets.   

“As a provider of turn-key car wash solutions, our customer success model requires highly reliable and efficient car wash operations,” said Ian Beason, director of Technology and Innovation at Motor City Wash Works.

He added that Cradlepoint’s new AIOps capabilities will allow our lean IT team to scale with our growing customer base and manage our network more effectively while providing an enhanced level of service to our customers.

The post Cradlepoint AI functionality advances 5G for business appeared first on FutureIoT.

“Cybersecurity is just one component of cyber resilience, but, unfortunately, many enterprises fail to understand the subtle difference,” said Kumar Avijit, practice director of Information Technology Services at Everest Group. He opined that while most C-suite executives concentrate on preventive controls and response, equal importance needs to be allocated to the recovery, revamp, and reinforcement stages of cyber resilience.

“For any business, having a comprehensive cyber resilience strategy is critical in safeguarding long-term viability and success,” he added.

The “5 Rs of cyber resilience”

Ready – High: C-suite is extensively focusing on pre-emptive measures to secure itself from cyberattacks and are investing in cutting-edge technologies.

Respond – High: There is rapid adoption of extended detection and response (XDR) tools in the market, and service providers too are now focusing on automated incident response to cut down on the standard metric of Mean Time to Resolution (MTTR).

Recover – Medium: There is very little focus on the recovery aspect from the C-suite, underpinned by the challenges of data fragmentation, infected backups, and meeting Recovery Time Objective (RTO) that are visible across the C-suite.

Reinforce – Low: The C-suite is not focused on learning from cyberattacks on peer organisations and building defences accordingly. In most cases, the C-suite lacks a comprehensive vision of security and instead remains reactive.

Revamp – Low: The C-suite is not acting agile enough to focus on the next-generation technology and thinking a step beyond on how to secure itself from the new attack vectors that the new shine tech brings.

Selected highlights

• Projections suggest the cybersecurity services market, currently valued at $US 70-73 billion, will surpass the $100 billion mark in 2025, exhibiting a CAGR of 16-18% between 2021 and 2025.
• Identity and access management (IAM), cloud security, and application security form the largest segments of the cybersecurity market, collectively representing 56% of the overall market.
• Cybersecurity consulting services are experiencing rapid growth, with a current market share of 25%. This is closely followed by design and implementation at 29% and managed security services leading at 46%.
• North America remains the largest market (40%) followed by Europe (33%) and Asia (21%).
• 63% of enterprises have mentioned lack of skills/talent as among their top three biggest challenges when it comes to cybersecurity.

The post C-suite must discern between cybersecurity and cyber resilience appeared first on FutureIoT.

ABI Research forecasts that by 2026, the installed base of connected devices will reach more than 70 billion installations, creating an expansive IoT attack vector in the IoT environment.

Most of these devices are low-power, storage limited, and with weak computational power, which means these devices are increasingly connecting to the cloud environment for centralized storage, data analytics, real-time monitoring, remote access, and updates in firmware and software.

Connecting to the cloud environment creates yet another compromise vector for these devices.  An effective IoT device-to-cloud security strategy should target security in three vital areas: device, network, and cloud.

“Device security often means securing the chipset and the data stored inside the device from being breached. Network security securely transfers data between the IoT device and the cloud. Cloud security allows the data to avoid intrusion while sitting in the cloud,” says Michael Amiri, senior industrial and IoT cybersecurity analyst at ABI Research.

In addition to embedded security in device design and cloud provider security offerings, end-users need to ensure the implementation of robust authentication practices, especially given the nature of remote access and remote work regarding the IoT environment.

Growth opportunities in network security

In such an environment, Amiri explains, “Security vendors need to include cloud security solutions at the forefront of their marketing strategies. Emphasising cloud solutions is fundamental in a market where IoT devices increasingly rely on the cloud for storage, data handling, computation, remote management, and updates.”

IoT security technology is already experiencing a surge in demand, which will probably accelerate if new regulations for IoT and cloud connections are passed. A case in point is a recent Software Bill of Materials (SBOMs) mandate for medical device manufacturers in the U.S. ABI Research spoke to SBOM service providers, and they unanimously believe regulation has been a significant driver for their services.

“An explosive increase in IoT connections and devices is evident in the next three to four years. North America and the Asia region show the highest level of growth, followed by Western Europe. These will be the largest markets for IoT and cloud security solutions. Traditional markets for IoT security solutions have been the consumer, financial, enterprise, and government verticals. Yet automobile, healthcare, and manufacturing have seen a strong push for IoT security,” Amiri concludes. 

The post Laying the groundwork for secure IoT appeared first on FutureIoT.

Nozomi Networks and NetWitness are partnering to deliver what they claim is unified security and visibility across OT and IT solutions. Integrating operational technology (OT) data greatly improves the effectiveness of the security operations centre (SOC).

“A key differentiator for NetWitness is its radical visibility into an organisation’s data, no matter what type – logs, network, or endpoints -- or where it resides – on-premises, in the cloud, or hybrid,” said

From a security perspective, Tod Ewasko, chief product officer for NetWitness, says integrating critical OT and IoT data into the threat detection, investigation, and response functions increases the effectiveness of the SOC and protects an increasingly important avenue for attacks.

The post Advancing OT security with smart IoT appeared first on FutureIoT.

As a result, cyberattacks targeting manufacturing sites in industries such as semiconductors and automobiles have increased, leading to production disruptions and highlighting the growing need for more robust security measures in factories.

Mitsubishi Electric and TXOne Networks have signed a long-term cooperation agreement covering technology development and marketing, aiming at expanding the operational-technology (OT) security businesses of both companies.

The collaboration aims to create innovative new value in OT security by combining Mitsubishi Electric's assessment, maintenance and operation services as well as control equipment and systems with TXOne's OT security products.

The new OT security solutions are expected to improve manufacturing productivity, efficiency and safety as well as security levels throughout the supply chains of various industries.

"We look forward to creating new value in OT security by combining OT technology and expertise for manufacturing, infrastructure and building automation with security technology for information systems," said Kunihiko Kaga, Mitsubishi Electric's representative executive officer and industry and mobility business area owner.

"With the continued evolution of DX and the increasing sophistication and complexity of cyberattacks, OT security measures must extend from the information communication layer to the control communication layer and deeper into the network layer.” Kunihiko Kaga

“We are confident that our synergy with TXOne's OT network segmentation and defence technologies will enable us to contribute to greater safety and security in OT environments and the world beyond," he continued.

Dr. Terence Liu, CEO of TXOne Networks, concurs adding that the collaboration between Mitsubishi Electric and TXOne Networks creates a unique value with our deep-rooted expertise in both IT and OT, forming comprehensive and holistic security services to safeguard manufacturing assets against the ever-evolving cyber risks at once."

The post Cooperation to expand security solutions for OT and ICS appeared first on FutureIoT.

However, these devices often lack proper security controls and are insufficiently tested for vulnerabilities. Sophisticated cyber adversaries increasingly attempt to exploit these devices, as evidenced by a growing number of CISA ICS advisories identifying significant threats to many life- and safety-critical devices.

The EMB3D Threat Model, a collaborative effort by MITRE, Red Balloon Security, and Narf Industries, provides a common understanding of the threats posed to embedded devices and the security mechanisms required to mitigate them.

“Together, we are committed to enhancing the cyber posture of critical infrastructure sectors that rely on Operational Technology (OT) technologies. This collaboration exemplifies the power of collective expertise and underscores MITRE's dedication to advancing the resilience and security of vital systems in today's interconnected world.”

What is EMB3D

EMB3D aligns with and expands on several existing models, including Common Weakness Enumeration, MITRE ATT&CK, and Common Vulnerabilities and Exposures, but with a specific embedded device focus.

It provides a cultivated knowledge base of cyber threats to devices, including those observed in the field environment or demonstrated through proofs-of-concept and/or theoretic research. These threats are mapped to device properties to help users develop and tailor accurate threat models for specific embedded devices.

For each threat, suggested mitigations are exclusively focused on technical mechanisms that device vendors should implement to protect against the given threat with the goal of building security into the device.

EMB3D is intended to offer a comprehensive framework for the entire security ecosystem—device vendors, manufacturers, asset owners, security researchers, and testing organisations.

“Utilities have been forced to extreme measures to secure our infrastructures because of concerns about ICS device insecurities,” says Niyo Pearson of ONEGas.

“The EMB3D model will provide a means for ICS device manufacturers to understand the evolving threat landscape and potential available mitigations earlier in the design cycle, resulting in more inherently secure devices. This will eliminate or reduce the need to ‘bolt on’ security after the fact, resulting in more secure infrastructure and reduced security costs.”

EMB3D is intended to be a living framework, where new threats and mitigations are added and updated over time as new threat actors emerge and security researchers discover new categories of vulnerabilities, threats, and security defences.

Anticipated to be released in early 2024, EMB3D will be a public community resource, where all information is openly available, and the security community can submit additions and revisions.

“We encourage device vendors, asset owners, researchers, and academia to review the threat model and share feedback, ensuring our collective efforts remain at the forefront of safeguarding our interconnected world,” said Yosry Barsoum, vice president and director, Centre for Securing the Homeland at MITRE.

“Insights, expertise, and a collaborative spirit are invaluable as we work together to strengthen the resilience of our digital infrastructure. Together, we can build a safer and more secure future.”

The post EMB3D – a threat model for critical infrastructure embedded devices appeared first on FutureIoT.

From ensuring secure financial transactions to enhancing border control and streamlining retail interactions, advanced biometrics' ability to provide robust security while improving user experience marks a new era in sectors such as financial services, government & law enforcement, retail, automotive, healthcare, and consumer goods, says GlobalData.

Saurabh Daga, associate project manager of disruptive tech at GlobalData, comments: “Biometric technologies are transforming various sectors by uniquely identifying individuals through traits like fingerprints, voice, and facial patterns. The integration of AI and machine learning has boosted their accuracy and ability to detect fraud, especially in finance and healthcare. As privacy regulations evolve, the providers and implementors of biometric technologies are also adapting upgraded secure and ethical data practices. This blend of innovation and security is positioning biometrics as a key ingredient in future technology solutions, balancing user experience with individual rights.”

GlobalData’s “Advanced biometrics: emerging trends and technologies in authentication” report delves into over 60 real-life implementations of biometric technologies. The report categorizes these implementations based on the end-use sectors and applications.

Daga says “Advanced biometrics are likely to be a game-changer for a multitude of industries. Their ability to enhance security, streamline processes, and offer personalized experiences is reshaping the way businesses and governments operate.”

“By harnessing the power of advanced biometrics in combination with technologies such as AI, blockchain, and IoT, industries can unlock new levels of security and convenience, ultimately shaping a more secure and user-friendly future,” he concluded.

The post Biometrics will redefine security and UX appeared first on FutureIoT.

“Third-party cybersecurity risk management is often resource-intensive, overly process-oriented and has little to show for in terms of results,” said Zachary Smith, Sr principal research at Gartner. “Cybersecurity teams struggle to build resilience against third party-related disruptions and to influence third party-related business decisions.”

Effective TPCRM depends on delivery of three outcomes

Successful management of third-party cybersecurity risk depends on the security organisation’s ability to deliver three outcomes – resource efficiency, risk management resilience and influence on business decision-making. However, enterprises struggle to be effective in two out of those three outcomes, and only 6% of organisations are effective in all three (see Fig. 1).

Figure 1. Security organisations’ ability to deliver on three outcomes for effective TPCRM

Four actions to manage third-party cybersecurity risks

Based on the survey findings, Gartner identified four actions that security and risk management leaders must take to increase their effectiveness in managing third-party cybersecurity risk. The survey found that organisations that implemented any of these actions saw a 40-50% increase in TPCRM effectiveness.

These actions include:

Regularly review how effectively third-party risks are communicated to the business owner of the third-party relationship: Chief information security officers (CISOs) need to regularly review how well the business understands their messaging around third-party risks to ensure they are providing actionable insights around those risks.

Track third-party contract decisions to help manage risk acceptance by business owners: Business owners will often choose to engage with a third party even if they are well-informed about associated cybersecurity risks. Tracking decisions helps security teams align compensating controls for risk acceptances and alerts security teams to particularly risky business owners that may require greater cybersecurity oversight.

Conduct third-party incident response planning (e.g., playbooks, tabletop exercises): Effective TPCRM goes beyond identifying and reporting cybersecurity risks. CISOs must ensure the organisation has strong contingency plans in place to prepare for unexpected scenarios and to be able to recover well in the wake of an incident.

Work with critical third parties to mature their security risk management practices as necessary: In a hyperconnected environment, a critical third party’s risk is also an organisation’s risk. Partnering with critical third parties to improve their security risk management practices helps promote transparency and collaboration.

The post Gartner: 4 action items to reduce 3rd-party cybersecurity risks appeared first on FutureIoT.

In the report, Cybersecurity in Medical Devices, GlobalData forecasts the market for cybersecurity in medical devices to grow at a CAGR of 12.2% between 2022 and 2027, reaching US$1.1 billion.

Persistent challenges that must be addressed

There are several cybersecurity challenges in the medical devices industry, including legacy devices and outdated software. The vulnerabilities in medical devices pose significant risks, as they can compromise patient safety, privacy, and the overall integrity of healthcare systems.

Legacy devices are older medical devices that operate on outdated software, making them hard to update and ultimately vulnerable to cyberattacks. Additionally, a key piece of cybersecurity is training healthcare professionals who are using the tools that are at risk. Healthcare professionals should be able to recognize cyber threats so that action can be taken quickly, avoiding the potential detrimental outcomes of cyberattacks.

Alexandra Murdoch, senior medical analyst at GlobalData, comments: “The increasing number of digital health tools and the need for cybersecurity is important. However, as many digital health devices are interconnected, there is a larger attack surface, putting medical devices at higher risk of cyberattacks.” 

According to GlobalData, the growth is largely driven by the increasing connectivity and digital integration of medical devices, which makes them more susceptible for cyberattacks.

While cyberattacks are more likely with the adoption of digital health and connected devices, several strategies can be employed to mitigate said risks.

Murdoch explains: “Manufacturers should ensure that their devices are compatible with regular software updates and patching to address vulnerabilities. Additionally, implementing encryption and authentication mechanisms can safeguard data transmitted between devices, and using network segmentation to isolate medical devices from other critical systems can limit the potential impact of cyberattacks.”

As medical devices advance, addressing cybersecurity concerns is necessary to ensure patient safety and to maintain the integrity of healthcare systems. Collaboration, awareness, and the adoption of robust cybersecurity measures are essential components of a comprehensive strategy to mitigate risks.

Murdoch concludes: “By implementing these strategies, the medical device industry can work toward creating a more secure and resilient healthcare system.”

The post Legacy device and outdate software to slow medical device growth appeared first on FutureIoT.

Building on these findings, LambdaTest’s new research, Future of Quality Assurance 2023, has shown that companies are working to respond to the need for greater software reliability with 72% of organisations involving testers in “sprint” planning sessions, signalling a substantial shift towards software quality being considered earlier in the software development lifecycle.

The survey shows that there has been rapid adoption of AI technologies. Uses of AI reported by software testers have included automating the creation of test data (51%), writing code for automated tests (45%), test result analysis and reporting (36%), and formulating test cases (46%). Additionally, 89% of organisations are automating the deployment and running of tests through CI/CD (Continuous Integration and Continuous Delivery) tools.

Persistent gaps

The research has also highlighted that gaps continue to exist in software testing. Teams are spending 10% of their time on setting up and maintaining test environments and a further 8% of time is spent fixing flaky tests. 74% of teams lacked a structured prioritization system, potentially overlooking factors like risk levels and customer feedback when running automated tests.

Finally, many teams lack data-driven insights to measure software reliability – 29% lacked Test Intelligence infrastructure to provide insights on how automated tests are running and 12% lacked reporting systems.

Asad Khan, CEO and co-founder of LambdaTest, pointed out that the study highlights the need to address bottlenecks affecting productivity like brittle tests alongside the set-up and maintenance of test environments. “This presents us with an opportunity as well as a challenge – to develop and implement tools that will efficiently address these bottlenecks to keep driving software quality forward,” he continued.

Commenting on the study, Dr Ali noted that organisations are attempting to close the gap between the market’s expectations of software reliability and the current state. Artificial Intelligence has seen rapid adoption amongst software testers; however, efficiency challenges remain key to improving the cost, speed and effectiveness of software testing.

“Software testers and QA staff face great pressure in the software development lifecycle, whilst practices in the industry like engaging them earlier in the process is a step forward, new tools offer a significant opportunity to help close the gap.”

Dr Junade Ali

The post AI already adopted by 78% of software testers appeared first on FutureIoT.

The combined technology enables auditors to establish an accurate network architecture and cybersecurity posture baseline. This information can then be used to set up continuous monitoring that enables immediate response and adaptation to disruptions.

Network assessment automation is fundamental to cyber resiliency best practices, enabling security and audit teams to transition from point-in-time spot-checking to real-time verification.

“While performing regular reviews of compliance metrics is important, accessing that data and analysing it can be time-consuming, tedious, and limited depending on where you are looking,” said Robin Berthier, CEO of Network Perception. “As cybersecurity risks grow, reviews need to become more comprehensive and frequent and be managed in a way that will not overburden security and audit teams. Integrating technology with Claroty makes this critical assessment possible at a glance.”

According to Stephan Goldberg, VP of business development at Claroty the exponential growth of unmanaged OT and XIoT network assets has made critical infrastructure more vulnerable to external threats.

“Our integration with Network Perception empowers customers to quickly discover and protect their XIoT assets, detect and respond to the earliest indicators of threats, and seamlessly extend their existing enterprise security and risk infrastructure and programs to harden their industrial networks,” he continued.

The post Partnership to offer continuous OT cybersecurity threat detection appeared first on FutureIoT.

Gartner says SASE has emerged as a leading framework already influencing these enterprise buying decisions and forecasts that in 2026, 60% of new SD-WAN purchases will be part of a single-vendor SASE offering, up from 15% in 2022.

SASE vendor Netskope claims that its Borderless SD-WAN will transform how organisations manage their most critical networking and security functions and optimise enterprise branches everywhere.

“The era of the hyper-distributed enterprise - where workers can be anywhere and applications are everywhere - is causing organisations across the globe to transform their network and security strategies,” said Brandon Butler, IDC research manager for enterprise networks. “Key capabilities for next-generation architectures include deeply integrated networking and context-aware security, cloud-based management, and advanced automation enhanced by AI/ML.

Challenges by current branch infrastructure

• Rely on legacy SD-WAN and multiple disjointed network security technologies that were not built to extend performance to cloud-first, hybrid work environments;
• Can’t accommodate the explosion of cloud applications or IoT devices now in use throughout the enterprise;
• Struggle under collections of security point products and connectivity services that aren’t cleanly connected or integrated, but incur significant ongoing maintenance costs;
• Contribute to an overall status quo of inefficient, un-optimized branch infrastructure and inadequate security controls.

The Netskope answer

The new Netskope Next Gen SASE Branch, powered by Borderless SD-WAN, converges a unified SD-WAN and security appliance (the Netskope SASE Gateway) with a context-aware SASE Fabric, zero trust-based security, and a SkopeAI-powered cloud orchestrator. Available as a single, cloud-delivered offering, the solution also includes a thin branch that optimizes and secures traffic from all locations and users to cloud and on-prem locations.

“We’ve designed the Next Gen SASE Branch with the biggest needs of enterprise businesses in mind, both today and in the future,” said Parag Thakore, SVP, Borderless SD-WAN at Netskope. “Organisations no longer need to manage a complex stack of solutions to properly operate their enterprise, nor do they need to sacrifice performance for security. With Next Gen SASE Branch, they can take full advantage of a one-platform, one-software, one-policy approach that’s uniquely and fully enabled by Netskope Borderless SD-WAN.”

The post Netskope claims borderless SD-WAN to transform enterprise networks appeared first on FutureIoT.

CSPs will be increasing their spending in multi-domain, multi-vendor and multi-technology network control, management and orchestration systems that support hybrid cloud networking environments.

By 2028, 60% of the total NAO expenditure will be dedicated to 5G, WAN automation and multi-domain orchestration predicts the firm.

Michelle Lam, an analyst at Analysys Mason, predicts the coming years will be a critical time for 5G, marked by maturing technology and evolving use cases that are prompting CSPs to invest heavily in advanced automation and orchestration capabilities.

“This investment serves the dual purpose of reducing total cost of ownership (TCO) by streamlining complex operational processes, and secondly, unlocking new revenue opportunities with service differentiation,” she elaborated.

According to Lam, 5G-related NAO spending is projected to grow at a CAGR of 27.2% during the forecast period to reach USD8.6 billion, aligning with CSPs’ imperative to modernise their 5G SA infrastructure to support end-to-end network slicing, cloud-native automation and intent-based orchestration.

“CSPs will look towards enhancing these capabilities with artificial intelligence/machine learning- (AI/ML) driven closed-loop automation to enable automated slice lifecycle management across multi-vendor, multi-cloud and multi-technology environments.”

She believes these efforts will rely on open standards and the adoption of Kubernetes-based network architectures to facilitate the orchestration of cloud-native network functions (CNFs).

“Open-source initiatives, such as the Nephio project, will be the driving force to unify CNF orchestration across the RAN, core and transport network and support CNF domain orchestration in multi-vendor cloud infrastructure across large-scale edge deployments,” she continued.

The post Network Automation and Orchestration Opportunities in 2024 appeared first on FutureIoT.

“Weak enforcement of security standards for IoT device manufacturers coupled with the proliferation of shadow IoT devices at the enterprise level poses a significant threat to global organisations. Often, threat actors target ‘unmanaged and unpatched’ devices to gain an initial foothold into the environment,” said Deepen Desai, global CISO and head of security research at Zscaler.

He encourages organisations to enforce zero trust principles when securing IoT and OT devices - never trust, always verify, and assume breach. “Organisations can eliminate lateral movement risk by utilizing continuous discovery and monitoring processes to segment these devices,” he continued.

Consistent growth in attacks

With the steady adoption of IoT and personal connected devices, the report found an increase of over 400% in IoT malware attacks year-over-year. The growth in cyber threats demonstrates cyber criminals’ persistence and ability to adapt to evolving conditions in launching IoT malware attacks.

Additionally, research indicates that cybercriminals are targeting legacy vulnerabilities, with 34 of the 39 most popular IoT exploits specifically directed at vulnerabilities that have existed for over three years.

The Mirai and Gafgyt malware families continue to account for 66% of attack payloads, creating botnets from infected IoT devices that are then used to launch denial-of-service (DDoS) attacks against lucrative businesses.

Botnet-driven distributed DDoS attacks are responsible for billions of dollars in financial losses across industries around the globe. In addition, DDoS attacks pose a risk to OT by potentially disrupting critical industrial processes and even endangering human lives.

Industries favoured by attackers

Manufacturing and retail accounted for nearly 52% of IoT device traffic, with 3D printers, geolocation trackers, industrial control devices, automotive multimedia systems, data collection terminals, and payment terminals sending the majority of signals over digital networks.

However, the quantity of device traffic has created opportunities for cybercriminals, and the manufacturing sector now sees an average of 6,000 IoT malware attacks every week.

Moreover, these substantial IoT malware attacks can disrupt critical OT processes, which are integral in many industrial manufacturing plants like automotive, heavy manufacturing, and plastic & rubber.

This creates long-term challenges for security teams at manufacturing businesses but also demonstrates that industrial IoT holds a substantial lead in adopting unique IoT devices (nearly three times more than other sectors). This increase is critical as manufacturing organisations continue adopting IoT tools for automation and digitization of legacy infrastructure.

Education is another sector that suffered from outsized attention from cybercriminals in 2023, with the propagation of unsecured as well as shadow IoT devices within school networks providing attackers with easier access points.

The wealth of personal data stored on their networks has made educational institutions particularly attractive targets, leaving students and administrations vulnerable. In fact, the report found IoT malware attacks in the education sector increased by nearly 1000%.

The post Manufacturing and education are most targeted by malware appeared first on FutureIoT.

The Nokia 20203 Threat Intelligence Report claims that 60% of attacks against telecom mobile networks are linked to IoT bots scanning for vulnerable hosts for use in distributed denial of service attacks.

Impact of unmonitored technology on security

Many say the weakest link is humans. I'd argue that the IoT devices that have been quietly sitting in the business perimeter present just as big a clear and present danger to consumers and enterprises. This has been repeatedly highlighted in cyberattacks against critical infrastructure.

Steven Scheurmann, regional vice president for ASEAN at Palo Alto Networks, says the escalation of cyberattacks on IoT and OT devices is a significant concern in ASEAN, with 60% of organisations acknowledging increased security risks associated with IoT. He pointed out that Unit 42's IoT Threat Report highlights that 57% of IoT devices are susceptible to medium to high-severity attacks.

He opined that the primary reason behind this trend is the expansion of the attack surface, as hackers exploit unsecured IoT and OT devices newly connected to networks.

“These devices often lack security updates and configurations, making them easy targets. Also, they may store sensitive personal data, making them attractive to hackers, particularly in sectors like healthcare. This evolving threat landscape is deeply concerning.”

Steven Scheurmann

The sum of the parts is better

It is widely known that IT teams and those with operational technology oversight have not, traditionally, seen the need to work together. However, recent attacks against critical infrastructure and supply chains suggest that threat actors are looking at multiple channels to penetrate an organisation.

“Across ASEAN and globally, organisations possess a multitude of diverse devices, including traditional endpoints like PCs and smartphones, cloud-based applications, and a mix of on-premises and hybrid cloud systems,” said Scheurmann. “In recent years, this fragmentation has become prevalent, resulting in varied configurations, standards, and compliance measures. This lack of uniformity creates vulnerabilities that attackers exploit.”

He suggested that by integrating IoT and OT under the shared responsibility of IT and security departments, enterprises can establish consistency, standardisation, and compliance, making it more challenging for hackers to breach systems.

“While this transition is positive, there is a learning curve involved, and our role is to educate the market on achieving this level of standardisation,” continued Scheurmann.

Factors driving a convergence of oversight

A report from the Center for Strategic and International Studies (CSIS) in the USA noted that hackers targeted government, military, and civilian networks across the Asia Pacific leveraging malware to obtain confidential information. The malware targeted both the data on victim machines as well as audio captured by infected machines’ microphones.

Scheurmann says securing critical infrastructure, like airports and telecommunications, at the national level is paramount to safeguard citizens in countries like the Philippines, Malaysia, Singapore, and Thailand.

He pointed out that protecting these vital assets is essential to prevent catastrophic disruptions and ensure public safety.

“The supply chain is another critical aspect, with many organisations reliant on interconnected third-party systems. Disrupting the supply chain can affect the delivery of goods and services, impacting everyone,” he added.

He explained that legacy systems pose unique challenges; identifying and managing them is a fundamental step in cybersecurity. “Without visibility, it's impossible to secure these systems effectively. Addressing these issues is complex but essential for comprehensive security,” he elaborated.

Protecting an expanding attack surface

The pandemic has accelerated organisations’ use of connectivity solutions. As enterprises start to connect IoT devices, sensors and instrumentations into the corporate network to acquire real-time visibility of assets or processes may have had the unintended consequence of exposing an organisation to threats previously not thought of by both security and IT teams.

“5G technology presents an incredible opportunity for organisations to scale services dramatically, impacting various sectors such as manufacturing and healthcare. It enables real-time decision-making on production lines and allows doctors to provide remote guidance in critical medical situations,” said Scheurmann.

He pointed out that the challenge lies in the speed at which data is transferred and shared – a breach could result in data being disseminated and compromised within seconds.

“Moreover, the connectivity of critical infrastructure through 5G raises concerns about potential attacks disrupting vital services like transportation and financial markets,” he posited. Despite these risks, he opined, the focus should be on harnessing 5G's benefits through education, preparation, and expert support, ensuring responsible and transformative use.

Expanding the protection envelope

Asked what steps should organisations then take to mitigate cybersecurity risk related to operational technology and IoT? And, more importantly, who should get involved?

Scheurmann believes that bringing OT and IoT devices into the realm of security and business units offers an opportunity to establish standards, governance, and policies. He added that this includes clear procedures, ongoing training and awareness, and a risk mitigation framework to anticipate and respond to incidents effectively.

He explained that visibility and tracking become crucial as more devices connect, ensuring a swift response to potential attacks. Resilience plays a critical role, ensuring systems can recover swiftly in the event of an attack.

“Delays in system restoration can have a significant impact, such as prolonged ATM network outages affecting everyday transactions for millions of people, emphasising the importance of quick recovery in a robust governance framework,” warned Scheurmann.

Predictions and advice for 2024

Recognising that Asia will continue to experience a shortage in skills and expertise, particularly in the areas of cybersecurity, Scheurmann believes that automation is pivotal for IT departments. He explains that automation ensures consistency in compliance, policy enforcement, and standardisation, allowing IT teams to focus on higher-priority tasks.

“For IT leadership, rationalising and consolidating the security stack is essential, given the proliferation of disparate products in response to recent challenges like COVID-19. Streamlining security measures simplifies administration and enhances effectiveness.

“Beyond IT, cybersecurity discussions must become a central boardroom topic, with every organisation recognizing the risk of potential cyberattacks. Leaders should prioritise cybersecurity strategy, investment, and integration into their overall business framework for successful digitisation,” concluded Scheurmann.

Click on the PodChat player to hear in detail Scheurmann’s take on how enterprises in Asia can mitigate OT and IoT cyber risks.

1. What is the impact of unmonitored and unsecured IoT devices on a system’s cybersecurity, and why is it one of the biggest cybersecurity challenges across ASEAN?
2. Why do the majority of ASEAN organisations (82%) see value in having a common team that looks after IT and OT infrastructure and systems? Is this a good thing or a bad thing?
3. What factors are driving organisations’ focus on securing IoT/OT in their future cybersecurity strategies?
4. What are the specific cybersecurity concerns related to 5G-connected IoT devices, and how do organisations plan to address them?
5. What steps should organisations take to mitigate cybersecurity risks related to OT? Who should get involved?
6. Coming into 2024, more devices and sensors will be added to the enterprises. What is your advice for operations, IT and leadership to improve the overall organisational security posture?

The post PodChats for FutureIoT: Mitigating OT and IoT cyber risks appeared first on FutureIoT.

To adapt to this changing environment, organisations need a new modern data centre architecture that delivers reliability through automated data centre operations, scalable performance to support the most stringent workloads (e.g., AI model training) and comprehensive data security, regardless of where the data resides.

"Data centre infrastructures are getting more complex and distributed. Traditional firewalls need to become more easily extensible to dynamically align with how the infrastructure is evolving. Juniper’s new security fabric meets market demands by allowing customers to integrate existing routers and firewalls," said Mauricio Sanchez, Sr. research director, enterprise networking and security at Dell’Oro Group. 

The new Juniper Connected Security Distributed Services Architecture integrates Juniper’s unified security management paradigm with (claimed) best-in-class routing and AI-predictive threat prevention to bring much-needed operational simplicity and scale to data centre security.

In addition, four new high-performance firewall platforms deliver unmatched performance in a compact footprint that minimizes cost, space and power consumption. 

The vendor claims its Connected Security portfolio provides a secure bridge for customers to facilitate their transition to a modern data centre, at their own pace.

This is achieved via the following unique innovations:

Juniper Connected Security Distributed Services Architecture: Juniper is the first in the industry to deliver an architecture design that fully decouples the forwarding and security services layers that have traditionally been combined in a single firewall appliance.

By decoupling these layers, customers can utilise their existing Juniper MX series routers as intelligent forwarding engines and load balancers. This unique design gives customers independent scaling flexibility without chassis limitations, multi-path resiliency and cost efficiency.

When coupled with Juniper Security Director Cloud, the operational experience is as simple as managing one logical element, regardless of the quantities and form factors of any additional firewall engines added to the architecture.

AI-predictive threat prevention: Building on Juniper’s Adaptive Threat Profiling and Encrypted Traffic Insights, AI-predictive threat prevention automatically generates custom signatures unique to the customer’s environment through a proxy-less architecture. Coupled with AI, customers gain even more effective malware prevention at line rate.

Additionally, the enhanced URL filtering solution provides more granular control, with more than 200 categories to choose from and support for up to 200 languages, as well as a new portal for better insights on web content and easy recategorization.

The AI-powered security solution enables customers and partners to predict and find real threats faster, leaving human experts to focus on more strategic security tasks.

Four new best-in-class high-performance firewalls: The new Juniper Networks SRX firewalls (SRX1600, SRX2300, SRX4300, SRX4700) are 1RU in size, scale up to 1.4 Tbps and include built-in Zero Trust capabilities, delivering the industry’s highest firewall throughput performance per rack unit.

The new platforms feature wire-speed MACsec along with natively embedded TPM 2.0 chips and cryptographically signed device IDs that allow security administrators and network operators to easily verify the trust posture of devices remotely and mitigate the risks of supply chain attacks.

These new firewalls, like the whole SRX family, support industry-standard EVPN-VXLAN Type 5 integration, providing full fabric awareness to security operators and allowing them to respond to threats faster.

“A new modern data centre architecture is needed that delivers reliable automated operations and high-performing connectivity, all without sacrificing security within and between data centre locations,” said Praveen Jain, SVP and GM, AI clusters and cloud-ready data centre, Juniper Networks.

When combined with Juniper’s Connected Security Distributed Services Architecture, these additions to the Juniper SRX series family offer customers even more options to build and expand their data centre architectures securely and with sustainability objectives top of mind.

The post Embedding zero trust in the data centre appeared first on FutureIoT.

The (hybrid) approach combines the scalability of cloud technology and the control of on-premise infrastructure. This means businesses can quickly scale up their operations while keeping security at the forefront.

According to the company, the hybrid cloud enables businesses to have full control over their cellular-connected networks, with on-site process controls. By requiring on-site authentication, the risk of hacking remotely is substantially reduced. This added security layer protects against potential cyber threats, similar to the added security that two-factor authentication provides.

The company says that integrating a business’ public key infrastructure (PKI), ensures companies retain full control over their environment. The company explains that all operations require local authorization, offering separation of duties and thorough auditing of the management system. This, combined with Semtech’s unique device-to-cloud security strategy, sets a new industry standard for security and control.

“In addition to the on-premise infrastructure security component, Hybrid Cloud features leverage the inherent advantages of cloud technology, providing scalable infrastructure that evolves with a customer’s business needs, minimizing the need for hefty hardware investments and enabling rapid deployment to meet operational demands,” said David Markland, vice president of AirLink Networking Solutions, Semtech.

He went on to explain that “With this new solution, customers can rely on the expertise and robust security framework of a premier cloud platform gaining the freedom to concentrate on what truly counts - their core business operations.”

Commenting on the announcement, Dan Shey, vice president at ABI Research says Semtech’s Hybrid Cloud is a new and unique approach to an industry-wide problem for securing management.

“With the introduction of this new network management feature, Semtech is offering a solution that combines the trust and controls of on-premise security services with the scalability benefits of the cloud. For any enterprise, Hybrid Cloud is an easy-to-implement, cost-effective way to start building their zero-trust security framework,” he continued.

The post Semtech adds hybrid cloud capabilities to its AirLink routers appeared first on FutureIoT.

“Organisations worldwide are under mounting pressure to ensure their IoT and connected devices are protected while navigating an increasingly complex digital landscape that requires complete trust,” said

Ellen Boehm, senior vice president, IoT Strategies and Operations at Keyfactor, says the survey demonstrates the importance of identity-first security for those who manufacture IoT devices and those who deploy and operate them in their environment to establish digital trust at scale.

She opines that most organisations implement PKI solutions in their IoT security strategy, which is a huge step in the right direction.

“Ensuring that IoT device security is managed throughout its lifecycle will go a long way in both eliminating costly certificate outages and enhancing the long-term viability of IoT within the enterprise.”  Ellen Boehm

Highlights of the survey

Unrelenting attacks: 89% of respondents’ organisations that operate and use IoT and connected products have been hit by cyberattacks at an average cost of US$250K. The March attack on Amazon’s Ring that exfiltrated sensitive customer data such as recorded footage and credit card numbers is an example of the increase in IoT attacks. 

In the past three years, 69% of organisations have seen an increase in cyberattacks on their IoT devices.

Boehm says many IoT security strategies fail to prevent and protect against IoT-targeted cyberattacks because organisations lack the proper education and support needed to fully understand the task at hand.

She added that over half of respondents agree that their organisation doesn’t have the proper awareness and expertise to prepare for IoT device cyberattacks, spotlighting the need for more guidance to fully secure their devices.

“Organisations can’t protect against what they cannot understand,” she called out.

Proliferating growth of IoT devices: Respondents reported a 20% average increase in the number of IoT and connected products used by organisations over a three-year period.

IT is not fully confident in the security of IoT and connected devices: About 88% of respondents agree that improvements are needed in the security of IoT and connected products in use within their organisation. 37% of respondents reporting that significant improvement is needed and 60% reported that some improvement is needed.

When it comes to specific strategies, 4 in 10 organisations report that they strongly agree they would benefit from using a PKI to issue digital identities on the IoT and IIoT devices in their environment.

IoT security budgets being diverted to cover costs from outages: While budgets for IoT device security are increasing year over year, with an anticipated increase of 45% in the next five years, 52% of that budget is at risk of being diverted to cover the cost of successful cyber breaches on IoT and connected products.

Pointing fingers on responsibility: 48% believed that the manufacturer of IoT or connected devices should be at least mostly responsible for cyber breaches on their products.

The post Securing IoT and connected devices is a global challenge appeared first on FutureIoT.

In addition to securing facilities, CISOs of publicly traded companies throughout Europe are now required to run recurring vulnerability scans, report on cybersecurity breaches within a reasonable timeframe, and report their risk exposure.

To bring companies in line with the new requirements in addition to their existing regulations, Radiflow has developed a three-pillar approach consisting of OT network illumination, prioritizing security for business-critical assets, and a clear onboarding process. In addition, they help ease the transition to new regulations by offering risk assessment and compliance services for companies going through the NIS2 journey.

“Many companies are entering a new world of cybersecurity regulation, unsure of how to go from their current security systems to more advanced ones that comply with regional legislations,” said Ilan Barda, co-founder & CEO of Radiflow.

“The want to comply is there, however, it’s a big leap for many teams. We’ve found that a customer-first approach to onboarding is allowing for faster time to be cyber-secure while demanding fewer resources.”

Ilan Barda

Many companies utilize older cybersecurity practices, outdated tools, or have no OT cybersecurity program at all. This presents a large skill gap between OT cybersecurity professionals today and the capabilities of a modern platform.

The CIARA 4.0 platform allows teams to gain insights into best practices for security controls, allowing for better mapping and reporting of their security posture. Working with teams allows for a smooth transition while integrating into existing systems, CIARA V4.0 can assist with compliance by focusing on continuous risk monitoring, enabling analysis of actions caused by the recent changes to the risk score.

The post Radiflow to support NIS2 compliance appeared first on FutureIoT.

The analysis reveals key insights about the OT cybersecurity threat landscape, outlines high-level security architecture for OT, critical infrastructure systems (CIS) and industrial control systems (ICS), and evaluates key requirements of security regulations and frameworks. 

OT environments experience the same kinds of threats as enterprise IT – including ransomware, account takeovers, APTs, and supply chains as vectors – while experiencing expanded OT-specific threats.

While traditional IT security tools may be adapted, developing robust security architectures for OT environments is inherently complex compared to their IT counterparts. Its unique nature, from equipment and software to communication protocols requires dedicated OT security solutions.

Key insights

OT threat landscape. Heightened geopolitical factors have intensified attacks on OT and ICS, posing significant consequences ranging from operational disruptions and service denial to financial repercussions and potential harm to human well-being.

Core cybersecurity regulations. The risks and consequences of cyber-attacks against critical infrastructure advanced regulations globally mandating secure architectures and technical controls. KRITIS and the follow-on IT Security Act 2.0 are related examples of such regulations, as well as the NIST Cybersecurity Framework.

OT security architectures and key functionalities. There are eight areas of functionality that are central to effective OT security architectures. Cybersecurity architectures for OT must address asset discovery, access control, IT security tool integration, detection and response capabilities, and OT protocol-level threats.

As the analysis breaks down, within critical infrastructure interruptions and downtime are not an option. To address the increasing need for secure access in OT environments, Cyolo introduced Cyolo 4.3, which expands key capabilities with more layers of security and makes the product easier than ever to use for both administrators and end users in the industrial space.  

With Cyolo 4.3, industrial organisations will be able to extend their multi-factor authentication (MFA) across environments through integration with Duo Security to support their physical tokens as required.

Cyolo has implemented another layer of security for file transfer within the OT/ICS environment, through query anti-virus software to scan files before they are delivered to their destination. The company is also adapting for further usability, allowing teams to securely invite external users by generating a secure one-time password; and import groups from existing IdPs, using System for Cross-domain Identity Management (SCIM).

“Ensuring the security of critical infrastructure and industrial processes has become increasingly critical as organisations unite their IT and OT systems. This convergence has expanded the OT threat landscape and introduced significant cybersecurity challenges, as the once-isolated OT networks are now vulnerable to the same threats that have targeted IT networks for years” said Joe O'Donnell, vice president ICS/OT of Cyolo.

“With Cyolo 4.3, industrial entities can confidently navigate the complexities of the modern threat landscape and fortify their defences against evolving cyber threats,” he added.

The post Zero trust and remote access analysis for OT environments appeared first on FutureIoT.

DPC is supporting the integration of sensors into Enturi’s portable and decentralised wind turbines. The turbines can then connect to DPC’s cloud platform to manage the secure communication and management of data.

Benefits of integration

• A customer application to control the turbines remotely and access live and historical data, a current challenge for the industry.
• Preventative maintenance via real-time data analysis.
• Data analysis to monitor and understand the impact of decisions on journeys to net zero.
• Transparency of data to, for example, open up data access for carbon accounting as part of companies’ decarbonization journeys.

Referring to the partnership as a perfect example of how a standardised approach to connectivity and trusted data is enhancing strategies across industries, Brian Bishop, CEO of DPC and OCF president commented that as the renewable energy industry innovates, both organisations and consumers must have complete confidence that their data is safe.

"By using the OCF framework, DPC is able to not only comply with UK green energy metering requirements but with ISO/IEC standards to ensure the secure communication of wind energy data."

Brian Bishop

In February 2023, Enturi was awarded £98,000 of Innovate UK funding to accelerate system development through advanced computational fluid dynamics (CFD) simulation and rapid prototyping.

Alex Shakeshaft, CEO and Co-Founder of Enturi, says monitoring and reporting on decarbonization in a secure yet transparent way is a huge challenge for the renewable energy industry.

"We are thrilled to collaborate with DPC to ensure both organisations and individuals can easily monitor and report on their sustainability goals. Our vision is to diversify clean technologies to enable businesses and communities to access renewable energy solutions to make significant contributions towards net zero goals, energy security, and energy costs.”

Alex Shakeshaft

The post Wind energy data transparency project adopts OCF standard appeared first on FutureIoT.

“Energy, critical manufacturing, water treatment and nuclear facilities are among the types of critical infrastructure industries under attack in the majority of reported incidents,” said Mark Cristiano, commercial director of global cybersecurity services at Rockwell Automation.

He added that anticipating that stricter regulations and standards for reporting cybersecurity attacks will become commonplace, the market can expect to gain invaluable insights regarding the nature and severity of attacks and the defences necessary to prevent them in the future.

Key findings

OT/ICS cybersecurity incidents in the last three years have already exceeded the total number reported between 1991-2000.

Threat actors are most intensely focused on the energy sector (39% of attacks) – over three times more than the next most frequently attacked verticals, critical manufacturing (11%) and transportation (10%).

Phishing remains the most popular attack technique (34%), underscoring the importance of cybersecurity tactics such as segmentation, air gapping, Zero Trust and security awareness training to mitigate risks.

In more than half of OT/ICS incidents, Supervisory Control and Data Acquisition (SCADA) systems are targeted (53%), with Programmable Logic Controllers (PLCs) as the next most common target (22%).

More than 80% of threat actors come from outside organisations, yet insiders play an unintentional role in opening the door for threat actors in approximately one-third of incidents. 

In the OT/ICS incidents studied, 60% resulted in operational disruption and 40% resulted in unauthorized access or data exposure. However, the damage of cyberattacks extends beyond the impacted enterprise, as broader supply chains were also impacted 65% of the time.

The research indicates strengthening the security of IT systems is crucial to combatting cyberattacks on critical infrastructure and manufacturing facilities. More than 80% of the OT/ICS incidents analyzed started with an IT system compromise, attributed to increasing interconnectivity across IT and OT systems and applications.

The IT network enables communication between OT networks and the outside world and acts as an entryway for OT threat actors. Deploying proper network architecture is critical to strengthening an organisation’s cybersecurity defences.

It is no longer enough to simply implement a firewall between IT and OT environments. Because networks and devices are connected daily into OT/ICS environments, this exposes equipment in most industrial environments to sophisticated adversaries.

Having a strong, modern OT/ICS security program must be a part of every industrial organisation’s responsibility to maintain safe, secure operations and availability.

“The dramatic spike in OT and ICS cybersecurity incidents calls for organisations to take immediate action to improve their cybersecurity posture or they risk becoming the next victim of a breach," said Sid Snitkin, vice president of cybersecurity advisory services, ARC Advisory Group.

He added that the threat landscape for industrial organisations is constantly evolving, and the cost of a breach can be devastating to organisations and critical infrastructure. "The report’s findings underscore the urgent need for organisations to implement more sophisticated cybersecurity strategies," he concluded.

The post Urgent need for proactive OT defences and incident response appeared first on FutureIoT.

The performance of the combined unified threat management (UTM) and firewall markets drove the growth of the overall market in 2Q23 with revenue growth of 9.7% compared to 2Q22. The intrusion prevention systems (IPS) market grew 2.3% year over year, while content management and virtual private networks (VPN) both experienced a single-digit year-over-year decline in the quarter.

"Supply chain constraints that have impacted the hardware-based markets continue to improve and IDC expects the security appliance market to maintain a healthy rate of growth in the years ahead as hardware-based security platforms remain a key component in a customer's cybersecurity investment strategy," said Carlo Dávila, research manager, Enterprise Trackers at IDC.

Competitive landscape

* Note: IDC declares a statistical tie in the worldwide security appliances market when there is a difference of 1.0% or less in the share of revenues or shipments among two or more vendors.

The post IDC: UTM and firewall spur growth in security appliance spending appeared first on FutureIoT.

“Continuing to educate global businesses about the evolving and increased risk being introduced to their attack surface through managed and unmanaged assets is a key mission of ours,” said Nadir Izrael, Armis CTO and Co-Founder. “This intelligence is crucial to helping organisations defend against malicious cyberattacks. Without it, business, security and IT leaders are in the dark, vulnerable to blind spots that bad actors will seek to exploit.”

Armis’ research, analysed from the Armis Asset Intelligence Engine, focuses on connected assets with the most attack attempts, weaponised Common Vulnerabilities and Exposures (CVEs) and high-risk ratings to determine the riskiest assets.

Assets with the highest number of attack attempts

Armis found the top 10 asset types with the highest number of attack attempts were distributed across asset types: IT, OT, IoT, IoMT, Internet of Personal Things (IoPT) and Building Management Systems (BMS).

This demonstrates that attackers care more about their potential access to assets rather than the type, reinforcing the need for security teams to account for all physical and virtual assets as part of their security strategy.

Top 10 device types with the highest number of attack attempts:

Engineering workstations (OT)

Imaging workstations (IoMT)

Media players (IoT)

Personal computers (IT)

Virtual machines (IT)

Uninterruptible power supply (UPS) devices (BMS)

Servers (IT)

Media writers (IoMT)

Tablets (IoPT)

Mobile phones (IoPT)

“Malicious actors are intentionally targeting these assets because they are externally accessible, have an expansive and intricate attack surface and are known weaponised CVEs,” said Tom Gol, CTO of Research at Armis.

He pointed out that the potential impact of breaching these assets on businesses and their customers is also a critical factor when it comes to why these have the highest number of attack attempts.

"Engineering workstations can be connected to all controllers in a factory, imaging workstations will collect private patient data from hospitals and UPSs can serve as an access point to critical infrastructure entities, making all of these attractive targets for malicious actors with varying agendas, like deploying ransomware or causing destruction to society in the case of nation-state attacks. IT leaders need to prioritise asset intelligence cybersecurity and apply patches to mitigate this risk,” explained Gol.

Assets with unpatched, weaponised CVEs vulnerable to exploitation

Researchers identified a significant number of network-connected assets susceptible to unpatched, weaponised CVEs published before 1/1/2022.

Zooming in on the highest percentage of devices of each type that had these CVEs between August 2022 and July 2023, Armis identified the list reflected in Figure A. Unpatched, these assets introduce significant risk to businesses.

Assets most susceptible to unpatched, weaponised CVEs published before Jan 1 2022

Assets with a High-Risk Rating

Armis also examined asset types with the most common high-risk factors:

• Many physical devices on the list that take a long time to replace, such as servers and Programmable Logic Controllers (PLCs), run end-of-life (EOL) or end-of-support (EOS) operating systems. EOL assets are nearing the end of functional life but are still in use, while EOS assets are no longer actively supported or patched for vulnerabilities and security issues by the manufacturer.
• Some assets, including personal computers, demonstrated SMBv1 usage. SMBv1 is a legacy, unencrypted and complicated protocol with vulnerabilities that have been targeted in the infamous Wannacry and NotPetya attacks. Security experts have advised organisations to stop using it completely. Armis found that 74% of organisations today still have at least one asset in their network vulnerable to EternalBlue – an SMBv1 vulnerability.
• Many assets identified in the list exhibited high vulnerability scores, have had threats detected, have been flagged for unencrypted traffic or still have the CDPwn vulnerabilities impacting network infrastructure and VoIPs.
• Half (50%) of pneumatic tube systems were found to have an unsafe software update mechanism.

The post The riskiest assets introducing threats to global businesses appeared first on FutureIoT.

However, many of these consumer IoT devices prioritise features and affordability, often sidelining essential cybersecurity provisions. This oversight makes them susceptible to digital threats, jeopardising user privacy and data. The 2016 Mirai botnet attack, which exploited IoT gadgets, underscores the looming dangers of poorly secured IoT systems.

Government intervention

Thankfully, governments globally are recognising these risks and acting on the security concerns raised, empowering consumers with the knowledge to make safer choices. The US has recently introduced the Cyber Trust Mark, a discretionary labelling system that promotes the understanding of a smart device's security provisions before a purchase is made.

This initiative mirrors others that have emerged prior, like the EU's Cyber Resilience Act. Closer to home, Australia has also implemented a similar cybersecurity label scheme for IoT devices. Notably, Singapore took the lead in the APAC region with their Cybersecurity Labelling Scheme (CLS) presented by the Cyber Security Agency of Singapore (CSA).

Given the collaborative efforts of businesses and governments worldwide to fortify IoT devices and develop universal IoT security benchmarks, we sit down with Kelvin Lim, director of security engineering, Asia Pacific, at Synopsys Software Integrity Group to understand more about how the CLS IoT labelling scheme has been doing in Singapore so far, and the lessons other organisations can take away in the space of security.

Given the rise of similar regulations in various regions, how has Singapore's Cybersecurity Labelling Scheme (CLS) fared locally?

Kelvin Lim: The CLS has garnered positive feedback from both industry experts and manufacturers. A mix of international, regional, and local IoT product manufacturers are getting their products assessed in Singapore. As of 14 August, this year, there are over 200 products endorsed under the CLS initiative.

"This track record speaks volumes, and the subsequent introduction of another scheme that has since been rolled out specifically for medical devices — the Cybersecurity Labelling Scheme for Medical Devices (CLS(MD)) — underlines Singapore's proactive approach to ensuring a digitally secure and advanced nation."

Kelvin Lim

The CLS initiative will bolster Singapore's cybersecurity standards, positioning it as a preferred hub for smart device production. From consumers, intuitive labels will help even those without technical expertise to navigate their decision process when purchasing IoT devices.

How has this influenced the medical device industry?

Kelvin Lim: More medical device manufacturers will adopt the standard as it gains recognition and traction in Singapore. By extending the CLS to medical devices, Singapore has emphasised the importance of cybersecurity in healthcare technologies.

This will compel medical device manufacturers to prioritise the security of their devices, ensuring the safety and privacy of patients.

How has the introduction of these labelling schemes impacted consumer preference?

Kelvin Lim: Today’s consumers are judicious. Increasingly so, they are invested in how their personal data is being used and stored, and how businesses are handling their private information. Consequently, consumers are more likely to buy a smart product sporting the CLS label.

It serves as a reassuring quality seal that the smart products they purchase and use have gone through stringent checks and are perceived as more secure, compared to one without.

However, those unfamiliar with CLS might gravitate towards renowned brands or manufacturers with a global footprint.

These renowned brands have built trust in consumers over many years, and are automatically associated with offering secure devices, regardless if they have the CLS certification or are on par with the security benchmark in Singapore.

Since its inception, how has the mutual recognition with Germany’s labelling scheme fared, and did it bring any value since it was finalised in October last year?

Kelvin Lim: The joint effort between Singapore and Germany epitomises the significance of global alliances in fortifying IoT security. This mutual acknowledgement has been warmly received by the industry and manufacturers. Beyond saving resources and avoiding repetitive tests, this accord also grants entry to new markets.

The path ahead for IoT

The horizon looks bright for IoT labelling. Such labels serve as badges of trust, assuring consumers of a device's compliance with rigorous cybersecurity norms. They also prompt manufacturers to prioritise cybersecurity in their product development process.

As the IoT landscape continues to evolve, it is imperative that consumers, manufacturers, and government work together to build a secure and resilient IoT ecosystem. By understanding the emerging risks in IoT security and implementing robust application protection measures, we can harness the full potential of IoT.

The post Elevating digital protection with IoT security labeling schemes appeared first on FutureIoT.

Organisations are now aware that state-sponsored actors and cybercriminals are capable of exploiting security gaps in key infrastructure to cause serious harm and supply chain issues.

According to Frost & Sullivan, major corporations throughout the world want to increase their spending on OT security.

The growing need for OT security

Vinay Biradar, associate director at Frost & Sullivan, says OT systems become significantly more vulnerable to cyber threats as they integrate with IT infrastructure. Biradar points to market data which reveals that 90% of firms experienced at least one OT system intrusion incident in the previous calendar year.

He opines that worries are worsened by the expansion of zero-day threat vectors in this field and the inadequate security features built into Internet of Things (IoT) and OT equipment.

He explains that security is compromised by problems such as system-level attacks, lax device management, and inefficient authentication.

"Risks are exacerbated by poor patch management and program updates. Non-compliance by IoT manufacturers, inadequate network segmentation between IT and OT, public OT network access, and weak identity management further increase vulnerability," he elaborates.

According to Biradar, weak encryption, insecure data transfer, misconfigurations, firmware glitches, and a lack of secure update mechanisms add to the security woes of these systems leading to a variety of different attacks:

Unauthorised Access to SCADA (Supervisory Control and Data Acquisition) systems – where attackers infiltrate them to manipulate machinery, potentially causing safety risks or equipment damage.

Device Hijacking – where attackers gain control of OT devices, enabling eavesdropping, data theft, and operational disruption.

Data Manipulation – where cybercriminals target SCADA or Industrial Control Systems (ICS) devices to tamper with or delete stored data, leading to misinformation and compromised decision-making.

Man-in-the-Middle Attacks – where attackers intercept and modify communication between devices, altering device instructions and causing malfunctions.

Permanent Denial-of-Service – where attackers destroy firmware, rendering devices or systems inoperable and requiring extensive recovery efforts.

Fraudulent Identity and Control Panel Access – where attackers use fake identities to access control panels, compromising system settings and operational integrity.

Biradar opines that addressing these challenges demands a multi-pronged approach involving collaboration among manufacturers, regulatory bodies, and end-users to build industry standards.

"Consistent adherence to security, establishment of guidelines, conformance enforcement, and widespread adoption of best practices are essential throughout the lifecycle of OT devices," he suggested.

Growth areas in OT security

According to Frost, infrastructure security and smart buildings are quickly becoming important growth areas for OT security for businesses. Building Management Systems (BMS) security is seeing a noticeable increase in spending and budgetary allocation from organisations, in our market studies.

Biradar argues that BMS security is no longer the sole responsibility of the facility and operations teams; instead, CISOs are taking a more active role in harmonising the security stack as a whole and in developing Standard Operating Procedures (SOPs).

"While the traditional BMS Providers have started to invest in expanding their portfolio into smart buildings cybersecurity services, IT security vendors have started to perceive smart buildings cybersecurity as a new growth area and a vital component of their OT security offerings," he continued.

How organisations can prepare themselves

Biradar says the growth of the OT security market provides opportunities for both security vendors as well as end customers alike.

He posits that as an end client, "you can choose from the best-of-the-breed solutions and approaches as providers significantly increase their R&D in this area."

He acknowledges grey areas in comprehensively understanding the market opportunities and the key areas of investment.

"By embracing comprehensive market landscape analysis – which can feed into the organisation’s business as well as the technology roadmap, fostering industry collaboration, and prioritising security throughout the lifecycle of OT devices – organisations can stay prepared for the future," he concluded.

The post Safeguarding OT in a connected world appeared first on FutureIoT.

Resource-constrained HDO security and IT teams continue to face operational difficulties in sufficiently securing critical systems from increasingly sophisticated attacks, as their vast and heterogeneous IoMT device fleets complicate management and, left unchecked, offer a broad attack surface.

Asimily's Total Cost of Ownership Analysis on Connected Device Cybersecurity Risk report highlights the unique cybersecurity challenges that healthcare delivery organisations (HDOs) face and the true costs of their IoT and IoMT security risks.

Key findings

Emerging cybersecurity trends and challenges: The report reveals the top cyberattack strategies impacting HDO medical devices right now: ransomware attacks that spread to devices and disrupt services, third-party-introduced malware that impacts device performance, and devices communicating with unknown IP addresses to enable remote breaches.

Cyberattacks on healthcare providers have become remarkably common: the average HDO experienced 43 attacks in the last 12 months. Unfortunately, many of those attacks are successful, with 44% of HDOs suffering a data breach caused by a third party within the last year alone.

The high cost of doing nothing: For HDOs, today’s high-failure status quo can be catastrophic. Cyberattacks cost HDOs an average of US$10,100,000 per incident. Worse, cyber incidents are directly responsible for a 20% increase in patient mortality. 64% of HDOs also reported suffering from operational delays, and 59% had longer patient stays due to cybersecurity incidents.

Those financial and operational burdens are pushing many HDOs to the brink: the average hospital operating margin sits at 1.4% in 2023. Currently, more than 600 rural U.S. hospitals risk closure, in an environment where a single cyberattack can put a smaller HDO out of business.

Poor device health leads to poor outcomes: HDO security and IT teams face a high-risk environment where the average medical device has 6.2 vulnerabilities. Adding to this challenge, more than 40% of medical devices are near end-of-life and poorly supported (or unsupported) by manufacturers.

Cybersecurity resources and staffing are limited: Even when device vulnerabilities are recognised, HDO security teams can fix only 5-20% of known vulnerabilities each month.

Cyber insurance is no longer enough: As ransomware attacks and breaches have skyrocketed in recent years, cyber liability insurers are introducing coverage limits and capped payouts, making it a less and less effective recourse for HDOs. At the same time, cyber insurance also fails to address the costly reputational damage an HDO suffers following a breach.

The report concludes that adopting a holistic risk-based approach is the most cost-efficient and long-term-effective path for HDOs to secure their critical systems and IoMT devices.

The post New report quantifies hospitals’ IoT and IoMT cybersecurity risk appeared first on FutureIoT.

Under its ‘emerging technology testbed’ initiative, the City of Melbourne worked with Nokia to leverage an existing network of installed cameras as Internet of Things (IoT) sensors to monitor one of the compactors.

The Nokia Scene Analytics solution employs an AI-powered algorithm to filter and collate data from the cameras, while also combining other data sources, such as operational data on the compactor itself, to create real-time alerts and produce reports.

Initial tests show

Initial trial results demonstrate that Scene Analytics can support the City’s objectives for better, safer citizen experiences while simultaneously lowering maintenance and downtime costs for waste management services.

Lord Mayor Sally Capp, City of Melbourne, says the solution is a great example of using new technology to help remove illegal waste more quickly, make our city cleaner and protect the environment.

"This innovative project will help to avoid hazards and make our streets even cleaner by allowing our waste services to better understand behaviour trends related to the illegal and dangerous dumping of waste,” she continued. 

How the technology works

The trial allowed for real-time monitoring and detection of activity in the vicinity of the compactor using a virtual tripwire. Object detection and object counting was used to identify and count items to show how the compactor was impacted by items incorrectly placed within it, while also identifying potentially dangerous items.

Anomaly detection identified unusual movements, such as illegal waste dumping during the night, while face and license plate blurring maintained individual privacy during the trial.

Using these reports, the City of Melbourne can better understand the correlation between illegal waste-dumping activities and compactor downtime, to keep maintenance teams better informed and minimize issues.

It also allows them to swiftly address waste dumping activities before they become a hazard, viewing locations in real-time to observe any obstructions to service vehicle access, and adapting their schedule to reduce unnecessary visits and minimize their carbon footprint.

By understanding patterns of compactor usage and waste dumping activities, the city of Melbourne is also able to patrol the area more effectively, while developing an ongoing campaign to better inform and educate the community.

The post Melbourne to use AI to keep city streets safe and clean appeared first on FutureIoT.

“The video surveillance market is experiencing a transformation as more cloud video surveillance systems emerge, diversifying a market that capital expenditure costs have historically dominated,” says Lizzie Stokes, IoT networks & services analyst at ABI Research.

“Enterprise companies, lines of business, and small and medium enterprises (SMEs) are looking to take advantage of surveillance insights and are searching for new storage and analytics service models to ease implementation, drive faster time to market, lower costs, and improve ROI.”

Lizzie Stokes

According to ABI Research, high upfront on-premises installation and integration costs traditionally drove video surveillance market service revenue. Professional services revenue dominated the market, facilitated by System Integrators (SIs) who often design and install customers’ surveillance systems.

Market trends

However, two prominent market trends have led video surveillance users to divert investments away from new camera deployments to cloud data services.

Stokes explains that as video resolutions have improved, data loads have become heavier and more costly to store. At the same time, regulation is driving more firms to save their video footage.

Stokes says these market dynamics have created a demand for scalable and cost-effective cloud data storage solutions.

The other trend she observes has to do with video surveillance users increasingly viewing video data as untapped business intelligence.

"Video surveillance cameras are already tracking employee behaviour, observing customer actions, and monitoring goods as they journey through the supply chain and the factory floor. Many video surveillance users—enterprises and SMEs—are searching for streamlined cloud video analytics services to mine raw video data for operational insights,” she adds.

Video Surveillance-as-a-Service (VSaaS) companies are responding to these market trends, offering cloud data storage, cloud video analytics, and Software-as-a-Service (SaaS) applications that produce vertical-specific insights.

New customer demand will eventually diversify the market’s revenue structures, with more customers paying for video surveillance services through recurring fees. Traditional video surveillance companies providing on-premises and cloud offerings include Honeywell, Milestone Systems, and Bosch. Newer companies featuring cloud video surveillance services include Verkada, Eagle Eye Networks, and Wasabi Technologies.

“VSaaS vendors are redefining how video surveillance can be offered and deployed,” Stokes concludes. “As video analytics applications expand and video data in the market explodes, new video surveillance companies have the opportunity to disrupt the market’s traditional revenue structure.”

Early stages

Sunny Chua, Wasabi Technologies' general manager for Singapore, acknowledges that the transition to the cloud for video surveillance is still in the early stages but certainly picking up speed. He points to the 5G deployment across the region as facilitating the use of intelligent video surveillance devices as well as advanced analytics at the edge.

"The ability for these smart cameras to relay information back in real-time is contributing to innovative use cases in digitally advanced markets like Singapore, such as live footage used complementarily with 3D mapping technology to provide live insights on crowd management and weapon detection via virtual patrols," he elaborated.

Another area where he sees an opportunity for VSaaS is smart cities where spending in the region is expected to more than double between 2023 and 2028 to reach US$42 billion.

"Intelligent video surveillance is an especially important part of the puzzle in smart city development - enabling everything from smart traffic management to furthering sustainability ambitions by providing predictive insights on facilities utilisation in buildings," added Chua.

He believes these ongoing digital developments will ultimately drive workflow modernisation and transformation. "This makes Asia a ripe ground for VSaaS providers that can offer domain-specific services for the deep and reliable automation that a digital era demands while expediting the transition and minimising risks," he concluded.

The post Surveillance driving demand for storage solutions appeared first on FutureIoT.

As a vendor-agnostic solution, MSS fits into an organisation's existing IT/OT infrastructure, scaling to their budget and maturity.

"Managed Security Services will help our customers implement cybersecurity practices, proactively address risk, and align to regulatory requirements, giving them the ability to focus on their core operations," said Jay Abdallah, vice president of cybersecurity solutions and services at Schneider Electric.

With the manufacturing industry reporting the highest share of cyberattacks in 2022, business owners increasingly recognise the need for innovative cybersecurity solutions to help minimise downtime, loss of intellectual property and other disruption caused by system vulnerabilities.

"As part of our wide range of solutions to make organisations run more efficiently, this new cybersecurity offering is continuously evolving, helping to protect our customers against new cyber threats that can, and will, arise."

Powered by Schneider Electric's global Cybersecurity Connected Service Hub (CCSH), the new MSS offering provides technologies as flexible services to monitor cyber threats and proactively respond on behalf of customers.

It monitors known risks and protects networks, systems and data across IT, OT and cloud environments – each of which has specific protocols and attack vectors. This new service can help customers to reduce the risk of emerging threats and sophisticated attacks that these unique technical and operational environments face.

Backed by advanced machine learning capabilities and trend analysis, MSS continuously optimises processes and addresses real-time threats. The services include 24/7/365 support through Schneider Electric's CCSH, with a global engineering and support team available around the clock.

The post Schneider Electric debuts MSS for OT environments appeared first on FutureIoT.

ABI Research forecasts that automated storage & retrieval system (AS/RS) revenues are expected to surpass US$15 billion globally by 2030, and warehouse management system (WMS) revenues are expected to exceed US$10 billion by the same period.

"Global supply chain challenges over the last three years have highlighted the need for digitalisation and a deeper restructuring of inventory management. Labour constraints, geopolitical trade shifts, and inventory gluts continue to pressure warehouse operations, and the most impacted organisations continue to be those with lower focus on digital transformations," states Ryan Wiggin, supply chain management & logistics industry analyst at ABI Research.

The present and future competitive landscape

AS/RS vendors, including AutoStore, Ocado, and Swisslog, as well as autonomous mobile robot (AMR) vendors such as inVia Robotics, Locus Robotics, and Vecna Robotics, are leading the structural automation charge.

Established and emerging WMS vendors such as Blue Yonder, Manhattan Associates, and Snapfulfil continue to add new functionalities to orchestrate and optimise both manual and automated workflows.

In addition to the growth in automation and management systems, high investment in hardware and devices is expected to increase worker productivity, as manual worker involvement remains necessary alongside the adoption of automated equipment. Global shipments of handheld devices for warehouse workers will grow at a CAGR of 20% to 2030, led by market leaders such as Zebra and Honeywell.

The new warehouse building is expected to drop by as much as 35% in 2023 compared to 2022. It is creating an even greater incentive to invest in the automation of current facilities to ease operational constraints.

Disruption to new developments will be short-lived, with steady growth in warehouse construction expected to 2030, led by a much greater CAGR in global e-commerce fulfilment centre development at 18%.

"Successful deployments by Tier One organisations continue to spur the adoption of technologies within small-medium enterprises. Solutions providers must continue to offer accessible adoption through as-a-service models and scalable structures, and exploring partnerships with complementary technology will be key to deploying market-leading end-to-end solutions," concludes Wiggin.

The post IT-OT investments to resolve exposed weaknesses in supply chains appeared first on FutureIoT.

With unique cellular capabilities and the simplicity of Cradlepoint’s cloud-based management platform, NetCloud Manager, Cradlepoint 5G SASE features zero trust, cellular intelligence along with cloud and SIM-based security to address the challenges and threats faced by today’s extended enterprise.

As enterprises evolve beyond fixed sites to include mobile and IoT, they are looking to the flexibility and agility of Wireless WAN and 5G. These geographically dispersed networks, combined with the proliferation of connected devices and ill-fitting network security solutions, can significantly increase security vulnerability.

With IoT device deployments projected to reach 30 billion by 2027, and the perennial IT talent shortage, the seamless integration of 5G-centric SASE solutions to manage Wireless WAN infrastructure is critical.

"A full SASE solution that is optimised for 5G will allow IT organisations to manage network security, network access policies, and observability across wireless connectivity in any hybrid WAN," said Shamus McGillicuddy, vice president of research at Enterprise Management Associates (EMA).

The Cradlepoint 5G SASE will be delivered in phases over the next 12 months:

Cradlepoint Cellular Intelligence: Available today, cellular telemetries, such as signal strength and data plan usage, can be leveraged for SD-WAN traffic steering. As 5G StandAlone (SA) networks become mainstream, Cradlepoint’s network slicing capabilities will work with carriers’ services to offer prioritisation and slice-based isolation.

SIM-based Security: Cradlepoint offers SIM management and GPS tracking to secure the physical devices and to detect rogue movement. Cradlepoint’s vision for the future is to work with carriers for tighter SIM-based security using SIMs as the basis for authentication, regardless of the connecting hardware.

Connect-and-Go Zero Trust Security: Creating WANs in just a few clicks, 5G SASE replaces complex VPNs. Zero trust shrinks the lateral attack surface—devices connected to a Cradlepoint router are immediately dark to the outside world and other sites. Soon, this capability will be delivered from the cloud, offering an easier deployment option.

Cloud-Delivered Security: Ericom’s full suite of SSE solutions, including SWG, CASB, RBI and DLP, protects users browsing in fixed and mobile environments from threats such as phishing and ransomware. Cradlepoint will integrate these capabilities with existing zero trust and SD-WAN solutions into Cradlepoint NetCloud for a single pane of glass user experience for IT teams.

"As enterprises evolve and become more diverse in terms of their connectivity to branch, mobile and IoT, they need a more 5 G-centric approach to security and management. An updated approach to SASE is essential for today’s modern organisation to defend against elevated attack surfaces," said Todd Krautkremer, CMO, Cradlepoint.

"Current SASE solutions are not optimised for 5G. Cradlepoint’s strategy is to provide lean IT organisations with a security solution that is aligned with the realities of a changing business and network profile."

Todd Krautkremer

The post Coming in phases: secure 5G connectivity to address extended enterprise appeared first on FutureIoT.

With unique cellular capabilities and the simplicity of Cradlepoint’s cloud-based management platform, NetCloud Manager, Cradlepoint 5G SASE features zero trust, cellular intelligence along with cloud and SIM-based security to address the challenges and threats faced by today’s extended enterprise.

As enterprises evolve beyond fixed sites to include mobile and IoT, they are looking to the flexibility and agility of Wireless WAN and 5G. These geographically dispersed networks, combined with the proliferation of connected devices and ill-fitting network security solutions, can significantly increase security vulnerability.

With IoT device deployments projected to reach 30 billion by 2027, and the perennial IT talent shortage, the seamless integration of 5G-centric SASE solutions to manage Wireless WAN infrastructure is critical.

“A full SASE solution that is optimised for 5G will allow IT organisations to manage network security, network access policies, and observability across wireless connectivity in any hybrid WAN,” said Shamus McGillicuddy, vice president of research at Enterprise Management Associates (EMA).

As an industry leader in Wireless WANs and with the recent acquisition of Ericom, Cradlepoint is uniquely positioned to deliver a comprehensive 5G-optimised SASE solution that enables organisations to seamlessly match the security challenges of extended networks. Cradlepoint 5G SASE will be delivered in phases over the next 12 months:

Cradlepoint Cellular Intelligence: Available today, cellular telemetries, such as signal strength and data plan usage, can be leveraged for SD-WAN traffic steering. As 5G StandAlone (SA) networks become mainstream, Cradlepoint’s network slicing capabilities will work with carriers’ services to offer prioritisation and slice-based isolation.

SIM-based Security: Cradlepoint offers SIM management and GPS tracking to secure physical devices and to detect rogue movement. Cradlepoint’s vision for the future is to work with carriers for tighter SIM-based security using SIMs as the basis for authentication, regardless of the connecting hardware.

Connect-and-Go Zero Trust Security: Creating WANs in just a few clicks, 5G SASE replaces complex VPNs. Zero trust shrinks the lateral attack surface—devices connected to a Cradlepoint router are immediately dark to the outside world and other sites. Soon, this capability will be delivered from the cloud, offering an easier deployment option.

Cloud-Delivered Security: Ericom’s full suite of SSE solutions, including SWG, CASB, RBI and DLP, protects users browsing in fixed and mobile environments from threats such as phishing and ransomware. Cradlepoint will integrate these capabilities with existing zero trust and SD-WAN solutions into Cradlepoint NetCloud for a single pane of glass user experience for IT teams.

“As enterprises evolve and become more diverse in terms of their connectivity to branch, mobile and IoT, they need a more 5 G-centric approach to security and management. An updated approach to SASE is essential for today’s modern organisation to defend against elevated attack surfaces,” said Todd Krautkremer, CMO, Cradlepoint.

“Current SASE solutions are not optimised for 5G. Cradlepoint’s strategy is to provide lean IT organisations with a security solution that is aligned with the realities of a changing business and network profile.”

Todd Krautkremer

The post Cradlepoint outlines 5G SASE Strategy for cellular and hybrid WAN security appeared first on FutureIoT.

Industries such as manufacturing, industrial control system (ICS) engineering and integration have been particularly affected, emphasising the urgent need for enhanced cybersecurity preparedness.

The investigation uncovered a series of targeted attacks with the objective of establishing a permanent channel for data exfiltration. These campaigns exhibited significant resemblances to previously researched attacks, such as ExCone and DexCone, suggesting the involvement of APT31, also known as Judgment Panda and Zirconium.

There was also the use of advanced implants designed for remote access, showcasing the threat actors' extensive knowledge and expertise in bypassing security measures. These implants enabled the establishment of persistent channels for data exfiltration, including from highly secure systems.

The threat actors were extensively using DLL Hijacking techniques again (that is abusing legitimate 3rd party executables, that are vulnerable to loading malicious dynamic linked libraries into their memory) to try and avoid detection while running multiple implants used during 3 attack stages.

Cloud-based data storage services like Dropbox and Yandex Disk, as well as temporary file-sharing platforms, have been used to exfiltrate data and deliver subsequent malware. They also deployed command and control (C2) infrastructure on Yandex Cloud as well as on regular virtual private servers (VPS) to maintain control over compromised networks.

Within these attacks, new variants of the FourteenHi malware were implemented. Discovered in 2021 during the ExCone campaign targeting government entities, this malware family has since evolved, with new variants surfacing in 2022 to target specifically the infrastructure of industrial organisations.

Also discovered is a novel malware implant, dubbed MeatBall – a backdoor implant that possesses extensive remote access capabilities.

"We cannot underestimate the significant risks posed to industrial sectors by the targeted attacks they face," comments Kirill Kruglov, a senior security researcher at Kaspersky ICS CERT.

"As organisations continue to digitise their operations and rely on interconnected systems, the potential consequences of successful attacks on critical infrastructure are undeniable."

Kirill Kruglov

"This analysis emphasises the critical importance of implementing resilient cybersecurity measures to protect industrial infrastructure against existing and future threats," he added.

Recommendations

Conducting regular security assessments of OT systems to identify and eliminate possible cyber security issues.

Establishing continuous vulnerability assessment and triage as a basement for effective vulnerability management process. Dedicated solutions like Kaspersky Industrial CyberSecurity may become an efficient assistant and a source of unique actionable information, not fully available to the public.

Performing timely updates for the critical components of the enterprise’s OT network; applying security fixes and patches or implementing compensating measures as soon as it is technically possible is crucial for preventing a significant incident that might cost millions due to the interruption of the production process.

Using EDR solutions for timely detection of sophisticated threats, investigation, and effective remediation of incidents.

Improving the response to new and advanced malicious techniques by building and strengthening your teams’ incident prevention, detection, and response skills. Dedicated OT security training for IT security teams and OT personnel is one of the key measures helping to achieve this.

The post Advanced TTPs against the industrial sector utilise cloud infrastructure appeared first on FutureIoT.

The report noted that alongside strong growth in biometric devices, rising in revenue from US$7 billion in 2022, consumer electronics (smartphone, tablet, wearable) biometric capability will markedly increase in future years. Fingerprint sensor revenues will remain at a steady US$1.5 billion annually, with attach rates for face, voice, vein, ECG, and gesture biometrics increasing rapidly.

There are two angles to look at regarding the biometrics market. “First, we have dedicated devices, predominantly in the government and security space, as well as in enterprise, healthcare, and BFSI institutions. These are often specialised by application, for instance, a biometric enrolment kit for citizens’ identities, or eGate systems which use biometric verification to clear those crossing a border,” explains Lucas Stewart, research analyst at ABI Research. “Second, we can look at smartphones and tablets as a vessel for biometric authentication.”

ABI Research notes a strong uptick in the biometric capabilities of said devices, with low-end models increasingly equipped with biometric technologies and the overall smartphone user base seeing growing biometric penetration.

Stuart posits that given convenience and user experience, we see a trend of biometric verification often going through a personal device where possible, that is using your smartphone or other to capture or verify your own biometric data, where apps and web pages increasingly incorporate biometric means of authentication as a password replacement or way to verify oneself.

“Alongside the usability factor, this trend is underpinned by a clear need for mobility. In terms of standalone biometric devices, the need for mobility in these larger scale kits manifests with movement toward more handheld and portable devices,” Stuart continues.

Biometric locks are a key area of opportunity and something we will see more and more of as smart home concepts progress. Regarding other key growth areas, the border control market should also be closely monitored.

Stewart reiterates that there is a significant opportunity here with the need for more efficient and secure international border crossing becoming clear post-COVID as traveller volumes continue to rise.

ABI Research forecasts biometric locks as the most rapidly growing device type within the wider market, rising from 9.3 million shipments in 2022 to 35.5 million in 2027. Similarly exhibiting strong growth are eGates, at 12.8% CAGR from 2022 through 2027. These key figures sit alongside additional detail and granularity for multiple device types, by submarket and biometric modality.

The post ABI Research forecasts strong demand for biometric hardware appeared first on FutureIoT.

Since the early days of industrial automation, manufacturers have adopted a variety of purpose-built protocols and systems for highly specialised control applications, instead of using standard Ethernet technologies.

As the IIoT continues to expand, industrial networks in the future will be required to transmit much larger volumes of data between interconnected devices and to collect information from remote devices for both OT and IT engineers to access. With these growing demands on the horizon, network preparedness may determine an enterprise's success.

Moxa offers three tips to prepare IIoT networks for the future. These include:

Achieve greater integration with a unified infrastructure

Over the years, various devices using different protocols have been deployed on industrial networks to provide diverse services. Under these circumstances, network integration usually costs more than expected or becomes more difficult to achieve.

Manufacturers can either choose the status quo, that is, maintain their pre-existing isolated automation networks with numerous purpose-built protocols of the past, or seek solutions to deterministic services and that can integrate these “islands of automation” into one unified network.

If the goal is to be ready for future demands, the choice is obviously the latter. The rule of thumb is to take potential industrial protocols into consideration and ensure you can redesign networks in case any new demands arise in the market.

One approach is Time-Sensitive Networking (TSN), a set of new standards introduced by the IEEE 802.1 TSN Task Group as an advanced toolbox. With TSN, you can build open, unified networks with standard Ethernet technologies that reserve flexibility for the future.

Enable anywhere access with hassle-free cloud services

Cloud-based remote access offers many benefits to IIoT customers, such as reducing the travel time and expenses of sending maintenance engineers to multiple remote sites. Furthermore, cloud-based secure remote access can offer flexible and scalable connections to meet dynamic, fast-changing requirements.

However, operational technology (OT) engineers may find it cumbersome to set up and maintain their own cloud servers for new services and applications. Indeed, there is considerable effort associated with setting up new infrastructure, even in the cloud.

Fortunately, OEMs and machine builders can now deliver secure cloud-based services and remote access to their customers, therefore eliminating the need to maintain in-house cloud servers.

One key issue that demands scrutiny is the cloud server license scheme. Often, upfront costs may seem low for limited server hosts. Yet these apparent cost savings on server hosts may actually make a project uneconomical due to a limited scale of connections.

Second, you may also need to consider central management capabilities in order to flexibly expand remote connections as your needs change. With this said, carefully weigh the costs and benefits of incorporating secure remote access to industrial networks. Always select solutions that minimise hassles and will help deliver more value to customers.

Get better visibility of network status

When complexity increases due to greater connectivity on industrial networks, it can become very difficult to identify the root cause of problems and maintain sufficient network visibility.

Control engineers often must revert to trial and error to get the system back to normal, which is time-consuming and troublesome.

To facilitate and manage growing industrial networks, network operators need integrated network management software to make informed decisions throughout network deployment, maintenance, and diagnostics.

In addition, as systems continue to grow, it is important that you pay attention to several network integration concerns. First, only managing industrial networks in local control centres may not be feasible three or five years from now, especially when existing systems need to be integrated with new ones.

It is therefore important to use network management software with integration interfaces, such as OPC DA tags for SCADA system integration or RESTful APIs for external web services. Furthermore, an interface to facilitate third-party software integration is also a key criterion for ensuring future flexibility.

For many industries, the IIoT presents as many challenges as opportunities. It is this new frontier where traditional OT and IT silos converge is clearly the way of the future. Successfully deploying an IIoT application requires careful planning and attention to detail from the moment you decide to begin the journey.

The post Getting IIoT networks ready for the future appeared first on FutureIoT.

“While embedded security is not new for IoT, which have leveraged secure elements and integrated circuits for some time to offer secure storage of certificates and keys, it is the integration of high-performant hardware that is breaking through,” says Michela Menting, senior research director of trusted device solutions at ABI Research.

“Securing application execution, for example, through the use of trusted execution environment (TEE) technology, is in greater demand than ever for IoT devices; and not just for mission-critical or functional safety use cases, but also for general purpose use cases.”

Michela Menting

This is largely due to better technological developments from the semiconductor vendors themselves, with the adaptation of TEEs to microcontrollers. A greater competitive ecosystem is emerging, with incredible advances by companies like ARM for security in Cortex-M cores, but also from open-source movements such as RISC-V. 

While TEE shipments for SoCs continue to dominate at almost US$1 billion in 2023 (notably selling into the smartphone market), the growth rate remains at a stable 14% year-on-year, while shipments for TEE-enabled Microcontrollers are expected to triple in that same period. 

The post IoT ecosystem is driving demand for high-performance systems appeared first on FutureIoT.

CISA identifies 16 critical infrastructure sectors including chemical, commercial facilities, communications, critical manufacturing, dams, defence industrial base, emergency services, energy, financial services, food & agriculture, government facilities, healthcare and public health, information technology, nuclear reactors, transportation systems, and water and wastewater systems.

Friedhelm Best, vice president for APAC at HIMA, noted that within the industries the company operates in, every operator has an operation which has risk involved. "Within the oil & gas industry, the mining and processing of raw materials involves risks. A rail operator, who has an infrastructure for rail, with rolling stock, with rail track, there is some risk associated with that," he pointed out.

According to Best, the objective is to maintain risk at levels that are tolerable for people, assets and the environment. "Functional safety is specifically that part of risk management – beyond all of the mechanical and operational measures – can be achieved by an electrical or electronic system, is called safety integrated systems," he further elaborated.

He acknowledged that critical infrastructure typically involves significant investments carried out over decades. "These complex investments are not replaced as and when new technologies become available.

"Rather, changes have to wait for the next phase of modernisation, or when there is a test run of new technology. That’s why it seems like there is a lot of old technology," he continued.

He also noted that in some cases, changes only happen following regulators' call for system management evidence or data to bring.

Impact of COVID on critical infrastructure

Best recalls that historically safety-related automation was often performed onsite, meaning the operator or the manufacturer of the equipment has to send an engineer on site.

"However, with travel restrictions and health regulations during COVID, remote access was allowed in a secure way as there was a need for that to happen. Now this option will stay because they are more used to working with remote access," observed Best.

Responding to market forces

The world remains vulnerable to market forces. A case in point is the ongoing Russia-Ukraine war saw global energy prices increase 20% for five straight months. Rising energy prices may decrease social surplus, which in turn, would slow economic growth.

Best stressed that the world needs stable energy over the long run. Disruptions, be they man-made or natural forces some operators, particularly in directly affected markets, to run operations continually without shutting down the plant for any turnaround.

"They are now prolonging their operations for as long as possible but well aware that their equipment needs maintenance and repair, hence using technology such as predictive maintenance and other options to help them," he opined.

Responding to digital threats

The May 2021 attack on the Colonial Pipeline in the US, reveals just how vulnerable critical infrastructures are from digital threats.

"Digital threats are very real today and everyone who runs a critical infrastructure has to act now," acknowledged Best. "It (digital threats) should be treated the same way as how safety systems were implemented at the beginning when they build a plant – where they analyse and study the requirements and put measures in place."

He points out that with new threats emerging constantly, more proactive measures and investments must be put into this in Asia Pacific as organisations become more aware of the cost to them in terms of potential loss of production hours and damage to infrastructure.

New challenges ahead

Best identified the changing environment and changing market conditions as top of mind when considering the challenges facing operators of critical infrastructure. "In the past, you can build a plant and keep it running for 10 or 20 years. Today, size and design need to adapt to changes often, which affects safety systems. Hence, the management of change is more important now than ever," he continued.

The other challenge he was quick to point out is the constantly changing security threats coming from outside which are hard to predict.

Click on the link to watch the full VODChat with FutureIoT.

1. Describe operational and functional safety at plants and critical infrastructure in APAC.
2. Critical infrastructure usually means operational technologies that are decades old. Why is that?
3. How has COVID impacted how critical infrastructure operators go about their business?
4. How do you see critical infrastructure operators responding to market forces?
5. What is hampering the digitization/modernisation of critical infrastructure?
6. How are critical infrastructure operators in APAC responding to digital threats today?
7. What is the problem that HIMA is solving?
8. What is your advice to critical infrastructure operators as regards safety?
9. What are the challenges of critical infrastructure today as it relates to safety?

The post VODChat: Operational and functional safety in plants and critical infrastructures appeared first on FutureIoT.

But with this broader connectivity comes more entry points for potential attackers, and capital decision-makers depend on up-to-date cybersecurity threat information to properly prioritise asset replacement and manage asset requests.

Yet many still lack a comprehensive strategy for incorporating medical device risk reduction into capital planning, which is increasingly concerning as cyber threats—and healthcare-industry data breaches that now average more than US$10 million per incident—continue to rise.

Hospitals must consider cyber risk when evaluating equipment purchases, maintenance, and device lifecycle management—including risk assessment, monitoring, and remediation.

“As security threats against healthcare systems continue to escalate, understanding and prioritising the current risk profile of each piece of connected equipment is critical for healthcare systems to avoid the kind of attacks that are costly to budgets and reputation,” said Peter Hancock, VP of global partnerships at Asimily.

Asimily announced plans to integrate its Internet of Medical Things (IoMT) risk management platform, with the CCM (Capital Cycle Management) solution from HANDLE Global to provide a single platform where healthcare system supply chain, security, and IT teams gain a holistic and always-current view of their organisation’s internet-connected assets.

This equipment visibility enables healthcare organisations to determine which assets or manufacturers are at risk of cybersecurity issues, and to track the status of cyber-related warnings and recalls.

Asimily uses AI-fuelled analysis to prioritise exploitable vulnerabilities and prescribe targeted, clinically-viable remediations—and identify when remediations are not possible and which assets may need to be replaced.

This critical information is dispatched to CCM to ensure that it is considered a key priority during the capital planning process and can empower a shift from reactive to proactive cybersecurity risk management.

CCM allows health systems to tailor priorities based on customisable risk thresholds for threats to cybersecurity, patient safety, product standardisation, and other factors provided by Asimily’s IoMT risk remediation platform.

“This integration with Asimily gives HANDLE’s CCM customers the ability to understand cybersecurity risks and precisely measure utilisation so they feel confident that they are making well-informed decisions about where to focus their capital spend,” said Kyle Green, CEO, HANDLE Global. "This is especially crucial as health system budgets continue to tighten and healthcare leaders are forced to make difficult budgeting decisions."

The post Partnership to optimise healthcare capital cycle end-to-end appeared first on FutureIoT.

The AWK-3252A aims to optimise mobile automation and IP surveillance systems in mining, manufacturing, healthcare, transportation, and other industries, driving improved outcomes especially where Autonomous Guided Vehicles (AGVs) and Autonomous Mobile Robots (AMRs) are at the heart of boosting productivity and operational safety.

Capable of concurrent dual-band Wi-Fi, the Moxa AWK-3252A offers 802.11ac performance with DFS channel support, the latest WPA3 encryption for an additional layer of WLAN security, aggregated data rates up to 1.267 Gbps, and millisecond-level client-based Turbo Roaming for <150 ms recovery time between APs.

Two redundant DC power inputs increase the reliability of the power supply, and the AWK-3252A can be powered via PoE to facilitate flexible deployment. Combined, these features simplify industrial wireless operations and the integration of mobile systems outfitted with complex sensors and cameras, while ensuring high performance to address the requirements for reliable and futureproof systems.

The AWK-3252A is compliant with IEC 62443-4-2 and IEC 62443-4-1 industrial cybersecurity certifications -- which cover both product security and secure development life-cycle requirements -- helping system integrators meet the compliance requirements of secure industrial network design, resulting in lower development risk, time, and cost.

Built for demanding industrial use, the AWK-3252A is protected within a metal IP30-rated housing with DIN-Rail mounting or optional wall mounting. Integrated antenna isolation safeguards against external electrical interference.

For those installing network devices in hazardous locations, the AWK-3252A is certified for Class 1, Division 2 (C1D2) areas where the risk of explosion exists. An extended temperature version of the device is safe to use from -40 to 75°C to ensure smooth wireless communication in exceptionally harsh environments.

The post Moxa solution boosts transmission speeds in industrial networks appeared first on FutureIoT.

ABI Research estimates that the overall worldwide biometric device shipments fell from 4.1 million in 2019 to 3.4 million in 2021 and recovered slightly to 3.6 million in 2022.

With a CAGR of 11.3%, fingerprint recognition will expand from 1.7 million to 2.9 million shipments in 2022 and 2027 to claim the lion's share of the biometric modalities market. However, due to simplicity and the expanding use of liveness detection, facial recognition biometrics will experience the fastest growth over the same period, with a CAGR of 11.9%,” said Sam Gazeley, digital payment technologies analyst at ABI Research.

He went on to explain that in terms of biometric hardware technology shipment share, ID/Authentication will account for 64% of the BFSI market in 2023.

"This is partly because, aside from smartphone-centric biometric technologies, user registration and authentication are the key use cases for biometrics in the BFSI sector,” he added.

Getting worst before it gets better

Exacerbated by the increasing integration of biometrics in mobile banking apps and with more customers turning to mobile banking apps, several BFSI businesses are including biometric authentication methods like fingerprint and facial recognition in their solutions.

While this applies predominantly to the smartphone industry, the BFSI market's growing use of biometrics will encourage the deployment of biometric hardware in branches.

"The customer experience as it relates to the client authentication processes is being streamlined by deploying biometrics such as fingerprint and facial recognition, which improves the entire experience with BFSI services and combating fraud by eliminating the need for passwords,” explained Gazeley.

However, it is also important to remember that branchless banking is growing in popularity and will limit the accessible market for biometric hardware providers as we enter the forecast period, particularly regarding neo and challenger banks.

The post Biometric update expected to surge following drop during pandemic appeared first on FutureIoT.

This alliance will bring together Paessler’s expertise in IT network monitoring and PATLITE’s capability in operational technology (OT) to help enterprises across Southeast Asia accelerate digital transformation in OT.

“The convergence of IT and OT is proving to be a boon for enterprises, whether it is optimizing operations or gaining a competitive edge. However, siloed stacks of IT and OT can result in challenges that prevent organisations from reaping the full benefits of digital transformation at scale," said Jim Lee, business development manager of Paessler for Asia Pacific

He claimed that tje partnership with PATLITE is designed to help customers take a comprehensive and coordinated approach to monitor both IT and OT systems which will enable organisations to better understand their infrastructure, increase business agility and ultimately drive business growth.

The partnership will enable Paessler to combine its PRTG network monitoring solution with its extensive experience in OT to provide its customers with comprehensive visibility into their entire infrastructure.

Paessler's PRTG network monitoring solution is designed to help organisations monitor their IT infrastructure, which includes servers, switches, routers, and other devices, while PATLITE’s expertise in OT includes signalling devices, industrial network devices, and other products that can help organisations gain visibility into their operational infrastructure.

“We fully comprehend the significance of technology and expertise in driving successful transformation journeys for industrial businesses,” said Edmund Gan, general manager of PATLITE Singapore.

He added that the collaboration between PATLITE and Paessler will benefit all its customers with the simplified joint solutions, namely the PATLITE Network Tower Light and Paessler PRTG monitoring software.

He further noted that these solutions are easy to understand and facilitate improved productivity and comprehensive process understanding for our customers.

The alliance is said to help organisations across the Southeast Asia region achieve a holistic view of their entire infrastructure, enabling them to make better decisions and improve operational efficiency.

The post Partnership to accelerate digital transformation in OT appeared first on FutureIoT.

"Today's threat actors are like shape-shifting masters, continuously adapting their tactics to slip through the cracks of our interconnected network. With a cunning blend of evasion tools and camouflage methods, the bad actors have weaponized the threats,” says Steven Scheurmann, regional vice president for ASEAN at Palo Alto Networks.

"Threat actors have become adept at exploiting vulnerabilities, and by the time security researchers and software vendors close the door on one vulnerability, cybercriminals have already found the next door to creak open."

Steven Scheurmann

Organisations must, therefore, simultaneously guard against malware designed to exploit older vulnerabilities while proactively staying ahead of sophisticated new attacks," he added.

Some of the key findings from the report include:

The exploitation of vulnerabilities has increased: There was a 55% increase in vulnerability exploitation attempts, per customer, on average, compared to 2021.

PDFs are the most popular file type for delivering malware: PDFs are the primary malicious email attachment type, being used 66% of the time to deliver malware via email.

ChatGPT scams: Between November 2022-April 2023, Unit 42 saw a 910% increase in monthly registrations for domains, both benign and malicious, related to ChatGPT, in an attempt to mimic ChatGPT.

Malware aimed at industries using OT technology is increasing: The average number of malware attacks experienced per organisation in the manufacturing, utilities and energy industry increased by 238% (between 2021 and 2022).

Linux malware is on the rise, targeting cloud workload devices: An estimated 90% of public cloud instances run on Linux. Attackers seek new opportunities in cloud workloads and IoT devices running on Unix-like operating systems. The most common types of threats against Linux systems are botnets (47%), coinminers (21%) and backdoors (11%).

Cryptominer traffic is on the rise: Doubling in 2022, cryptomining continues to be an area of interest to threat actors, with 45% of sampled organisations having a signature trigger history that contains cryptominer-related traffic.

Newly Registered Domains: To avoid detection, threat actors use newly registered domains (NRDs) for phishing, social engineering and spreading malware. Threat actors are more likely to target people visiting adult websites (20.2%) and financial services (13.9%) sites with NRDs.

Evasive Threats will Continue to Become Increasingly Complex: While attackers' continued use of old vulnerabilities shows that they will reuse code as long as it proves lucrative, there comes a point where creating newer, more complex attack techniques is necessary. When basic evasions became popular and security vendors started detecting them, attackers responded by moving toward more advanced techniques.

Encrypted Malware in Traffic will Keep Increasing: 12.91% of malware traffic is already SSL encrypted. As threat actors adopt more tactics that mimic those of legitimate businesses, it's expected malware families using SSL-encrypted traffic to blend in with benign network traffic will continue growing.

"As millions of people use ChatGPT, it's unsurprising that we see ChatGPT-related scams, which have exploded over the past year, as cybercriminals take advantage of the hype around AI. But, the trusty email PDF is still the most common way cybercriminals deliver malware," says Sean Duca, VP and Regional Chief Security Officer at Palo Alto Networks.

"Cybercriminals, no doubt, are looking at how they can leverage it for their nefarious activities, but for now, simple social engineering will do just fine at tricking potential victims. Organisations must therefore take a holistic view of their security environment to provide comprehensive oversight of their network and ensure security best practices are followed at every level of the organisation."

Sean Duca

The post Malware targeting manufacturing, utilities and energy industry up 238% appeared first on FutureIoT.

This sharp increase, also supplemented by the increased use of IoT devices by consumers around the world, was first noticed at the beginning of the Russia-Ukraine conflict but has since spread to other parts of the world, with botnet-driven DDoS attacks being used to disrupt telecom networks as well as other critical infrastructure and services.

The number of IoT devices (bots) engaged in botnet-driven DDoS attacks rose from around 200,000 a year ago to approximately 1 million devices, generating more than 40% of all DDoS traffic today.

The most common malware in telecommunication networks was found to be a bot malware that scans vulnerable devices, a tactic associated with a variety of IoT botnets. There are billions of IoT devices worldwide, ranging from smart refrigerators, medical sensors, and smartwatches; many of which have lax security protections.

The report also found that the number of trojans targeting personal banking information in mobile devices has doubled to 9%, putting millions of users around the world at heightened risk of having their personal financial and credit card information stolen. A trojan is nefarious software code disguised as being safe for use.

The report, however, did find some encouraging news, showing that malware infections in home networks declined from a Covid-high of 3% to 1.5%, close to the pre-pandemic level of 1%, as malware campaigns targeting the wave of at-home workers tapered off, and more people returned to office work environments.

Based on data aggregated from monitoring network traffic on more than 200 million devices globally where Nokia NetGuard Endpoint Security product is deployed, the report underlines both the scale and sophistication of cybercriminal activity today.

Hamdy Farid, senior vice president for business applications at Nokia noted that a single botnet DDoS attack can involve hundreds of thousands of IoT devices, representing a significant threat to networks globally.

"To mitigate the risks, it’s essential that service providers, vendors, and regulators work to develop more robust 5G network security measures, including implementing telco-centric threat detection and response, as well as robust security practices and awareness at all company levels."

Hamdy Farid

The post Malicious IoT botnet activity up sharply appeared first on FutureIoT.

Radix IoT's chief product officer, Michael Skurla, claims Radix IoT’s Mango 5 is the future of effortless scalability for global commercial portfolio asset monitoring. "Without compromising flexibility, enterprises can now scale remote management and triage in half the time legacy monitoring solutions require. No other comparable product in today’s market offers this level of intuitive monitoring scalability and stability for critical facilities’ owners and operators,” he added.

Mango 5’s streamlined, automated workflow features include:

The Portfolio Manager Configuration Tool–transforms enterprise owners and operators into data experts,­ with instant set-up and views of globally distributed property portfolios with access to site-level metrics and device-level data without dashboards or complex tagging structures.

Integrators and end-users can instantly access KPI overviews and site-level historical graphs and maps with a drag-and-drop interface, create information tabs personalised to roles and needs, and make changes instantaneously without touching a line of code.

Pi-Link–expands on the highly popular TCP Publisher by simultaneously enabling events operations at the edge and in the cloud using gRPC. Scheduled events and logging at the edge are unhindered with lost connectivity to the cloud, and instantly re-synchronise with the cloud when reconnected.

This unparalleled resilience level, critical in environments with unstable or highly constrained cloud connectivity (e.g., over cellular, LoRaWAN, and satellite), increases Edge to Cloud security with mTLS certificates. Mango administration panel allows connection authentication with integrated setup and management–and the TCP Publisher is fully backwards compatible.

Pi-Mesh–this revolutionary database, designed specifically for storing and querying IoT data at scale–with 100 times faster query processing speed than the traditional database technology–is fully optimised for time-based data critical to most distributed SCADA and BMS (building management systems) solutions.

Whether Mango runs at the edge or in the cloud, it can handle tens of millions of data points in real-time and historical context. Compatible with Pi-Link, its rapid, small-size data and events transfer between locations reduces traffic while assuring constancy amidst outages.

Optimised for Mango data and long-term storage, Pi-Mesh takes up a fraction of the typical storage space required by traditional database solutions.

Pi-Flow–the reimagined Mango UI accommodates a highly intuitive workflow for commissioning and setup by integrators, contractors, and end-users. The redesign allows systems deployments to scale and change instantly–whether onboarding 100 or two million points of data–across one to tens of thousands of locations.

CSV Toolbox–brings new tools to streamline and automate with an escalated systems’ configuration ability. In addition to the JSON store, Mango 5 supports tooling for CSV importing/exporting from devices, tags, and events–enabling automated, at-scale operations with conversant tools contractors and enterprise customers are fully accustomed to.

Mango 5 enhances all Mango 4 features including alarming, event management, full HTML (desktop and mobile) compliance, native cloud capability (or cloud of choice)–scaling to tens of thousands of sites–with simple device integration across 40+ protocols without vendor lock. Best of all, upgrades from Mango 4 are simple to deploy.

The post Radix IoT Mango 5 optimises IoT scalability for mission-critical monitoring appeared first on FutureIoT.

Radiflow claims to solve this problem with the release of CIARA 4.0 – a data-driven platform that continuously monitors changes in the site topology as well as vulnerabilities and threats. It constantly re-evaluates the risk posture of facilities and their digital components. This continuous monitoring enables the CISO to review the strategic and tactical OT security plans and adapt them if needed.

To further assist the CISO with the evaluation of their risk posture, Radiflow is introducing a new free-to-use cloud benchmark tool. Utilising collected industry-specific benchmark information based on Radiflow’s experience and enriched with CS2AI surveys, the new benchmark tool provides the user with a quick risk posture assessment compared to the industry status and best practices.

“CISOs are under enormous pressure to do more with less, making it challenging to understand their current standing across the OT Cybersecurity landscape,” said Ilan Barda, Radiflow CEO, and Co-founder. “Data-driven CIARA 4.0 automates the delivery of the necessary insights concerning the changes in the risk posture that actually direct users toward optimal security actions.”

At the same time that threat actors are getting more sophisticated, and vulnerabilities are becoming more diverse, national and industrial regulatory bodies are tightening cybersecurity regulations. But these are often highly complicated and challenging.

For example, while the widely accepted IEC62443 international series of standards provides a detailed map of security controls, it is often too complex for companies to understand and implement.

For these situations, CIARA 4.0 delivers a view of Best Practices of Security Controls which are simpler to understand and map better to the planning of security projects in an individual factory or across a sprawling, geographically diverse complex of interlinked facilities.

“A centralised, highly intelligent solution that enables OT cybersecurity teams to identify vulnerabilities and stay up to date with industry standards and/or best practices, while prioritising and evaluating mitigation efforts, slashes the investment in time and effort required to conduct secure operations,” explained Michael Langer, Radiflow’s chief product officer.

He added that with the accelerating pace of so many new devices being interconnected via expanding OT networks alongside decades of legacy versions, CIARA 4.0’s ability to automate accurate risk analyses and furnish actionable insights becomes vital for ensuring zero downtime.

The post CIARA 4.0 to simplify OT risk management appeared first on FutureIoT.

The OMDIA survey of 250 senior technology leaders in North Asia revealed that 32% of firms have seen an increase in cyber-attacks over the past 12 months across their entire IT stack, most notably endpoints, network, and operational technology devices. Also, 66% of those that experienced significantly increased serious security incidents also observed a surge in serious breaches.

The research also revealed that 40% of firms lost revenue due to these attacks, whilst 38% suffered reputational damage and 34% sustained operational downtime. However, security leaders are confident that with better security automation, they could reduce nearly 50% of all serious security incidents.

The research found that only 24% of regional organisations are advanced in leveraging security automation, confirming that the rate of security automation is relatively low in North Asia, with limited use across the region.

Adam Etherington, a senior principal analyst for digital enterprise services at OMDIA, says security is becoming a growing concern and a potential constraint to digital ambitions in the region. He stressed that security automation is vital to address this challenge.

"Leveraging automation in SecOps can enrich threat telemetry, unify toolsets, and harness AI/ML advancements to better protect, detect and respond to advanced persistent threats. However, technology alone won't solve the problem."

Adam Etherington

"Third-party expertise is critical to address people, process and tool impacts within each firm's industry context, regulatory requirements, and corporate objectives,” he continued.

Toolset sprawl

Although many organisations are investing in additional cybersecurity platforms to overcome rising incidents and breaches, this has resulted in sprawling toolsets that generate a higher volume of alerts and false positives.

The survey found that a large volume of threat alerts, alarms, tickets, and possible incidents generated by various security tools are causing issues for security professionals.

The false positives overwhelming security teams are caused by a dramatic increase in the attack surface as more operational technology (OT) devices become integrated with IT systems, lagging patch and device management across legacy technologies and a wide variety of non-integrated toolsets.

“Security executives must continually assess their organisational cybersecurity resilience to support ongoing digital transformation, leverage the right cyber partner and unlock value from security tools. Reaching optimised automation can be a long journey."

Paul Abfalter

"It is important to work with experienced and trusted specialists to discover the best adoption and operational model for your organisation,” Abfalter added.

The post Low rate of security automation in North Asia appeared first on FutureIoT.

Additionally, owing to the locations where most industrial facilities are built, remote access to OT assets and operations is all but mandatory. The TakePoint Research report, The State of Industrial Secure Remote Access, states that remote access is now a universal and fundamental requirement for most industrial enterprises.

The same report, however, noted that ensuring all access is safe and secure and cannot be exploited or abused by malicious actors, whether external or internal, remains a challenge.

The report concludes that industrial secure remote access (I-SRA) strategies have become a critical building block for every OT environment. The report recommends that securing remote access and building an overall cybersecurity strategy should be approached like any other business decision, with advantages and associated risks that must be reviewed.

The report cautions that many challenges around people, technologies, and processes need to be considered and that these will likely vary between and within industries. It also recommends that organisations begin by identifying their operational objectives and risk appetite to develop an appropriate strategy.

"A diverse, multidisciplinary approach will help organizations align with various stakeholders and expectations while successfully deploying and securing remote access to industrial environments."

TakePoint Research

The sponsor of the report, Cyclo, picked three key findings:

1. Third-party access is the top reason for enabling I-SRA

Across all industries, 72% of respondents ranked third-party access as the number-one reason for securing remote access.

"This isn’t too surprising, as OT environments tend to depend heavily on third parties due to a significant skills gap, original equipment manufacturer (OEM) maintenance requirements, and risk mitigation, among other factors," said Kevin Kumpf, chief OT/ICS security strategist at Cyclo.

2. I-SRA is not just a “big company” problem

The TakePoint report reveals a linear relationship between company size and the sheer volume of remote connections: the bigger the company, the more connections (see Figure 1).

Kumpf acknowledged that larger companies may have a larger attack surface to secure, but they are also more likely to have teams robust enough to do so. "In contrast, small companies may lack the budget, headcount, and experience necessary to adequately defend their systems," he added.

Figure 1: Concern about remote access threats to OT/ICS systems

3. Across all industries, concerns outweigh confidence

Kumpf says the most striking finding of the survey is that across all industries, respondents were more concerned about threats than confident in their current I-SRA solutions. "A common practice is to give teams remote access to critical systems because operations depend on it. However, that access is far less secure than these organisations would like them to be," he noted.

Figure 1: Concern about access risks vs confidence in current solutions

Kumpf opined that industrial settings have built brittle workarounds for securing remote access, like firewalls and virtual private networks (VPNs), and have sought to implement frameworks like NIST 800-82 or ISA/IEC62443.

"Still, they recognise that the problem is not solved," commented Kumpf who wrote that VPNs struggle to scale and cannot cover the full range of OT use cases.

"Due to a lack of SRA solutions built specifically for OT, there’s a frequent need to rely on tools designed for IT. These are far from ideal because they often require a cloud connection, need regular patching that requires downtime, or interrupt sensitive OT processes."

Kevin Kumpf

The post Secure remote access: awareness is high, confidence is low appeared first on FutureIoT.

Gartner Digs Deeper. A new Magic Quadrant for Managed IoT Connectivity Services report published on January 30, ranked 19 managed IoT connectivity service providers.

IoT and Security?  There is a lack of understanding of IoT security best practices and the need for a comprehensive security approach for devices, communications infrastructure, and applications.

New this past year were enterprises looking for providers with leadership, with a robust and diverse ecosystem of technology alliances and service delivery partnerships, spanning IT, OT and IoT. These leaders also had the size and scale in their operations, sales and marketing, formal bid, and product management to pursue large multinational opportunities for IoT connectivity.

Maybe you don’t need a leader?  An IoT-enabled business can use this analysis to select a provider that delivers enough critical functions to match its business objectives.

I&O leaders must insert themselves into the process of solution and vendor selection to determine whether providers of managed IoT connectivity services can provide a pre-integrated IoT solution. This strategy will ensure the cost-effectiveness and security of these solutions, as well as potentially reduce the opportunity costs of due diligence.

Major IoT market forces at work will continue in 2023.

While some enterprises interoperate IoT together with OT, Gartner sees many others bouncing among invisible silos within operating units and regional business units. Not an effective or efficient approach. Play nicer in the sandbox.

Inflation? Not. Gartner has observed price reductions of 10% to 15% in some regions and for certain connectivity types.

On the technical side, 3GPP LPWA network connections (NB-IoT, LTE-M) doubled since last year, reaching 20 million. Why important?  Managed IoT connectivity is a bridge to 5G, Private Mobile Networks and Edge Computing.

Effective IoT implementation and management require stronger security. Enterprises the analysts are talking to admit they struggle with security risks to their network and ecosystems.

First published on Gartner Blog Network

The post IoT red flags kickstart 2023 appeared first on FutureIoT.

A 650 Group report posits that the Observability market grew by 60% in 2022 and that cloud and subscription-based offerings are predicted to be most of the revenue during the forecast period as enterprises move to hybrid and multi-cloud infrastructure.

The Deep Observability Market is a critical growth component for Observability Infrastructure vendors, as enterprises need to extract a significant amount of data from networks beyond logs to secure and automate their infrastructure.

“Operation teams, such as SecOps, NetOps, and CloudOps, are key beneficiaries of Deep Observability. These teams stress the importance of being proactive and less reactive to application performance, vulnerability detection, and issues in their production networks,” said Alan Weckel, founder and technology analyst at 650 Group.

“Deep Observability continues to add additional value-add features like decryption, application filtering, application metadata, and deduplication. Over the forecast years, this will help drive networking automation and AI-based networks.”

Alan Weckel

The post Logs are not enough to secure the network infrastructure appeared first on FutureIoT.

“The strict separation between general-purpose and payment HSMs is dissolving quickly,” explains Michela Menting, a cybersecurity applications research director at ABI Research.

“In their latest flagships, many HSM original equipment manufacturers opt to provide just one converged hardware platform tailored to the applications through software packages.”

Michela Menting

Market-making opportunity

Most HSM OEMs seek to provide all the necessary certifications (FIPS 140-3, PCI PTS HSM v2, and increasingly CC+ EAL) as a baseline for that converged hardware. The differentiation becomes a software and licensing matter that can be easily modified and configured remotely, enabling users to service new applications as their business evolves.

This malleability from a software perspective is key to unlocking the potential of the service-based HSM opportunity, whether managed or hosted (HSM-as-a-Service). Both for enterprise users and managed service providers, it allows for repurposing the HSM for other applications without purchasing new hardware.

With advanced hardware capabilities for multi-tenancy and virtualisation, HSMs can offer greater multi-usage performance. ABI Research forecasts service-based revenue to reach US$229 million globally by 2027. 

“Better understanding by enterprises of the need to leverage trusted services for their cloud migration and digital transformation is a significant driver for HSM applications, with OEMs targeting new markets and use cases not only in the enterprise (SMBs) but also in manufacturing, automotive, telco, and utilities. The HSM market is constantly evolving and ripe for innovation,” concluded Menting.

Competitive landscape

Top HSM OEMs in the space include Crypto4A, Entrust, Futurex, IBM, Kryptus, Marvell, Sansec, Securosys, Thales, and Utimaco.

The post HSM convergence creates a service-based market appeared first on FutureIoT.

The security hardware market is at an inflexion point, where real-time functional safety requirements from the microcontroller space are converging with trusted computing base and secure execution environments capabilities popular in SoC applications.

“A richness in security IP offerings on the market is enabling plenty of use cases for leveraging a trusted hardware foundation in IoT edge, with chipset manufacturers able to offer features such as advanced high assurance boot, hardware firewall domains, run-time attestation, and secure enclaves,” explains Michela Menting, research director at ABI Research.

She opines that most importantly, these capabilities allow building secure edge devices that can run trusted applications and securely communicate over networks to various front and backend services.

There is a democratization of the building blocks for designing secure edge devices: greater availability, more choice, better pricing, and improved functionality. Many security capabilities used to be offered to distinctive markets almost exclusively (microcontroller vs. CPU).

Still, a convergence in the space, driven by the demand for creating trusted applications in a myriad of IoT use cases, is breaking down those barriers. Demand for secure processors spans automotive, industrial, retail, logistics, healthcare, and consumer.

With heavyweights from the processor computing space like Intel, AMD, and TI to smartphone chipmakers including Qualcomm, MediaTek, and Samsung, and microcontroller leaders such as Microchip, NXP, Renesas, and STM, the market for secure processors for the IoT edge is vibrant and highly competitive, all offering innovative and highly performant technology solutions that can meet the modern demands of the IoT edge.

The post New opportunities for processor security applications using IoT Edge appeared first on FutureIoT.

The E7515R expands Keysight’s 5G Network Emulation Solutions portfolio, the industry’s most robust, which is used in mobile device validation across the workflow, from early design to acceptance and deployment.

The 5G RedCap specification introduces support for wireless devices with reduced 5G capabilities. These devices are less complex, and consume less power, allowing them to address new CIoT use cases such as industrial sensors and wearables such as smartwatches.

Like other cellular devices, RedCap devices require time-consuming and expensive certification from accredited labs before they can be released to the market. By performing lab validation ahead of time to identify and correct design issues, device and module manufacturers can shorten the certification process for RedCap and other CIoT devices.

The Keysight E7515R addresses this need as a network emulation test platform designed specifically for 5G RedCap and supporting all CIoT technologies. The solution features streamlined capabilities for RedCap without the additional features needed to test a full-spec 5G device.

Benefits of E7515R solution

• Specifically built for RedCap and CIoT: The E7515R supports 5G Release 17 RedCap along with legacy CIoT technologies, including Narrowband IoT (NB-IoT), LTE Category M, and LTE Cat-1bis.
• Integrated Platform: The E7515R is a complete solution offering RF, protocol, functional, and performance testing in a compact footprint.
• Built on Keysight’s Proven Technology: The E7515R is built on the same architecture as the market-leading 5G Network Emulation Solutions platform. The E7515R uses the same proven software solutions employed by the 5G Network Emulation Solutions platform, providing workflow consistency and reduced learning curves.
• End-to-End Solution: The E7515R supports the entire RedCap and CIoT device development workflow, from early design and development through acceptance and certification testing, and deployment.

 The release of the E7515R solution builds on Keysight’s ongoing achievements supporting RedCap device development, including establishing a data call using the 5G RedCap specification. Through this demonstration, Keysight’s 5G Network Emulation Solutions validated RedCap connectivity on a 5G chipset.

Mosaab Abughalib, general manager of Keysight’s wireless device development R&D group, said: “The E7515R solution is optimised for the development of devices that do not require full 5G NR capability, which allows our customers to maximize their return on investment.”

The post New solution facilitates mobile device validation across the workflow appeared first on FutureIoT.

To help companies keep their OT environments secure, Palo Alto Networks launched what it claims is the most comprehensive Zero Trust OT Security solution.

A key component of the solution is the new cloud-delivered Industrial OT Security service, which can be easily enabled — without the need to install additional sensors — by any of the 61,000+ active customers of Palo Alto Networks network security products: hardware and software Next-Generation Firewalls (NGFW) and Prisma SASE. Built on an AI-powered foundation with ease of deployment in mind, the new solution enables customers to secure their OT environments from the most sophisticated threats while simplifying their operations.

The challenges around security OT

OT devices can be hard to secure because many lack built-in security and were not designed to be patched. In addition, high uptime requirements limit the ability to do regular security maintenance. OT environments are also at risk as organisations adopt new technologies like 5G, which enable mass connectivity, and open up remote access.

“Most OT security solutions in the market fall short because they can’t identify all the assets and can only alert but don’t prevent threats. This leads to a patchwork of siloed security technologies, which can lead to security gaps,” said Anand Oswal, SVP for network security at Palo Alto Networks. “Our OT Security solution is designed to help organisations stay secure through granular visibility and effective inline security while meeting their availability and uptime requirements.”

Implementation

Using the industry’s first ML-powered OT visibility engine, the Industrial OT Security service recognises hundreds of unique OT device profiles, and over 1,000 OT/Industrial Control System (ICS) applications, and has hundreds of distinct OT threat signatures to help protect these hard-to-secure assets.

“As industrial OT systems and IT systems become more interconnected, so does the size of the attack surface available to the adversary. Defending against increasingly sophisticated threats requires expanded security strategies that can provide visibility, context, and Zero Trust capabilities across both OT and IT networks, devices, applications, and users,” said Dave Gruber, principal analyst, Enterprise Strategy Group. “The Palo Alto Networks solution embraces this unified security model, promising to help protect complex OT environments.”

A notable feature of the service is its ability to help security teams proactively understand risk and apply controls. It continuously observes, categorises, and visualizes asset behaviour so anomalies can be discovered immediately and addressed with a firewall policy.

“Manufacturing has come into the crosshairs of many recent cyberattacks. Palo Alto Networks Industrial OT Security is a must-have to ensure security best practices are in place,” said Jared Mendenhall, director of information security at Impossible Foods. “We look forward to Palo Alto Networks’ dedicated OT Security solution to help us further secure our manufacturing plant, and remote operations, and realise our broader Zero Trust vision.”

Palo Alto Networks’ Zero Trust OT Security solution secures multiple OT use cases with consistent Zero Trust policies, all managed centrally:

• OT assets and networks using Palo Alto Networks NGFWs, along with the new Industrial OT Security service.
• Remote access using Prisma SASE.
• 5G-connected devices using NGFWs with Palo Alto Networks 5G-Native Security.

The post Palo Alto Networks simplifies OT security appeared first on FutureIoT.

Frost & Sullivan’s Sensor Technologies Impacting the Physical and Digital Security Market predicts that by 2025, there will be a significant increase in the use of contactless sensing technologies for physical and digital security applications, including cameras, LiDAR, and terahertz (THz) image sensing.

Critical assets like personal identity and biometrics are protected by security sensors integrated with other emerging sensor technologies, like LiDAR and THz.

“Sensor technologies, drones, robotics, and internet of things (IoT)-enabled devices will fuel the adoption of security systems, offering safety and security advantages,” said Varun Babu, TechVision industry analyst at Frost & Sullivan.

“Additionally, security sensors integrated with other emerging sensor technologies, such as LiDAR and THz sensors, provide highly safe and sophisticated security to critical assets like personal identity and biometrics.” Varun Babu

He added that sensor technology providers must work closely with security software solution providers to build a robust, user-friendly security management system.

“Further, they should build strong partnerships and jointly develop video surveillance management systems to overcome internal technology development barriers in the next two or three years,” he predicted.

Opportunities ahead

Frost outlines vertical markets that are wide open to the adoption of sensors, particularly in security applications such as:

Artificial Intelligence (AI): With AI, security professionals can pre-emptively spot defective equipment like security cameras and analyze alarms from defective devices. It helps lower the chances of cyberattacks.

Machine learning (ML): Physical and digital security manufacturers and service providers can create security and video monitoring systems that dynamically notify users of abnormal activity using ML.

Robotics and drones: Mobile drone surveillance can monitor criminals on the road and help avoid or reduce deadly pursuits. Drones are also safer and offer a significant investment return over traditional surveillance.

The post Frost predicts significant use of contactless sensing tech appeared first on FutureIoT.

They are also prioritising sustainability and resiliency in their operations, driving the need for greater visibility across their environments. The distributed nature of these operations makes networks complex to manage, and as these industries digitise their assets, the cybersecurity attack surface grows.

"The most effective way to manage growing complexity and provide more insight into business operations is through reliable connectivity and complete visibility across an organisation's operations and assets," said Vikas Butaney, SVP/GM, SD-WAN, Cloud Connectivity, and Industrial IoT Networking, Cisco.

ThousandEyes to simplify IT data intelligence

Having the relevant data at the right time is necessary to optimise users' digital experiences, but data may not always be easy to collect and correlate. To help customers tackle this challenge, Cisco ThousandEyes now supports OpenTelemetry, the open-source framework and industry standard that partners, customers, and providers rely on to generate, collect, process and export cloud-native and distributed telemetry data.

As the first network visibility solution to support OpenTelemetry, ThousandEyes is making it possible for customers to interconnect cloud and internet intelligence across a wide range of solutions for unmatched data correlation and insight. With ThousandEyes for OpenTelemetry, Cisco is enabling true end-to-end correlated insights across disparate domains, from user to application, for optimal digital experiences.

New Cisco offering

Cisco is introducing new cloud services in its IoT Operations Dashboard to increase industrial asset visibility and securely manage assets from anywhere.

Cisco Cyber Vision is now integrated with Cisco IoT Operations Dashboard to grant IT and operations teams full visibility into IT and OT devices to manage threats across the organisation, providing a unified security posture across the entire network.

Secure Equipment Access Plus makes it easier for IT and OT teams to remotely deploy, manage and troubleshoot connected equipment. This service now provides access to any connected equipment with IP connectivity, so operations teams can run native applications on their workstations to access remote assets more easily.

These innovations, along with Cisco's extension of the portfolio of its Catalyst industrial wireless and switching portfolio, provide more common tooling and data so IT and OT teams can work more efficiently together to reduce downtime of critical infrastructure, drive greater business productivity and efficiencies, and enhance overall safety and security.

The post Cisco ThousandEyes to support OpenTelemetry appeared first on FutureIoT.

Perhaps this was the thinking behind computer scientist Kevin Ashton, then working at Procter & Gamble, when he proposed putting radio-frequency identification (RFID) chips on products to track them through a supply chain.

That was 1999. Fast-forward to 2023, IoT devices and sensors are expanding their influence from the production floors of manufacturers to warehouses all the way to retail shelves, and homes. Most remain designed for a specific, single purpose, their value now extends from innocuous public lights to critical systems that power cities.

The recent cyberattacks against public organisations, such as healthcare, and critical infrastructure like power and utilities, reveal the extent to which organisations need to enhance the security of these facilities while at the same time responding to business and consumer demands for faster, better, and more reliable service.

Can you have your cake and eat it too? How do you merge the unwieldy world of IoT with the controlled, predictable environment that IT is built upon? And do so while delivering it securely, faster and cheaper?

The IoT conundrum for the CIO and IT

Dee Dee Pare, senior marketing manager at CradlePoint says “the cloud is the de facto way that everyone delivers applications and stores data.” She points out that applications work as if they are next door. In contrast, IoT is messy, outdoors, usually at a larger scale, is distributed, and is found in environments where things just don’t operate (in a predictable fashion).

“IoT is not necessarily the most clean-cut way of doing things,” she added.

She hints that edge computing may be just the answer for IoT – “by having a lightweight version of your application, you can bring this closer to wherever the IoT device is,” she explained. “That way you minimise latency, also filter out some of the unnecessary traffic that goes back to the cloud (presumably saving bandwidth and data storage).

She called the increasing popularity of using containers, a self-contained application, inside a router.

“What you have is a low-footprint device closer to the IoT Edge. You only have one device to manage, figure out how to power it. Everything happens very quickly within the router, you have the connections back to the cloud,” she elaborated.

The other benefit is business continuity. “If the cloud goes down, the router with the containerised application can continue to work with the IoT devices connected to it. When the network comes back up, the router can send the necessary traffic back to the host,” she added.

Critical components of an edge strategy

What would be the critical components to developing an edge strategy that involves IoT, Pare suggested calling the containerised application running inside a router a “customer edge”. She then goes on to comment there are other edges.

She referred to Amazon Web Services as an example of the Internet edge. These tend to be distributed (in the cloud) and have more processing capability. She cautioned that by its design (in the cloud), the Internet edge will be further away from the devices – hence some latency can be expected.

The other edge is the 5G edge. “You can set up an edge in the cell tower as well – as some carriers are doing. That way you can improve and enhance performance as it goes out for the application and out from the cell tower,” she added.

Conceding that the customer edge provides the ‘most bells and whistles’, she advised anyone developing an edge strategy to keep in mind where the edge is located. “It is about balancing between the placement, the quantity of data processing, the latency from the application to the IoT devices, as well as how much you need to customise,” she elaborated.

Getting IT started with edge technology

Asked how easy it would be for traditional IT teams to build these applications around the edge, Pare noted that the challenge lies in developing lightweight versions of current applications. Pulling examples from within, she noted that among managed service provider partners, developing lightweight applications is their value-add.

She cited a partner in the US that developed an application for car wash operators. Running off a CradlePoint router, the solution ran the point of sales, the surveillance cameras, as well as the automated car wash machinery. An entire running on one router.

Getting IoT/OT to work with IT

Pare says IT needs to collaborate with the operational technology (OT) team. In the converging world of IT and OT, it is not feasible to manage each technology in a vacuum. She acknowledged that IT, throughout most of its history, has worked in predictable environments and therefore may not be ready for what she described as the ‘messy world of OT’.

“OT tends to work with machinery that is not the latest technology. In some cases, these types of machinery cannot be updated. OT needs to educate IT on these projects,” she added.

She conceded that the mixing of IT and OT will blur as the two start working together. But ultimately, she believed IT will own a little bit more of the onus because they have to understand it end-to-end.

“They (IT) must make sure things such as security are in place end-to-end, and they are ultimately responsible for that. There are several scenarios where the end-to-end fits a bit more cleanly in the IT side, but they can't do it without the help of the OT side, because OT knows the reality of what's happening on the ground."

Dee Dee Pare

The post Supercharging IoT with edge computing appeared first on FutureIoT.

Total smart home services revenue for 2022 reached US$32.7 billion, up 2% over 2021, well below the more than 20% growth rate in the penetration of smart home capabilities in homes around the world over the same period.

Smart home services encompass whole home system design, installation, and management down to extended online storage for video from a home camera. It is a market that competes with free offerings delivered and underwritten by some of the largest technology players in the world, including Amazon, Apple, Google, and Samsung.

Smart home services opportunities

The service revenue opportunity is limited by free or freemium services typically tied to the price of smart home hardware, rather than a separate services revenue stream. However, there remains strong potential for those smart home providers able to show real value in their subscription services over and above what can be gained in the freemium market.

“Home security is an application that has shown resilience during earlier recessions. Those smart home services players with security integrations table to deliver peace of mind as well as whole home functionality, are well placed to defend and even grow their subscription capabilities – even in a tight consumer spending market,” says Jonathan Collins, smart homes and buildings research director at ABI Research.

Security is not the only opportunity. In a time of rising energy costs and concern especially in Europe, energy management is another area where smart home players can stress the potential to ease consumer utility bills.

“However, players must ensure their systems continue to evolve to deliver the functionality, security, privacy, or integrations with a host of applications that will support subscription spending,” concludes Collins.

The post Opportunities for smart home service revenue appeared first on FutureIoT.

If you said no, it’s probably because when it comes to mitigating cyber threats, most people talk about it in the context of protecting IT assets such as the systems, data, applications, and networks that organisations depend on every day to keep the business operating.

Whilst IT assets are important, OT is a whole other realm of digital infrastructure that also needs protecting and its growing, importance, and potential vulnerability all the time. That’s why understanding and testing an organisation’s Operational Technology security is so important.

Keeping the lights on

We take it for granted that we can just flip a switch to get a light and turn on a tap to get water. But the infrastructure that makes these things possible is extremely complex and it requires significant digital capability.

For example, to meet the cycles of consumer demand for electricity, a power grid must create exactly the amount of electricity that is being used at any given moment. This means the grid’s power generation and transmission lines must constantly adjust to meet demand wherever and whenever it is needed.

Managing this electrical cycle of demand is made possible because of the electrical utilities’ OT systems. The real-time control and influence these systems have on our day-to-day lives only amplify the need for strong OT security.

Many Asia Pacific countries have legislation to protect their critical infrastructure from cyber threats, including in Australia, where the recent revisions to the Security Legislation Amendment (Critical Infrastructure) Act 2021 represents the Australian Government’s response to the growing cyber threats faced by critical infrastructure organisations.

In Singapore, the Cybersecurity Act was introduced in August 2018 however last year the Cyber Security Agency of Singapore (CSAS) announced it was reviewing the Act to improve Singapore’s cybersecurity posture and support its digital economy.

The Agency also announced it was updating the Cybersecurity Code of Practice (CCoP) for the 11 Critical Information Infrastructure (CII) sectors to better deal with new and emerging threats. The Cyber Security Act had initially focused on the CIIs, which support the delivery of essential services such as water and power.

OT systems — often referred to as Industrial Control Systems, or ICS — are also increasingly prevalent in industrial and manufacturing environments, as we’ve put robots on our assembly lines and stuck chips in virtually every piece of equipment we deploy.

So, while we might at first think of the so-called “Internet of Things” (IoT) in terms of our smart homes and our cars, a large percentage of the world’s estimated 11.5 billion chip-enabled devices are in OT infrastructure.

Operational technology-related risk

The risks associated with critical OT infrastructure are obvious. We’ve seen them in the movies (e.g., Die Hard 4) and in real life (e.g., Ukraine in 2015) but as we implement more OT, our threat surface keeps growing. And as we add more features and functionality to our OT control systems, system complexity adds to our cybersecurity challenge.

Global tensions also increase our OT-related risk, since critical infrastructure is an attractive target for state actors seeking to do harm. However, OT infrastructure is also an attractive target for ransomware attacks—since it could potentially allow cybercriminals to hold vital services hostage.

Utility companies and other operators of critical infrastructure are aware of this risk, so they tightly control access to their OT systems. OT networks are also typically kept separate from IT networks and are not connected to the public internet.

This air gapping obviously poses a significant obstacle to any would-be attacker. However, there are growing caveats to this idea of air gapping. As operators of OT infrastructure get more aggressive about leveraging the intelligence of their OT networks, they increasingly need to tap into those networks via wired or wireless connections using fixed or mobile computing devices. That connectivity — as secure as operators may hope it is — often creates potential points of exposure to an extremely skilled and dedicated hacker.

Security testing is key to OT integrity

The importance of testing cannot be more underscored than in OT. If your organisation has OT infrastructure, it is important to engage the services of a qualified penetration testing (pentesting) team to independently validate your cybersecurity posture on a regular basis.

Before working with a pentesting partner, it is important to ask questions about the team’s previous OT experience, any OT certifications they hold, and the types of industries they have OT experience (e.g., water infrastructure is different from energy infrastructure).

Pentesting and adversarial testing will help you gain both confidence and a deeper understanding of the integrity of your IT and OT infrastructure. In the worst-case scenario, when security vulnerabilities in your IT or OT infrastructure are found, you will have the time to mitigate and take the necessary steps to prevent a threat actor from leveraging those vulnerabilities.

A proactive approach to security allows you to take an important step in protecting your organisation — as well as the customers you serve – from the serious consequences that would come from a breach of your OT infrastructure.

Just as our businesses and our personal lives have become increasingly digital, so has the infrastructure on which we all depend every day. It is only when our access to these services becomes disrupted that we realise how much we rely on them. Like our health, maintaining it should not be put off or ignored until it is too late.

The post Why OT is the other digital infrastructure that needs protecting appeared first on FutureIoT.

The report, Border Security Technologies: Emerging Trends, Key Opportunities & Market Forecasts 2022‑2027, predicts that rising levels of international travel and greater passenger flow will drive the adoption of eGates, as a more efficient means of border control than manual processes.

Juniper Research forecasts that eGate hardware revenue will exceed US$490 million by 2027; up from US$207 million in 2023.

Rise in travel to drive adoption of eGates

Juniper Research predicts airports will be looking to implement efficient border control solutions to help manage increasing passenger flows, as international travel continues rebounding following the lifting of COVID-19-related travel restrictions.

Research author Jordan Rookes explained: “More international travel is placing increased stress on border control operations, with many airports unable to effectively manage the complexities associated with heightened passenger flow.

Accordingly, vendors must highlight their solutions’ ability to efficiently and reliably process a continuous flow of passengers when marketing their products.”

Regulation to drive growth in Europe

The research predicts that regulation, particularly within the EU, will drive the adoption of eGates, with the value of eGate hardware revenue across Europe set to account for 35% of the global total by 2027.

The EU has enacted regulations to improve the efficiency of border controls at the external borders of the Schengen area (the area in which 27 European countries have abolished border control measures across their mutual borders allowing free movement of people) by creating a centralised EES (Entry/Exit System) that leverages eGates.

This is available for use by non-EU nationals entering the EU. The research urges vendors to leverage advanced biometric and document capture technologies to meet the demands of border security, with success measured by efficiency, reliability and accuracy of passenger identification.

The post eGates pickups on travel resurgence appeared first on FutureIoT.

While the forecasted total available market has contracted, especially in the smart home, retail, advertising, and supply chain spaces, secure MCU shipments will only be temporarily adversely affected. ABI Research forecasts the secure microcontrollers market will grow to US$2.2 billion by 2026.

ABI Research’s trusted device solutions research director, Michela Menting, attributes this to the niche nature of security demand which commands a higher value proposition.

He predicts that in the short term, supply chain issues due to trade embargoes and pandemic quarantines at manufacturing sites will affect availability.

“Demand for security, especially in general purpose microcontrollers, will ensure the secure MCU market continues to be a high priority for device OEMs,” he continued.

Strong market demand will stem from utilities and industrial IoT and smart cities and buildings, notably for MCUs with Trusted Execution Technologies that can securely run mission-critical and highly-sensitive applications at the edge.

Opportunities driving secure MCUs

Several opportunities will continue to drive demand for secure MCUs. On the one hand, a growing body of policy and regulation supports secure semiconductor investment, including a range of EU and U.S. tools such as the EU Cybersecurity Certification Framework, the EU Cyber Resilience Act, and the EU Chips and the U.S. CHIPS and Science Act.

On the other hand, the demand for secure IoT lifecycle management capabilities, from provisioning and onboarding for cloud and network services to OTA firmware updates and patching, means security IP choice for MCUs become primary product differentiators in an increasingly competitive market.

Competitive landscape

The secure MCU market is responding to this continued demand. An increasing number of semiconductors have launched numerous new products in the last two years, catering to various IoT device types and use case scenarios. These include Renesas (RA), NXP (i.MX), STMicroelectronics (STM32), Microchip (SAM), Infineon/Cypress (PSoC), among many others.

The market has coalesced around Arm Cortex processors, in part due to the rich security IP available with TrustZone. Still, there is growing competition from the secure RISC-V movement, directly challenging Arm’s dominance in the space.

The post Drivers of secure MCU through 2026 appeared first on FutureIoT.

The Deloitte report, 2023 manufacturing industry outlook, predicts that manufacturers will likely continue progressing toward smart factory transformations, as these initiatives drive future competitiveness.

Many manufacturers are making investments in laying the technology foundation for their smart factories. One in five manufacturers is already experimenting with underlying solutions or actively developing a metaverse platform for their products and services.

Trends influencing ASEAN’s manufacturers

According to Euromonitor International’s Voice of the Industry: Digital survey, around 62% of companies globally plan to increase their investment in cloud computing over the next five years, while around 50% of companies plan to invest in Artificial Intelligence, the Internet of Things and production automation tools.

Pavan Mahajan, VP of solutions delivery for APAC at Belden observes that the adoption of Industry 4.0 technologies gaining momentum among manufacturing companies in the region. He attributes this trend to manufacturers seeking to accelerate their journey towards full digital transformation.

Boston Consulting Group observes that harnessing Industry 4.0 will be key in helping the ASEAN manufacturing sector become more competitive and move up the value chain, with Singapore, Malaysia and Vietnam among countries that are already investing in smart manufacturing solutions such as smart factories, industrial IoT, advanced robotics, and cloud computing.

“Customers are beginning to embrace the desire for digital transformation and are looking to transform their manufacturing ecosystem with industrial automation and smart solutions,” added Mahajan.

Industry 4.0 investment priorities

According to Justinas Liuima, insights manager, industrial with Euromonitor International, says to partly solve the problem and compensate for rapid wage growth, companies are forecast to accelerate their investment in production automation tools in 2023.

“Production automation in many cases could be the only viable option for companies to ensure productivity growth,” opined Liuima.

Mahajan says among Belden’s customers in the Asia-Pacific (APAC) region, a key investment area is IT/OT convergence.

IDC predicts that by 2024, 50% of industrial organisations will be integrating data from edge OT systems with cloud-based reporting and analytics, moving from single-asset views to sitewide operational awareness. The IT/OT convergence market in APAC is estimated to develop at the highest CAGR of 7.1% from 2022 to 2027, from US$49,195 million in 2021 to US$73,523 million in 2027.

“As data becomes increasingly crucial for manufacturing companies to solve business challenges and achieve greater operational efficiency, performance, safety, and profitability, having access to an optimised, convergent network is key,” noted Mahajan.

With both IT and OT data available, he opined that companies could collect, move, integrate, and analyse data to automate processes and make better, more informed business decisions. “The additional capabilities in an IT/OT converged network, such as edge computing and analytics, will also usher in even greater opportunities for productivity and problem-solving,” he added.

Mahajan said that another key area of investment for manufacturers is in edge-to-cloud environments, especially edge technologies. We are seeing a higher level of acceptance and readiness among our manufacturing customers to invest in industrial edge solutions, with an increasing adoption rate over the past two years.

This is happening worldwide as well as in APAC, with GlobalData predicting that the global edge computing market will reach US$17.8 billion by 2025, with APAC sales accounting for 26.4%.

“As Industrial IoT (IIoT) and Industry 4.0 continue to gain momentum, investing in industrial edge capabilities will be key in enabling fully connected operational systems, reducing latency and cost of data processing while maintaining security and communication with the cloud,” concluded Mahajan.

Core competencies needed to benefit from Industry 4.0 innovations

Katarzyna Grzybowska and Anna Łupicka, authors of the report, Key competencies for Industry 4.0, noted that the demand for special skills will drive the shift of job creation within Industry 4.0 requiring more qualified managers.

For his part, Mahajan believes that to benefit from industry 4.0 manufacturers will need to have skills in network security, and data management and governance.

“The expanded, highly connected networks with more data transmission points, which are characteristic of Industry 4.0, create a greater need for security. This only grows with the integration of cloud computing, edge computing and the presence of older devices on an industrial network that can be more vulnerable,” he explained.

“Manufacturers need to have proper security measures in place to ensure network security, including the implementation of advanced network access control systems, industrial cybersecurity firewalls, and other hardware components to secure network infrastructures.”

Pavan Mahajan

He added that manufacturers also need to place more emphasis on industrial data management and governance. “With the adoption of smart technologies and IIoT, more and more devices are getting networked and connected. Organisations need to have a strong data governance policy that outlines how data needs to be stored, managed, accessed, and analysed and by whom to ensure data isn’t lost, stolen, or misused,” concluded Mahajan.

Top recommendations for ASEAN manufacturers

According to Mahajan, the pandemic has shown that digitisation which leads to digitalisation and usage of advanced technologies is key to staying resilient and agile in the face of major disruptions.

“As we move into a 2023 full of uncertainties, manufacturers in ASEAN need to further accelerate their digital transformation journey, prioritising the adoption of technologies such as warehouse automation and connected manufacturing,” he opined.

Mahajan posited that moving towards full automation for warehouses will help boost productivity and operational efficiency for manufacturers at the material handling level.

“Beyond being able to streamline workflows, eliminate waste and maximise output, smart automated warehouses will also be flexible and robust enough to support future technologies and processes, effectively futureproofing network infrastructures against changes and disruptions,” he continued.

“Depending on their focus and goals, manufacturers could also consider making the leap towards connected manufacturing, which harnesses the power of data to transform operations as well as customer and employee experience. With many uncertainties and challenges facing manufacturers now, it can be difficult for them to focus on the future,” he cautioned.

“Transitioning to connected manufacturing will ultimately enable manufacturers to stay ahead of the curve with significant long-term benefits such as boosting efficiency, reducing costs, and enhancing communication across all stages of manufacturing.”

Pavan Mahajan

“As the threat landscape is becoming more sophisticated than ever, manufacturers should look to reinforce their network security. Security should be taken into account at the initial stage of network design for a more holistic and effective approach to securing modern industrial networks.

“At the same time, security best practices such as implementing firewalls and continuous monitoring of potential threats should be applied in day-to-day operations to minimise security risks,” he concluded.

The post IoT’s influence on Asia’s manufacturing sector in 2023 appeared first on FutureIoT.

"In many phase one projects enterprises focused on a single use case and on acquiring the data streams from single sources but as the organisations gain a deeper data-driven understanding of their operations, they can start to use other data sources (such as geolocation, machine maintenance data, weather, transactions activity, vehicular telemetric traffic data, and so on) to improve their analytics and expand beyond the original use case," he continued.

That’s the good news. The bad news is that any device that is connected to the internet is susceptible to some form of cyberattack. The Mirai Botnet and Stuxnet are two infamous attacks against targets that caused massive disruptions.  

Any device that is connected to the internet is susceptible to some form of cyberattack. Apart from the fact that IoT devices inherently have very little built-in security, and that patch management can be difficult because of their physical nature, the interconnectedness of these devices and the subsequent complex environments they are implemented pose grave security threats across entire networks.

Monitoring is a vital part of every security strategy, ensuring that all classic security tools like firewalls, unusual detection systems or privileged access management (PAM)-tools work flawlessly.  

Suitable monitoring solutions can ensure physical security by integrating door-locking systems, security cameras, smoke detectors or temperature sensors into central monitoring. And businesses in APAC should be prioritising this in 2023 to reduce their risk of cyber-attacks and data breaches.

In describing the state of IoT security or lack of it, David Montoya, the global head of IoT at Paessler, noted that it is not just the lack of security features in the IoT devices themselves that is the challenge, but where these devices are located.

“When you think about cybersecurity from the IT perspective, everything is central. You might have the perimeter and then you have all the endpoints in the middle. But here (with IoT) we might be talking about having a device, which is sending out information about the flow of water, or temperature or humidity of the soil, for example, in the farming context,” he explained.

“It is important to look at different security problems or challenges because we are not only talking about the security of the information. We are, in several cases, even talking about the security of the device itself.”

David Montoya

“People are creating vulnerabilities out of IoT, and they are willing to get a device, open it up and figure out how to reverse engineer it.  They will then try to figure out how it works and then install it again with some malware, which can then make the network vulnerable,” he continued.

Why IoT continues to be vulnerable

Montoya comments that despite more regulations and security practice context within the vendors, it is very costly or inconvenient for them to put extra resources, like computing resources into these tiny little IoT devices in use to be able to deal with patches and updates.

“For companies creating IoT devices, there is not a lot of value in needing to put more resources there,” he surmised.

He argued that device manufacturers are incentivised to create small devices that cost as little as possible. The other issue is the variety of devices and vendors. “Even though there are more regulations, there are still no standard practices put in place as to how the information should be stored,” he commented.

Twin standards to consider

Montoya clarifies that there are two standards they consider when it comes to IoT – security and communication. One is related to a standard for protocols and the way those devices connect to different cloud-based systems monitoring systems. These central consoles ensure all the devices are on and reporting data, etc. In such a heterogeneous environment the lack of standards is creating chaos in the IoT world.

“Every vendor with a specific device for a specific reason created specific ways of communication that led to multiple protocols nowadays,” he continued. “When you have different players, each looking at their market niche, what ends up happening is a lack of communication standards and protocols.”

“This (situation) opens the same vulnerabilities that have happened for operational technology (OT) before now happening for IoT as well. Stronger standards are one way things can get better in terms of how to secure all these kinds of devices.”

David Montoya

Monitoring tools can help improve the security of IoT

According to Montoya, monitoring tools help visualise the data, including receiving alerts about the data. And while IoT vendors may provide tools to monitor their solution, the variety of vendors and the specificity of their use cases, suggest that a user may have a collection of monitoring applications that track a specific kind of device.

And because these may not come from the same vendor, it is likely that these do not use the same standard and may not be able to communicate with each other.

In addition, Montoya believes that users will not likely stay with one vendor for the same use case throughout the entire life of the process. “It is very normal that you have a certain IoT device from a certain vendor today and maybe two, or three years later you need to go for another technology and another vendor,” he explained.

The result is complexity on the part of the user trying to make decisions on the entire system or process. “You will have multiple different visualisation tools with different databases where the data is stored. And whenever you are trying to retrieve the data from multiple sources, you will take more time to know what is going on, how to use the data, how to bring the data into a central location, how to use that central location to provide central visualisation,” elaborated Montoya.

Ideally, you will want a central location from which to manage all these different proprietary technologies, standards and protocols, something Montoya says is what Paessler does.

“We keep up with all these new technologies to provide a single pane of glass. So that multiple vendors for IoT devices can share the information with our visualisation tool and monitoring solution. So that the users can see everything in one place and can handle everything from a single location, we provide a central database, and they can also get centralised alerts,” he explained.

Where do we go from here?

IDC market analyst for Asia-Pacific, Sharad Kotagi, says enterprises no longer think IoT value is only limited to achieving operational efficacy and improved productivity.

“They see IoT as an enabler in the evolution of enterprises' requirements and challenges in an ever-changing business environment. Many organisations are willing to invest in digital technologies such as IoT, and AI to fully leverage the new expansive role of data in emerging digital business models.”

Sharad Kotagi

But in the race to Industry 4.0 and the promise of smarter IoT-enabled enterprises, businesses and operations should not forget that behind the facade of benefits such a transformation promises, lies a myriad of security threats and vulnerabilities that must be addressed not for the lifecycle of the IoT but the use cases it is trying to enable.

Click on the PodChat player and hear Montoya talk about the challenges organisations face as they integrate IoT into their operations, and why monitoring may be the best path forward to securing IoT as the converged future of IT, OT and IoT.

1. Paint us a picture of the security landscape where it involves IoT.
2. Technologies like IoT, security practices and regulations have evolved, why do IoT continue to be vulnerable?
3. Is the lack of standards around IoT protocol a problem for securing IoT?
4. Will this wide range of protocols also hinder the effective use of monitoring tools and services?
5. As IoT start to connect – be part of the enterprise, how should the CIO, CISO and the COO or head of operations work together to better secure IoT as these connect to the enterprise?
6. Your thoughts for 2023?

The post PodChats for FutureIoT: Why monitoring is essential in IoT adoption appeared first on FutureIoT.

“When it comes to data centres, monitoring solutions support the monitoring of all IT components, which includes external facilities and security, as well as customisable alerts and reporting,” he commented.

In this article, Krueger provides insights into how networks of sensors are deployed in the data centre and used to monitor and predict the status of a data centre facility, including cooling systems, lighting, and security.

He explained that predictive maintenance anticipates future problems with IT infrastructure through forecasts and predictions made by analysing real-time data obtained from sensors and IoT, allowing organisations time to identify and work on anticipated risks.

“Predictive maintenance employs technologies such as machine learning to model and analyse real-time data and optimise the execution process, drastically reducing infrastructure downtime.”

Sebastian Krueger

He explained that by providing a centralised overview of the entire data centre infrastructure, a holistic monitoring solution supports a predictive maintenance programme in monitoring the sensors and IoT devices that provide real-time data.

What are the elements of a monitoring solution that support the monitoring of the entire scope of IT environments?

Sebastian Krueger: Sensors are the building blocks of a monitoring solution - monitoring solutions usually rely on sensors and other IoT devices to gather real-time data from an application or device. These range from generic sensors for monitoring hardware devices to platform-specific, preconfigured, or customised sensors to CCTV cameras and smoke alarms that monitor the physical environment.

Sensors in a monitoring solution integrate with important technologies such as SNMP (Simple Network Management Protocol), WMI (Windows Management Instrumentation), and HTTP (Hypertext Transfer Protocol) to gather system and performance data and to monitor the diverse variables present across the entire data centre infrastructure, which includes servers, networks, websites, and applications, present across a range of operating systems.

Apart from monitoring, another important element of a monitoring solution is being able to access and communicate the real-time information gathered in a simplified, convenient, and efficient manner.

Interactive dashboards and maps, that are based in real-time, allow for an easy-to-read and centralised overview of the system - this is especially convenient for larger and more geographically distributed IT environments such as data centres.

Customisable alerts and notifications - for whenever there has been a status change - are another element that enhances the scope of monitoring solutions.

Why do organisations need to monitor all the sensors and systems 24/7 with regard to availability and function and, at the same time, collect surveillance data?

Sebastian Krueger: Special attention needs to be given to the data centre security which not just covers the IT network and infrastructure risks but the entire premises.

When it comes to physical risks, it is important to monitor that there are no instances of overheating, cable fires which can cause massive damage while leakages in the air conditioning systems release water that can result in short circuits or damage the IT equipment.

What is needed is extensive sensor technology which can detect humidity, room temperature, hot spots, smoke, and other environmental influences. Monitoring issues such as smoke, fire, water intrusion, faulty cooling, faulty batteries, physical intrusion, building access security, as well as CCTV manipulation is important.

Given this backdrop, it is essential to keep a constant eye to detect any potential security threat, since data centres are doubly at risk, whether on the IT level, through distributed denial-of-service (DDoS) attacks, viruses, Trojans and similar threats or on the physical level, that can cause unwarranted disruptions.

Thus, organisations need to use the right monitoring tools which can leverage extensive sensor technologies and systems 24/7, regarding availability and function, and concurrently collect the surveillance data and integrate it into a central system to be pro-actively prepared for any anomalies.

How important is environmental monitoring of the data centre?

Sebastian Krueger: Given that data centres are required to always operate, disruptions such as power failure or overheating can cause massive damage, which includes increased costs, potential downtimes, increased wear and tear, and other disruptions.

Hence, apart from security and operational hardware devices, the monitoring of environmental parameters is an extremely important component of maintaining a functional data centre. A monitoring solution can support the monitoring of environmental parameters such as power and cooling.

While data centres are usually equipped with backup power systems such as UPS and SPS in case of a power outage, a monitoring solution helps monitor the status and performance of all power systems, including the backup.

Sensors help monitor any power-related occurrences - be it outage, heavy loads, or replacement. Similarly, to avoid system overheating, it is extremely important to maintain optimum room temperature.

A monitoring solution can integrate and combine multiple systems that give a singular overview of the detection of an irregularity and its cause, allowing for a much quicker and more efficient resolution.

The post Enhancing data centre operations with IoT appeared first on FutureIoT.

As Asia comes out of the three-year economic slump because of the pandemic, what lies ahead for businesses? What is the role of IoT in the return to some form of normalcy?

FutureIoT spoke to Danny Mu, principal analyst at Forester Research on recent trends around IoT adoption in Asia and where this will lead us in 2023 and beyond.

Drawing from the Forester Report, state of IoT in Asia Pacific in 2022. Where is the concentration of IoT?

We have seen that companies in Asia-Pacific are shifting the share of IoT engagements toward production deployments.

Five years ago, in 2017, production deployments comprised just 25% of engagements, and these were predominantly POCs or pilots.

But in 2021, 61% of engagements were production deployments. That is a clear indication that Asia-Pacific firms are getting more confident in the potential of IoT initiatives to generate business value.

Among all the IoT use cases, smart industry, smart consumer services, and smart infrastructure are popular in Asia-Pacific.

Why do you say the smart city industry in Asia Pacific's leading the world in terms of IoT?

As we know, Asia Pacific contributed 35% of the world's GDP, but when focusing on industry value added, including manufacturing, construction, and utilities, Asia Pacific contributed 44%. That is why the smart industry is a leading IoT use case.

What’s driving this deployment of IoT?

Three drivers. The first appearance and rising maturity of specialised IoT solutions and cloud-based IoT. Second, connectivity technologies such as 5G. Third capabilities and offerings of IoT consultants and service providers.

In Asia, which industries are leaving the deployment?

In Asia Pacific, two-thirds of telecom decision makers say their firm is currently adopting IoT solutions.

Adoption and investment are highest in high-tech manufacturing, 81% followed by telecom, 71%. General manufacturing and pharma are broadly in line with Asia-Pacific outreach.

Adoption rates below the average are found in financial services and insurance, 60%, and retail in wholesale 56.

Compared to other regions outside Asia, how sophisticated do you see the level of use of IoT in our part of the world?

According to the survey data, the IoT solution and application adoption rate in Asia Pacific is higher than in Europe and North America. Particularly in the high-tech manufacturing sector, the adoption rate in Asia Pacific is more than 10% higher than in Europe and North America.

Within the leadership at organizations deploying IoT, what do you see are the primary motivations most surveyed?

Asia-Pacific Telecom decision-makers are confident that IoT solutions will generate significant operational efficiency. Half of them expect IoT initiatives to significantly improve customer experience and increase revenue.

How do you see these IoT deployments impacting other initiatives like digital transformation and modernization, for instance?

Impacted by IOT solutions, enhancing customer experience in public places is the most often mentioned. Other use cases related to smart consumer services are also popular.

The two years of the pandemic have likely driven this trend as customer experience in public. It's driven by private companies, public infrastructure operators, and governments.

IoT Solutions also help to enable new business models, particularly in financial services and insurance – a clear indication that those firms will spend the extra IoT budget on usage-based insurance financing and lending.  

Given that security is a rising concern among business leaders, how should enterprises deploying IoT manage the security strategy of the company? 

Security is on top of the concerns with deploying IoT 10% higher than the second option. To help protect data in IoT scenarios, confidential computing can help to isolate sensitive operations in a trusted execution environment during processing.

To support the transfer of data between edge and cloud while appearing seamless to the developers, two networking markets, zero trust/edge, and multi-cloud networking will combine to create a business-wide networking fabric.

Finally, as we step into 2023, how should enterprises review IOT deployment strategies to ensure that these initiatives meet expectations?

We have found that Asia-Pacific companies are less confident in their in-house skills to deliver IoT solutions successfully. These points will need for consulting partnerships.

We also predict that the adoption of in-region digital industrial platforms will gain significant growth. Embracing these in region platforms and industry-specific cloud solutions will help Asia-Pacific firms meet their expectations.

The post PodChats for FutureIoT: IoT in Asia in 2023 and beyond appeared first on FutureIoT.

Commissioned by Telenor, the OMDIA study found that 20% of enterprises in APAC anticipate their IoT deployments to reach beyond 500,000 devices that can be connected wirelessly to a network and used to transmit information within the next 12 months.

The study forecasts that emerging IoT adoption in the region, particularly from India, Pakistan, Bangladesh, Indonesia and Thailand, is expected to push the 14.5 billion IoT devices in circulation today to a forecasted 38.9 billion IoT devices by 2030.

Seth Ryding, chief sales officer (CSO) and head of Telenor IoT Asia says digitalisation and sustainability are moving to the core of companies’ future strategies.

“IoT and digitalisation are no longer an option for enterprises in the region, but a necessity – as technology hardware, connectivity and software takes centre stage in the digital future.”

Seth Ryding

Challenges unique to APAC

Unique challenges drive APAC in ways not seen in the rest of the world – population growth in megacities combined with a need to reach widely spread remote areas, the increasing pressures of urban mobility and energy demand, and the wider political landscape (including newly introduced/revamped policies or guidelines to steer deployment).

This takes place in an IoT vendor market that is fragmented, with enterprises challenged by the complexity and concern of cybersecurity.

IoT devices include any physical object that can connect wirelessly to the internet and transmit data, such as smart watches, printers, meters, speakers, and even kitchen appliances and automobiles.

The report specifically highlights the drivers behind fast-moving automotive digitalisation and IoT efforts, particularly in fleet management.

The vertical view also covers how IoT is enabling a streamlining of processes in transportation and logistics as well as a clear link to the sustainability agenda in the growing application of IoT in APAC energy, utilities, and resources enterprises.

Conclusion

The report concludes as IoT deployment goes into high gear, enterprises should consider the following with their projects:

• Consider connectivity from the country-level
• Seek proven integrated IoT security solutions
• Build-in a sustainability-first approach
• Plan for the complexity of IoT integrations
• Choose the right partners

The post 5 point strategy for accelerated IoT adoption appeared first on FutureIoT.

With more than 43 billion IoT devices connected in 2023, Futurist Bernard Marr shares his perspective on the above four trends he believes will influence how we use and interact with these devices.

Click on the YouTube player above to watch Marr reveal his top four trends impacting IoT in 2022.

Click here to see his 2022 predictions and compare – what’s different and the same.

The post Top four IoT trends in 2023 appeared first on FutureIoT.

The COVID-19 pandemic has become a fertile ground for the combination of the IoT and digital twins to solve one of the biggest challenges brought about by the ensuing mobility restrictions – how to be more resilient to ongoing uncertainties.

As we prepare to face continuing uncertainties in 2023, what can we learn from the past three years to help businesses be more adaptive and resilient in the years ahead?

KONE is a Finnish engineering company best known for its elevators, escalators, automatic building doors, and monitoring and access control systems.

IoT has opened new business opportunities for Kone in areas such as remote monitoring, as Markus Huuskonen, KONE's head of maintenance processes, explains it: “This ability to remotely monitor equipment has been one of our targets for a pretty long time, but now IoT really enables us to do it efficiently while scaling up our operations.”

FutureIoT spoke Jukka Salmikuukka, partnership development director at KONE Asia Pacific, for his perspective on how organisations are adopting IoT to solve real-world business problems.

Which industries are leading the deployment of the Internet of Things (IoT)? Compared to other regions outside Asia, how sophisticated (mature) is the level of use of IoT?

Jukka Salmikuukka: IoT is utilised so widely that you can find great deployments happening in many industries. Good examples are manufacturing, finance, and healthcare where IoT is widely utilised.

"Regardless of the industry, often the deployments are driven by global organisations with the help of global technology/platform providers. This means that the best practices can be efficiently utilised, and the smartest deployments can be done regardless of whether the location of the underlying infrastructure (for example core networks for the internet) is solid and reliable enough."

Jukka Salmikuukka

In Southeast Asia, Singapore is leading the way and setting the standard in digitalisation in many ways – especially compared to the rest of the world.

The Smart Nation initiative has proven to be a very powerful approach in combining public and private sector actions to drive the adoption of digitalisation and IoT. Following this example, we have also seen the neighbouring countries actively working on various IoT opportunities.     

Within the leadership of these organisations deploying IoT, what do you see are the primary motivations?

Jukka Salmikuukka: Quite naturally it is usually about money – often IoT enables significant cost savings or opens new revenue opportunities.

More and better data combined with advanced analytics helps healthcare to operate more efficiently and provides more accurate care for patients.

Elevator and escalator companies such as ours can predict possible upcoming problems and neutralise those before issues arise allowing the people flow in busy buildings and cities to continue without interruptions.

The better retailers can understand their customer’s behaviour and preferences, the more successfully they can tailor their offerings for them.

Hotel operator may solve their service personnel challenges by deploying delivery robots to manage in-room deliveries. Numerous similar examples can be found in many industries.

At the same time, IoT can also play a significant role in helping organisations achieve their sustainability targets – IoT solutions can help eliminate waste, minimise energy consumption or achieve carbon-neutral operations, which besides providing financial benefits is also good for the planet.

Similarly, IoT can future-proof buildings for owners, so they can more accurately plan their future investments throughout the building’s lifecycle. 

How do you see these IoT deployments impacting other initiatives like transformation, modernisation and many more?

Jukka Salmikuukka: I would like to use a very worn-out cliche here: “everything is connected”. IoT is one of the key enablers for transformation, modernisation, and renewal.

IoT has changed and will keep on changing the world – the way we do things, how we work, how we play and how we live. Some jobs may disappear thanks to IoT, but new roles will emerge because of it.

Therefore, IoT deployments should be seen as tools and enablers to achieving the targeted transformations and other changes.

Given that security is a rising concern for businesses, how should enterprises deploying IoT manage the security strategy of the company?

Jukka Salmikuukka: Data security is a top priority when we speak about IoT. When leveraging IoT, security cannot be something that you “add” on top of the solution in the end.

It must be designed into the solution from early on to ensure that there is comprehensive, end-to-end security in place in a way that can be managed and updated when needed.

This type of comprehensive security management can be achieved only through systematically organised processes and practices that are applied throughout the entire organisation and in collaboration with the right type of partners.

As we step into 2023, how should enterprises review IoT deployment strategies to ensure that these initiatives meet expectations?

Jukka Salmikuukka: I believe everybody agrees that no organisation can walk away from digitalisation, but we all need to have a clear strategy and plan for it. It is very important to pick the right partners with whom the IoT initiatives can be carried out successfully.

The IoT and technology landscape is evolving so quickly that organisations need to stay on top of all the possibilities new technology can enable, being those digital twins, metaverse or anything else. This understanding combined with systematic technology roadmaps helps organisations deploy IoT successfully into their operations.   

The post IoT in 2023, beyond smart connectivity appeared first on FutureIoT.

Despite Singapore reporting a slightly smaller figure at 86%, there remain widespread gaps in industrial security and indicated opportunities for improvements.

Addressing the audience during the Operational Technology Cybersecurity Expert Panel (OTCEP) Forum 2022 on 12 July, minister for Communications and Information, Josephine Teo, stressed the importance of enhancing the collaboration between the public and private sectors, supported by suitable security tools investments, which will better position Singapore to manage future OT cyber-attacks.

During a media briefing, representatives from Fortinet, including Adam Wu, regional solution architect for OT, Rashish Pandey, vice president of marketing and communications, and Jonathan Chin, OT business development manager, joined Kenny Yeo, Frost & Sullivan's director and head of Asia Pacific cyber security practice, to talk about how organisations in Asia need to represent OT security practices.

When an OT attack occurs, what is the workflow for resolving the attack? Typically, when does the CIO/CISO/IT team get involved when an OT attack occurs?

Adam Wu: Don’t panic and don't pull the plug. Assess the process that you have currently in your plan. Then the CIO and IT team can decide, whether they want to isolate or start an instant response. The incident response has to be formulated by the organisation based on their needs. They toned to invoke caution before hitting the brake glass button and disconnecting everything.

Frost says OT refresh cycles take longer than IT. How do you then keep OT and IT security practices synchronised and reflect the present environment?

Rashish Pandey: The refresh cycles are different and longer for OT. The patching protocols are different depending on the different types of assets. How can these two teams work together? We observe that the air gap goes away and there is a need to have a common playbook that cuts across both IT and OT, known as IIoT alignment.  Aligning the mindset of OT and IT security is a bigger concern.

Adam Wu: Organisations can do virtual patching, periodic validation, and risk assessments in their environment. Organisations should conduct risk assessments and audits regularly to ensure that the current controls are being followed.

Do you see the current variety of connectivity standards for OT, and the varying age of OT devices as frustrating the securing of OT?

Rashish Pandey: We can choose to do something about it. Organisations need to make sure that traffic is protected in transit as well and are taking security measures. We can’t rip out all the OT infrastructure and replace it with brand-new infrastructure. We need to start with where we are and put in place a pragmatic approach to protect these assets.

How would you assess the state of OT security in Asia? Is the lack of maturity in OT security a reflection of lack of understanding or it’s just not a priority?

Rashish Pandey: OT security as a discipline has come to the forefront of the day which coincided with the rise of industry 4.0. It's mainly the lack of awareness but it’s speeding up fast. We see the board of directors getting involved in this conversation. We do see varying degrees of maturity across Asia, in which Singapore is a leading player. We have a very robust conversation happening on OT and critical infrastructure security.

Kenny Yeo: Regulation is also key, it’s the key number one factor leading to increased adoption of cybersecurity. Organisations tend to postpone OT security until something happens.

Do you think CISOs/CIO/Head of OT Ops will trust an AI to take remedial action against OT threats without human intervention?

Adam Wu: So, the level of security is according to the CVE rating, that is being assigned to a particular vulnerability. The score is derived from a variety of factors, whether it can easily exploitable, and whether it costs a lot of damage.

There is also a human element to giving that score. If the exploit is being stopped, that’s the most important.  For FortiGate, you can set what level of security you want to stop, let's say, out of five scores, you can set maybe three and above to block anything. It is flexible.

How should an OT security program be managed? Who should oversee this?

Jonathan Chin: The conversation is about cyber resiliency, which depends on the organisation's dynamics. For example, some organisations have a dedicated individual working specifically on readiness. They are responsible for understanding whether threats are real and critical, but also what they should be doing and who they should call.

Sometimes, the Lead Automation engineer takes charge due to OT system expertise, and the CIO/CISO acts as a consultant. In other cases, the IT teams take control regardless, and the Lead Automation engineer serves as a consultant. In an ideal case, an IT/OT specialized group should balance the IT/OT perspective.

Do you see AI/machine learning as going beyond the identification of threats and into the pre-emptive prevention of threats?

Jonathan Chin: AL/ML is utilized primarily for threat detection and automated responses upon discovery. However, we see AL/ML being increasingly used beyond threat identification to being utilized as take-down services, threat hunting at both networking, as well as endpoint levels, and actively pursuing botnet malware threats on the internet.

AI/ML models provide an effective way to counterattack by learning the pattern of these attacks. Putting in place intelligent analysis at the endpoints can also provide an enormous advantage since it protects the point where the possibility of human error is most exposed.

With IT looking at passwordless as the next level of authentication, do you see the necessity to deploy FIDO2 for IoT?

Jonathan Chin: Passwordless authentication and FIDO2 came out of consumer password fatigue while preserving the need for security. However, implementing the same for air-gapped scenarios/ private clouds will need expert supervision.

Security professionals can consider Multi-Factor Authentication (MFA) technologies which confirm the identity of users by adding a step to the authentication process. A second step is to verify a user's identity to ensure that a cybercriminal can't access an individual's account even if a password is compromised.

OT organisations can also consider a Digital Risk Protection (DRP) Service that includes external attack surface management (EASM) and adversary-centric intelligence (ACI) which are essential in stopping adversaries early in their campaigns.

The post The Game Plan: Modernising OT security programmes appeared first on FutureIoT.

The Border Security Market forecasts the border security market to reach US$65,150 million by 2030, growing at a CAGR of 7.61%

As the travel industry, border authorities face the need to win in operational efficiency and user convenience. For years, biometrics has been used by authorities to simplify traveller experiences at borders, speeding up people's enrolment and ID checks (ex: the eGates or Entry-Exit Systems).

The new Thales multimodal biometric pod is an efficient enrolment and identification solution that helps smoothly manage travellers’ border and immigration processes. It combines ‘iris & face’ capture and recognition capacities to enable fast and secure people enrolment and ID verification at borders. The pod features a modern design that perfectly suits the authority’s needs in high-security environments.

With the Thales multimodal biometric pod, border authorities can easily integrate automation into their processes, without compromising on passenger and employee security nor on the confidentiality of the data exchanged as the solution offers ‘security and privacy by design’ parameters.

Featuring a camera and a high-resolution LCD screen, the biometric pod can recognise pre-enrolled travellers’ iris and face from 0.5m and up to a record of 1.5m, with excellent accuracy. Boosted by AI, the solution captures dual iris and face in two seconds, leading to swifter operations and visibly shorter waiting queues.

Thales biometric pods can be set at any border checkpoint (airports, seaports, etc.) managing both the first traveller enrolment upon arrival and quick biometric checks whenever required (upon territory exit, internal flights etc).

“The combination of biometric patterns applied to touchless people authentication, is a sought-after solution for many stakeholders to address security, operational and convenience challenges”, said Youzec Kurp, VP of identity and biometric solutions at Thales.

“Thales relies on its in-house biometrics, border, and smart travel expertise to design, develop and deliver top tier responsible biometric solutions to meet users’ expectations and authorities’ requirements.”

Youzec Kurp

The post Multimodal Biometric Pod to more efficiently secure borders appeared first on FutureIoT.

“The ability to defend against threats targeting critical care devices while maintaining operational availability and strengthening the alignment of device governance responsibilities between IT and Biomed engineering teams is quickly becoming a necessity for the protection of patient data and lives.”

Ed Lee

As healthcare providers use digital devices such as diagnostic and monitoring systems, ambulance equipment, and surgical robots to improve patient care, the security of those devices is as important as their primary function.

It is therefore understandable that as technology advances and new innovations become accessible, the healthcare industry becomes a prime target for cybercriminals. Why not? Healthcare practitioners are not necessarily at the cutting edge of cybersecurity practice, and with how busy they are performing their tasks, who can blame them?

“The proliferation of connected medical devices in the healthcare industry brings a wealth of benefits, but these devices are often not well secured. For example, according to Unit 42, an alarming 75% of smart infusion pumps examined on the networks of hospitals and healthcare organizations had known security gaps,” said Anand Oswal, senior vice president of products, and network security at Palo Alto Networks.

“This makes security devices an attractive target for cyber attackers, potentially exposing patient data and ultimately putting patients at risk.”

Anand Oswal

Zero trust in healthcare

Zero Trust is a strategic approach to cybersecurity that secures an organization by eliminating implicit trust by continuously verifying every user and device. While a Zero Trust approach is critical to help protect medical devices against today's cyber threats, it can be hard to implement in practice.

Through automated device discovery, contextual segmentation, least privilege policy recommendations and one-click enforcement of policies, Palo Alto Networks Medical IoT Security delivers a Zero Trust approach in a seamless, simplified manner.

It also provides best-in-class threat protection through seamless integration with Palo Alto Networks cloud-delivered security services, such as Advanced Threat Prevention and Advanced URL Filtering.

Using ML enables healthcare organizations to:

• Create device rules with automated security responses: Easily create rules that monitor devices for behavioural anomalies and automatically trigger appropriate responses. For example, if a medical device that typically only sends small amounts of data unexpectedly begins to use a lot of bandwidth, the device can be cut off from the internet and security teams can be alerted.
• Automate Zero Trust policy recommendations and enforcement: Enforce recommended least-privileged access policies for medical devices with one click using Palo Alto Networks Next-Generation Firewalls or supported network enforcement technologies. This eliminates error-prone and time-consuming manual policy creation and scales easily across a set of devices with the same profile.
• Understand device vulnerabilities and risk posture: Access each medical device’s Software Bill of Materials (SBOM) and map them to Common Vulnerability Exposures (CVEs). This mapping helps identify the software libraries used on medical devices and any associated vulnerabilities. Get immediate insights into the risk posture of each device, including end-of-life status, recall notification, default password alert and unauthorized external website communication.
• Improve compliance: Easily understand medical device vulnerabilities, patch status and security settings, and then get recommendations to bring devices into compliance with rules and guidelines, such as the Health Insurance Portability Accountability Act (HIPAA), General Data Protection Regulation (GDPR), and similar laws and regulations.
• Verify network segmentation: Visualize the entire map of connected devices and ensure each device is placed in its designated network segment. Proper network segmentation can ensure a device only communicates with authorized systems.
• Simplify operations: Two distinct dashboards allow IT and biomedical engineering teams to each see the information critical to their roles. Integration with existing healthcare information management systems, like AIMS and Epic Systems, help automate workflows.

"With thousands of devices to manage, healthcare environments are extremely complex and require intelligent security solutions capable of doing more. Adding intelligence will enable providers to improve operational efficiency, which will enhance patient and practitioner experience and alleviate the burden of an ongoing IT skills shortage," said Bob Laliberte, principal analyst, ESG.

The post Palo Alto Networks secures medical devices appeared first on FutureIoT.

“The criticality and resulting demand for security in 5G networks are undisputed. However, the persisting fallout of the global pandemic, with interrupted deployments of 5G, delays in spectrum auctions and the standardisation from Release 16, continue to impact the market,” explains Michela Menting, telco cybersecurity research director at ABI Research.

She adds that current inflation and a potential recession in 2023 means mobile operators will face challenges for their future revenue streams (e.g., consumer spending), Operational Expenditure (OPEX) increases (e.g., energy prices driving up costs and increased price of upstream providers), and higher cost to borrow money (making investing harder).

This means that investments in security technologies and services will take longer to materialise. ABI Research sees the opportunity for URLLC and mMTC as highly promising from a security perspective compared to the security demand in eMBB applications.

A slowing market doesn’t mean a passive one. She opines that this slowing condition provides more time for stakeholders, notably mobile operators and network equipment providers, to plan for security monetisation in the enterprise space in 5G telco cloud and services.

“They are faced with aggressive coopetition from hyperscalers and other new entrants, around which they will need to position themselves. As such, there is plenty of opportunity for the continued development of a lucrative and healthy security market in 5G.”

Michela Menting

The post 5G network security worth US$9 billion up for grabs appeared first on FutureIoT.

By the programmable logic controllers (PLC) The Stuxnet computer virus disrupted the Iranian nuclear program by damaging centrifuges used to separate nuclear material.

The United States Presidential Decision Directive 62 (issued in 1998) stated that “Critical infrastructures are those physical and cyber-based systems essential to the minimum operations of the economy and government. They include, but are not limited to, telecommunications, energy, banking and finance, transportation, water systems and emergency services, both governmental and private.”

Trending in ICS security

Tim Conway, a certified instructor and technical director for ICS and SCADA programs at the SANS Institute says globally there are common trends across multiple geographies and critical infrastructure sectors with asset owners and operators pursuing increased interconnectedness across systems, increased remote access, and increased pursuit of cloud integration.

“In addition, with this movement toward connecting and operating systems in ways they never were previously designed for, there is a corresponding increase in concern, which is driving regulation and framework adoption to ensure appropriate levels of cybersecurity detection and defence capabilities.”

Tim Conway

What are the current and emerging ICS vulnerabilities in critical infrastructure (in Asia)? What is the industry doing to address these?

Tim Conway: This is truly a global issue, while some sectors may be of higher risk in certain geographies than other parts of the world, we all face similar challenges across common ICS devices, and protocols that are used in various industries. 

In general, we are seeing a rise in ICS-targeted malware which is concerning for all vendors and the associated industries that rely on those vendor products and solutions. 

Modular malware frameworks that allow adversaries to add capabilities or customise an attack approach have been discovered and they truly provide a force multiplier capability that could enable an increased frequency of attacks across a broader scope of targets potentially.

With the increasing adoption of IIoT, to what extent are ICS vulnerabilities expanding beyond operational technology (OT)?

Tim Conway: There will continue to be a feverish pursuit of connectivity and automation to everything everywhere, our challenge is in understanding where all those trusted communication paths are, how they could be misused and what impactful effects could be achieved. 

Understanding these attack vectors, and vulnerabilities will allow organisations and individuals to make risk-informed decisions about what technologies should be pursued and where.  The phrase, “Just because you can, does not mean you should” applies well here. 

Singapore is probably one of the best examples to look at regarding guidance and thoughtful discussions on the development of a common balanced approach to pursuing innovating technologies and interconnectedness with a healthy dose of concern about how those technologies should be implemented and maintained.

Can you share common pitfalls and challenges in ICS security that impact/endanger critical infrastructure security in Asia?

Tim Conway: Every process has unique considerations and nuanced discussions around appropriate cyber-informed engineering concepts that need to be pursued.  There needs to be a focused investment in the workforce around the areas of operations, engineering, safety, and cybersecurity to begin addressing the issues truly.

What lessons can Asia learn from recent compromises and attacks in industrial companies around the world – to protect the community and national security?

Tim Conway: As a region, I would recommend any country to look to activities being pursued around the world to run national exercises throughout their critical infrastructure sectors and examine the regulation or guidelines that have been implemented elsewhere to determine if there are areas within their own country that could benefit. 

From an attack perspective, each sector should look to impactful attacks around the world and ask the questions of their teams – how that attack could occur in our organisation, would it have been worse, how would we detect and prevent it, what can we do to improve our abilities to operate through a similar attack, and then establish exercises to practice and prepare.

What are the key ICS cybersecurity critical controls that governments and organisations should deploy to adapt, to best fit their environment and risks? How has ICS cyber security evolved in recent years?

Tim Conway: ICS cyber security has greatly expanded from the perspective of solutions and guidance.

We have recently released a whitepaper on “The Five ICS Cybersecurity Critical Controls” and we feel this will significantly help organisations establish focused capital and O&M projects and programs to address the areas of greatest risk.

The post Securing the critical appeared first on FutureIoT.

According to Data Bridge Market Research, the IoMT market in Asia Pacific is expected to grow with a CAGR of 24.1% from 2021 to 2028. Despite the growing IoMT market and rising adoption of advanced technologies, the healthcare industry still lags behind other advanced sectors such as info-communications on cybersecurity.

The cybersecurity risks patients and operations can be exposed to are real and pervasive. Additionally, the accreditation and compliance to standards for connected medical assets, including IoMT, are also straggling.  With the growing number of unmanaged medical and non-medical devices and sensors, the risks to hospitals' cybersecurity go beyond IoMT itself.

According to the Identity Theft Resource Center (ITRC), during the first half of 2022, the healthcare sector has been the number one target of data breaches.

James Millington, senior director of product marketing at Armis, says concerns are not only with confidential medical data but also with patient care disruptions that might have life-threatening consequences. After all, the threat landscape has evolved with the rise of ransomware as a lucrative business model for criminals.

“The complexity of the healthcare tech stack, due to a diverse number of devices and types of systems, makes it harder to track assets and manage their vulnerabilities.”

James Millington

“For example, hospitals need to deal with a great number of medical device vendors, each one with its own, little-known proprietary operating system. Besides, many of those devices are mobile — think of infusion pumps being moved from one room to another, which can lead to misplacement or loss,” he added.

Does the coexistence of OT, IT, IoT, and IoMT expand the attack surface?

The healthcare device ecosystem is highly connected – beyond smart medical devices that are touching the patient or directly providing care. The growing number of devices connected to the internet – over 55 billion by 2025, as per IDC – leads to an increased attack surface, too.

Printers, self-check-in tablets, surveillance systems, smart lighting systems, and temperature control for vaccine storage are just a few examples of enterprise IT, Internet of Things (IoT), and operational technology (OT) in medical facilities. Hacking a smart TV in a waiting room might open the door to threats that can move laterally in often poorly segmented hospital networks and cause disruptions to patient care.

Why is it a concern that medical devices do not accommodate agents?

Since medical and clinical devices are regulated and built intentionally as walled hardware to achieve a specific outcome (for example, administering a medication), they usually don’t accommodate external software. As a result, they cannot be secured through traditional endpoint agents, nor easily updated or patched.

Effective patch management is a significant concern given that cybercrime and nation-state actors have focused on discovering vulnerabilities or unpatched systems as a main method of attack, according to the 2021 Microsoft Digital Defense Report.

Will the use of legacy technology compromise cybersecurity?

Medical devices generally have a higher lifecycle than consumer technology. Due to concerns over patching or restrictions due to FDA certifications, the operating systems and software running these devices may go untouched and unpatched for fear of rendering the device inoperable and impacting patient care.

Since medical equipment is expensive to replace, devices may even be operating outside the supported lifetime of the software they are running. An MRI machine, for example, might cost more than $400,000. Investments in hospital technology involve planning, training, and government subsidies.

Are vulnerability scans disrupting healthcare?

Medical devices have different sensitivities. You don’t know how a specific operating system (OS) will respond to the protocols of a vulnerability scanner. When the communication deviates from the expected, the device might crash.

If you are doing a scan through a workstation, the end user can likely tolerate the disruption, but a medical device malfunction while touching a patient can negatively affect care (for example, if the device stops working in the middle of surgery).

Network segmentation is recognised as a standard security strategy. How is the inconsistency in network segmentation affecting healthcare?

A typical hospital network is flat and divided between biomedical and corporate IT security teams, creating silos. IT is concerned with cybersecurity, while biomedical teams focus on clinical usage. Traditionally, VLAN keeps both sides separated, but it’s not designed for security.

Exposure to the IT side of the house increases risks. Many threats start on the IT side, such as the case of WannaCry malware, which spread through computers operating Microsoft Windows. As per Armis research, 40% of healthcare organisations suffered from the WannaCry attack.

How to stay on top of IoMT vulnerabilities?

Healthcare delivery organisations often lack the visibility to expand their vulnerability management programs to medical devices. Asset inventory is often a manual effort where healthcare professionals do a site survey, literally walking through every single room to see what they have and writing it down in an Excel sheet.

Improved Internet of Medical Things security requires a holistic, automated inventory of every digital asset (IT, OT, IoT, and IoMT), regardless of who purchased them (IT or biomedical teams).

To support today’s healthcare innovations, hospitals need a comprehensive cybersecurity and asset management solution that can monitor all devices, including those that cannot accommodate security agents.

The post Cybersecurity challenges of IoMT and mitigation appeared first on FutureIoT.

IoT Analytics forecasts that globally the number of connected IoT devices will grow at 9% annually, reaching 27 billion IoT connections by 2025. Riding on this growth of connected devices is an increased need for security.

ResearchandMarkets forecasts the global IoT security market to grow from US$3.86 billion in 2021 to US$5.09 billion in 2022. The firm attributes this growth due to the companies stabilizing their output after catering to the demand that grew exponentially during the COVID-19 pandemic in 2021.

While 64% of respondents to the Kaspersky study, Pushing the limits: How to address specific cybersecurity demands and protect IoT, use IoT solutions, as much as 43% do not protect them completely.

The National Institute of Standards and Technology (NIST) paper, Recommended Criteria for Cybersecurity Labelling for Consumer Internet of Things (IoT) Products, posits that to reduce IoT product vulnerabilities, it is important to understand already exploited vulnerabilities in IoT products and ensure that consumer IoT product labelling programmes consider these incidents in its criteria to help improve the cybersecurity of the IoT ecosystem.

Dr Dorit Dor, chief product officer with Check Point Software Technologies, explains that there are many levels to IoT leaving to misunderstanding and potential risks of exposure to threats from within and outside the organisation.

“Even the lowest cost IoT device could be a starting point for an attack. You have to understand the connectivity of the IoT device to the internal and outside world. The fact that it bridges the two things without having the right IoT controlling them is the biggest evidence of this,” she explained.

“People use IoT to do massive attacks (DDoS massive attacks) by taking over IoTs in many locations and doing denial of service or other destruction for the world. These are less focused attacks and more widespread attacks.”

Dorit Dor

More common than you think

Dr Dor cautions that attacks that stem from unprotected IoT are not always targeted at specific industries. She calls back understanding that cybercriminals are often looking for the least protected targets.

That is not to say that there are attacks that are specifically directed at certain industries or organisations.

“It is less of a sectorial issue. It's more of a general issue of IoT devices being spread around and kind of hindering the security architecture of the organisation. By creating all these hidden links, the IoT itself could be served as a jump point for the intended target,” she cautioned.

Common misconceptions and challenges

Dr Dor noted that one of the biggest misconceptions when it comes to IoT security is the perception among enterprises that they do not have any IoT devices in the workplace. And if they did, the other misconception is that these devices are not connected to the internal network (without their knowledge).

Another misconception, she added, is enterprises think they are protected when they are not.

“People don’t always have the right personnel to perform the security sections required,” she posited.

Advanced technologies to the rescue?

Asked whether any advanced technologies help solve some of the challenges she presented, Dr Dor is confident that tools are available to help in the process of understanding the challenges.

She cited the use of artificial intelligence (AI) as helping map the devices that are seen on the network of IoT devices and mapping their behaviour.

“But to do this, you need to have a lot of data on similar IoT devices that exist,” she cautioned.

“So as an organisation, you may not have enough data to secure your IoT devices. However, you probably have enough data on different uses and usages of this IoT device that could help you sanction or create sectioning policies for the IoT device.”

Dorit Dor

Bringing about greater security of IoT devices in the enterprise

Dr Dor suggests reducing the access atmosphere of the IoT device to the least limited or a zoning-based approach. The other step is to understand what the IoT does and see that it behaves like a legitimate IoT device.

She recommended organisations buy IoT devices that have some security and stability built in.

Click on the PodChat player and hear in greater detail Dr Dor’s observations and recommendations for securing IoT for the enterprise.

1. What are the IoT cyber security threats faced by enterprises?
2. How common are these threats?
3. What are common misconceptions and challenges encountered today when enterprises try to secure IoT devices?
4. Can advanced technology such as AI, machine learning and deep learning solve these problems?
5. What are the roles of AI, machine learning and deep learning in IoT security?
6. What are your recommendations to bring about greater security of IT devices in the enterprise?

The post PodChats for FutureIoT: Understanding the fundamentals of secure IoT appeared first on FutureIoT.

A Ponemon Institute study noted that 65% of responding organisations say that IoT/OT devices are one of the least secured parts of their networks, while 50% say that attacks against these devices have increased.

IT security practitioners in 88% of those organisations have IoT devices connected to the internet, 56% have OT devices connected to the internet and 51% have the OT network connected to the IT network.

Threat actors are aware of these trends. Forescout recently reported on how ransomware groups have started massively targeting devices such as NAS, VoIP and hypervisors. Not surprisingly, most of these devices were among the riskiest identified in the 2020 Enterprise of Things Security Report. 

Many of the device types observed among the riskiest in 2020 remain on the list, such as networking equipment, VoIP, IP cameras and programmable logic controllers (PLCs). However, new entries such as hypervisors and human-machine interfaces (HMIs) are representative of trends including critical vulnerabilities and increased OT connectivity. 

2022’s riskiest connected devices

Using Forescout’s scoring methodology, Vedere Labs identified the five riskiest devices in four device categories: IT, IoT, OT and IoMT.

• IT: Router, computer, server, wireless access point, and hypervisor
• IoT: IP camera, VoIP, video conferencing, ATM, and printer
• OT: PLC, HMI, uninterruptible power supply (UPS), environmental monitoring, and building automation controller
• IoMT: DICOM workstation, nuclear medicine system, imaging, picture archiving and communications system (PACS), and patient monitor

How organisations can mitigate risk

“We have seen two recurring themes in Vedere Labs’ research, which this report reinforces,” said Daniel dos Santos, head of security research at Forescout’s Vedere Labs, noted two recurring themes: “First, attack surfaces are growing quickly due to more devices being connected to enterprise networks, and second, threat actors are increasingly able to leverage these devices to achieve their goals.

“Unfortunately, the attack surface now encompasses IT, IoT and OT in almost every organisation across the globe, with the addition of IoMT in healthcare. It is not enough to focus defences on risky devices in one category, as attackers will leverage devices in different categories to carry out attacks. Vedere Labs has demonstrated this with R4IoT, demonstrating how an attack that starts with an IP camera (IoT), can move to a workstation (IT) and disable PLCs (OT).”

Daniel dos Santos

What to do

Forescout advises organisations to undertake a proper risk assessment to understand how their attack surface is growing. Granular classification information including device type, vendor, model and firmware version are required for accurate assessment. 

Once this assessment is complete, organisations should mitigate risk with automated controls that are not reliant on security agents, and that apply to the whole enterprise, instead of silos like the IT network, the OT network, or specific types of IoT devices.

Once the risk assessment is complete, organisations need to mitigate risk with automated controls that do not rely only on security agents and that apply to the whole enterprise, instead of silos like the IT network, the OT network, or specific types of IoT devices. 

Forescout Continuum enables these types of controls by accelerating the design and deployment of dynamic network segmentation across the digital terrain while also automating policy enforcement by enabling countermeasures to mitigate threats, incidents and compliance gaps.

Understand what makes the riskiest connected devices so risky. Then strive for full visibility into how many are connecting to your digital terrain so you can secure your attack surface.

The post Report reveals riskiest connected devices in enterprise networks appeared first on FutureIoT.

The paper covers the top business and technological challenges faced by stakeholders such as airlines, identity providers including mobile operators, satellite and air-to-ground backhaul services, avionics vendors and hub services that facilitate roaming.

The on-the-air connectivity challenge

One major reason is the difficulty connecting to the Internet due to the traditional captive portal method. Passengers must connect to the correct Wi-Fi (network SSID), then navigate to the correct landing page and finally determine which pass they want to buy, and how to register and pay.

In an online journey, each incremental step usually leads to dropouts, and for airlines, service providers and other ecosystem members, every dropout due to this unnecessarily complex connection process are lost revenue.

Airlines have invested in inflight portal services, and an employer’s VPN is a barrier for business travellers consuming these. Once they have internet connectivity, connecting to their VPN will prevent them from being able to access these onboard services.

To regain access, they must disconnect their VPN. This back-and-forth makes them less likely to purchase in-flight services such as inflight food and duty-free — another revenue loss for airlines and other ecosystem members.

The report claims stakeholders can overcome these and other major barriers and improve the process by implementing Passpoint.

Passpoint frees passengers from the hassle of manually entering log-in credentials every time. Instead, the aircraft’s network automatically authenticates and connects them on every flight with an automatic, secure and friction-free user experience.    

 It also lays the foundation for airlines and other ecosystem members to participate in the WBA’s OpenRoaming federation. By simply adding the appropriate Roaming Consortium Organisation Identifiers (RCOIs) to the network, airlines and other ecosystem members can leverage the enhanced security, privacy, and automatic network-attached experience afforded by Passpoint, which are key concerns for business travellers, with the convenience of OpenRoaming for authentication.

As a federated service, OpenRoaming also ensures that travellers get and stay connected at additional locations throughout their journey to and in the airport, hotels, convention centres and any other public locations, and finally on board the aircraft. Airlines can use this gate-to-gate experience to create new loyalty opportunities for travellers, and new monetization models with identity providers and partners.

Going forward, WBA members have already agreed to move one step further and start developing industry guidelines for users' digital experience when using Wi-Fi networks. This ultimately will unleash a consistent experience across networks with non-fixed backhauls, such as maritime and trains use cases. Ultimately, an integrated and consistent mechanism will be trialled initially by WBA members in real-world scenarios and create the standard for commercial rollout. 

Tiago Rodrigues, CEO of the Wireless Broadband Alliance, commented that connectivity today is fundamental for daily lives and Wi-Fi is the most used wireless connectivity technology in the world.

“The in-flight Wi-Fi experience must improve to give vacationers and business travellers access to flight information, entertainment, social media and more. But a host of technological and business challenges have prevented in-flight Wi-Fi from living up to its mainstream potential.”

Bruno Tomas, CTO of the Wireless Broadband Alliance said: “Airline travel is soaring, with international traffic up 229.5% over the past year and total traffic up 76.2%, according to the International Air Transport Association (IATA). “That trend means now is the ideal time for airlines to take a fresh look at their in-flight Wi-Fi experience. This report shows how they can use Passpoint and WBA OpenRoaming to eliminate complexity so passengers can take full advantage of all their in-flight services.”

The post New framework to improve connectivity in the air appeared first on FutureIoT.

The increasing frequency of OT/ICS cyberattacks is serving as a wake-up call to organisations. Cybercriminals are using a range of techniques to launch a tsunami of attacks against OT and ICS systems.

The impact of these attacks can affect the masses by causing civic unrest, and governments in some countries are taking pre-emptive measures to stop these attacks.

For instance, the Cyber Security Agency of Singapore (CSA) created the OT Cybersecurity Masterplan in 2019 to enhance the security and resilience of the nation’s Critical Information Infrastructure (CII) sectors in delivering essential services.

Its goal was to improve cross-sector response to mitigate cyber threats in the OT environment and to strengthen partnerships with industry and stakeholders, proving that the threat of OT/ICS attacks is imposing enough for governments to act before they happen.

 In today’s manufacturing and utility networks, feeble defences across assets, managed and unmanaged devices give adversaries the advantage to launch attacks.

Without direct action to harden OT networks and control systems against vulnerabilities introduced through IT and business network intrusions, OT system owners and operators will remain at indefensible levels of risk.

An example is Iran suffering a major attack on its fuel stations nationwide in 2021, which disabled a system that allowed millions of Iranians to use government-issued cards for fuel at a subsidised price.

In total, 4,300 fuel stations were victims of the attack with traffic in cities being widely affected in an attempt to get “people angry by creating disorder and disruption”, according to Iranian president Ebrahim Raisi.

Similarly, petroleum powerhouse Oil India suffered a cyberattack disrupting the company’s operations in Assam earlier in 2022. In the attack, they received a ransom demand of USD 7,500,000, disrupting business through its IT systems.

The company reported huge financial losses due to the attack. When securing against today’s cyber threats, it is important to understand the game plans of threat actors and proactively counteract them with solutions.

Let’s start with Sun Tzu to understand our enemy’s 5 steps into our ICS and OT environments:

1. Effects and targets: 

APT actors, or state-sponsored actors, are looking to create chaos, sow discord, or destabilisation of leadership. To do so, they typically vet out critical assets within critical infrastructure like controllers in marine ports, energy generation/distribution points, and highly visible targets where disruption may cause harm, distrust, or may psychologically or socially impact a community.

Conversely, cybercriminals are looking for a payoff and are more than happy to find high-value targets anywhere within an organisation to extort their owners. While there may have been a wide gap in the past, the skills, backing, and training between the two are narrowing.

WHAT TO DO: Define your critical protection surfaces. Not all systems and components are created equal. Begin by identifying the most critical surfaces and grow to incorporate additional surfaces over time.

Within OT, this may be a bank of Windows machines that allow for remote access into a PLC segment where third-party lateral connections are established for maintenance and support. Within IT, these may be north-south assets that allow for pivoting from IT into OT, especially if IT connections to the Internet are present.

2. Intelligence collecting on the target system: 

It is widely known that information about both OT systems and IT technologies is widely known. Publicly available documentation on both IT and OT systems and components are not hidden, including default admin credentials.

WHAT TO DO: Never allow for default admin credentials to reside on any asset and continually rotate passwords.

3. Developing techniques and tools: 

Adversaries can be quite resourceful, especially with readily available tools on the dark web. Presuming devices are secured because they run proprietary protocols is a zero-sum game as tools are readily available to exploit IT and OT systems.

APT actors have also developed tools to scan for, compromise, and control certain Schneider Electric PLCs, OMRON Sysmac NEX PLCs, and Open Platform Communications Unified Architecture (OPC UA) servers.

WHAT TO DO: Acknowledge that standalone, islanded networks are few and far between. Do not presume a posture of security by obscurity. Monitor application usage and ICS traffic to include authorised user access and behavioural anomalies.

4. Gain initial access:

Most modern control systems have remote access capabilities that allow third-party vendors and integrators into the systems, as well as work-from-home, remote access and the supply chain. Oftentimes, these points of access into the network are attack vectors for cyber actors. Matters get worse when we add wireless access points to the mix that attract local actors into the fray.

WHAT TO DO: Audit all third-party access. Ensure the ability to pivot to high-value targets is non-existent. Take advantage of VLAN technologies to create safe holding pens for devices as they are introduced into your network prior to introducing them into the production network. Look for devices with multiple NICs attaching to differing networks, creating bridges from ‘A to B’.

5. Execution: 

The disruption, disabling, denying, and/or destruction of the system, to achieve intended results. This might include the degradation of the monitoring of a target system (Manipulation of View [T0832] ), operation of the control system (Manipulation of Control [T0831]), SCADA impairment (Block Reporting Message [T0804], Denial of View [T0815]), denial of control (Denial of Control [T0813]), or Theft of Operational Information [T0882]).

WHAT TO DO: Monitor industrial control commands and anomalous behaviours coming from unauthorised machines, unauthorised users, commands occurring outside of change control, and multiple reset, errors, and mode changes in critical infrastructure.

As system owners and operators, we cannot prevent a malicious actor from targeting our systems. Understanding that being targeted is not an “if” but a “when” is essential. By assuming that the system is being targeted and predicting the effects that a malicious actor would intend to cause we can employ and prioritise mitigation actions.

It all starts with identifying the initial system and all its sub-components within a protected surface. Once we find success, repeating across the broader OT landscape gets easier each time.

The post Understanding threat actors’ steps into OT and ICS environments appeared first on FutureIoT.

The real-time nature of IoT data presents opportunities, challenges and threats to organisations. Analytics will have to happen in real time for companies to benefit from these types of data.

According to Niraj Naidu, APJ head of field engineering for DataStax, the internet of things (IoT) refers to the billions of internet-connected devices around the world that use different types of sensors to collect real-time data remotely.

He adds that the IoT use cases span many different industries in a wide range of applications, depending on the application, the data that is collected from these devices can be used to perform analytics.

These devices need support from a modern technology stack that can ingest and handle a continuous flow of real-time and often time series data. Some IoT devices may have multiple sensors collecting different types of data.

“All that data flows in and is integrated into a platform where analytics are applied, patterns emerge from the analytics and insights are uncovered. These insights are then effectively converted into useful information that is delivered to end users via the IoT application user interfaces.”

Niraj Naidu

“And so, we see the type of valuable information will vary by each application’s purpose, but it could be a recommendation it could be an alert, a status update, or any other variety of use cases being tackled by specific IoT initiatives that you know, these organizations have,” he added.

The six challenges of a growing IoT ecosystem

Naidu forecasts that by 2024, the global IoT market is predicted to surpass a trillion dollars annually.

He posited that due to this growth, companies are now speedily accumulating hundreds of terabytes or even 1000s of terabytes of data, depending on the industries that they're based in.

“These companies are therefore having to deal with many different challenges when it comes to managing data produced by these IoT devices or even gadgets.”

There are six main things that we tend to see:

Scalability: Companies need a modern architecture that can quickly and seamlessly scale alongside the number of users’ devices or even the associated data volumes if they suddenly skyrocket to this.

Security: Data flowing in from IoT devices can be located anywhere globally, and there is a high probability that some if not all of it, is sensitive information. A company trying to completely handle the security of this data internally places itself at risk of a breach occurring.

Control: Data should be a company's most asset, and IoT collection and analysis can yield some amazing insights that will lead to them creating a competitive advantage for them in their markets. Organizations should therefore have complete control over that data and their data. And be able to migrate whenever and wherever they want and make it a first-class citizen.

Performance: The value that can be gained from IoT data depends on its timelessness. And the effectiveness of IoT devices largely relies on the responsiveness of the system. The platform that can truly handle millions of devices, and elastically scale with any unexpected spikes, can do all of this without slowing things down

Flexibility: Companies need that flexibility to speedily adjust, when necessary, to handle that rarity of data and devices. The database should have the ability to deal with many different types of data models and cloud environments that these IoT devices are generating.

Availability: That's one of the other key challenges that organizations are having and the success of an IoT system requires continuous flow and exchange of data, and as such going offline, it could be disastrous.

“When it comes to smart products, smart devices customers expect to access and information to be just to be available right at the click of a finger. The systems must therefore always be online, with no single points of failure,” he concluded.

Data infrastructure for IoT

Naidu suggests that the data infrastructure for an IoT system today needs to be open. It is built on a modern data management layer that once again can ingest large volumes of high-velocity data that these IoT devices and gadgets are created.

There are three parts to the system there is device connectivity, IoT Hub and the business layer.

Device connectivity is metadata information for each deployed device that needs to be managed. Each of those management layers is looking at specific things like the device registry device. Once again, metadata right device configuration, looking at device states, the device commands and interactions, and device shadows.

This part of the IoT system also contains field gateways, specialized devices, or software that acts as a communication enabler in even a local device control system, and a device data processing hub.

The IoT Hub is where all the data comes together to allow operations, administration, and insights to take place. It has two or more types of storage, looking at a hot layer for ingesting and a holding layer for recent data and another cold layer for older data.

That hub can be on-premises or close to the edge or in the cloud depending on the scale of the data or latency requirements that the organization may have.

There are then two types of analytics that can be conducted via that hub. There's real-time analytics right as data arrives at a central hub. It is streamed with event streaming technologies, which allows complex event processing tasks and analytical tasks to take place.

Batch analytics is ideal for cases where large amounts of data must be analysed right with batch queries, or even ad hoc queries, as those systems or users require.

At the business layer is where all the data from those devices’ gateways and, other sources come together to provide analysis for actionable insights. This analysis provides the ability to spot anomalies and explore trends and measure operational efficiency is just an example.

Other tools like artificial intelligence and machine learning form the basis for predictive maintenance and operation.

“I think that those three elements, they're aligned around device connectivity, the IoT hub in the business layer is what really kind of help form the right data infrastructure, architecture for IoT.”

Click on the PodChat player as Naidu elaborates on how to achieve better results using IoT analytics.

1. What is IoT analytics?
2. How prevalent is the use of IoT analytics in Asia?
3. We know that IoT produces a lot of data. What are the real challenges why enterprises struggle to better utilise/monetise the data produced by IoT?
4. Can you name a high-value/promising use case of IoT analytics?
5. What would the data infrastructure for IoT look like?
6. Do you see IoT streaming data as further complicating (or facilitating) IoT analytics adoption?
7. Where does DataStax sit in the adoption of IoT analytics?

The post PodChats for IoT: Working with IoT data analytics appeared first on FutureIoT.

These are some of the findings from the 2022 IoT & Edge Developer Survey, published by the Eclipse Foundation and administered by the Eclipse IoT Working Group, the Eclipse Edge Native Working Group, and the Eclipse Sparkplug Working Group.

Another survey finding is that edge computing is gaining traction in real-world applications as top edge computing workloads all show significant increases in adoption.

“IoT and edge computing are arguably the most important technologies today, particularly for industries like industrial automation, agriculture, and automotive,” said Mike Milinkovich, executive director of the Eclipse Foundation.

The post Survey reveals top edge computing workloads appeared first on FutureIoT.

Matter devices offer consumers assurances of secure use through a consortium-led standard for authenticating device identity that only allows Matter-certified devices to connect to the network.

With the high-profile hacking of critical infrastructure, security remains an important issue that the ecosystem or manufacturers, users and regulators need to address before the next major disaster occurs.

“The introduction of Matter to the smart home industry is an exciting move that improves interoperability between devices and raises the bar for security, creating a more efficient and secure experience for consumers,” said DigiCert VP of IoT Security Mike Nelson.

It also presents new opportunities for organisations like DigiCert to make available new offerings. This includes DigiCert’s announcement that its Root Certificate Authority (CA) is approved by the Connectivity Standards Alliance (Alliance) for Matter device attestation.

As the first Matter-approved root CA, also known as a Product Attestation Authority (PAA), DigiCert can now provide rapid time to market for smart home manufacturers looking to earn the Matter seal on their products.

“Device attestation allows existing Matter devices to locally confirm new ones when they have been recognized by the local network, and quickly remove non-compliant devices when needed. Consumers are no longer under the burden of ensuring new devices are secure; it happens automatically,” said Chris LaPre, Director of Technology at the Connectivity Standards Alliance.

DigiCert contributed its expertise to the security and attestation components of the standard and has the scalable technology to enable an efficient path to compliance.

“DigiCert has been involved in building the Matter standard for several years, and we’ve already helped many leading companies evaluate their device attestation procedures using our test Certificate Authority. Now, with our PAA approved for production, we are ready to help customers save time in achieving Matter security compliance,” Nelson elaborated.

What DigiCert offers to Matter participants

• Accelerate time to market in achieving Matter compliance.
• Save money by avoiding the costs of technology, maintenance, staffing and ongoing compliance.
• Enjoy flexible deployment options, including on-premises, hosted or batch issuance.
• Simplify management of device attestation certificates and product attestation intermediates through the DigiCert IoT Device Manager.
• Gain efficiencies using a scalable platform to sign and secure device updates.

The post DigiCert offers Root Certificate for Matter devices appeared first on FutureIoT.

IoT Analytics also reports record levels of VC investments for IoT firms, including acquisitions in the areas of AI and analytics. It is anticipated that despite headwinds like rising inflation and prolonged supply chain disruptions, overall sentiment will continue to be positive as the number of connected IoT devices reach 14.4 billion by the end of 2022.

With this growth, we can expect more targeted and perhaps creative ways of attacking both producers and enterprise consumers of IoT devices in the years ahead.

According to Satyajit Sinha, principal analyst for IoT Analytics, organisations tend to focus on security from a softer aspect or had network security at best.

“We have never seen security from the device aspect, and IoT demands different requirements of security such as authentication, authorisation, and identification. Most devices are secured through software security which is not adequate as they are vulnerable to attacks.”

Satyajit Sinha

“The more we create awareness about IoT devices security, the more people will implement security in their devices,” he added.

How adequately do you think current IoT ecosystems are secured, especially for unmanaged IoT devices?

Satyajit Sinha: The IoT devices do not have the capability to hold a higher level of security because of the power constraint thus security will always be a challenge. However, if these devices are connected to a gateway or a router, they can secure the touchpoint of the network and IoT ecosystems. It is not the case for small devices or unmanned devices.

Are concerns around IoT security justified? Or why does the IoT ecosystem require security?

Satyajit Sinha: People are focused on securing devices that create critical data, autonomous driving and intelligent devices for example. But this should not just be about selected devices.

A thermostat may not provide critical data so you may disregard whether it is secured or not. But, if it is linked to your home gateway, it is easy for someone to hack into your network and get all the information from all other connected devices.

What is the strategy that will secure IoT?

Satyajit Sinha: For hackers, it is a business. They will not invest their time and money in devices with multiple layers of security. So, the best strategy is to have multiple layers of security from hardware to software to network to cloud security. Connect these four and create end-to-end security, also called chip-to-cloud security.

What are the challenges or roadblocks to securing IoT end-to-end?

Satyajit Sinha: First is having the right policies and regulations. There needs to be proper regulations and direction for security implementation in the market. The second is industry sentiment.

"Treating security as an extra cost will incur a burden in the long term. We need to understand that if you don't spend on that extra secure element chip, you will have to pay more in a ransomware attack."

Satyajit Sinha

Last is device provisioning and key management services for chip-to-cloud security. It is difficult to manage security especially if you switch between service providers.

What are the key similarities and differences between traditional IT security and IoT Security?

Satyajit Sinha: The similarity I believe is that both are accountable not just at the OEM level but also platform and the cloud level. The difference is that it is new for the IT industry to manage IoT security with multiple applications. There are many standards, and numerous players come up with their own solutions.

How much is post-quantum security relevant for now?

Satyajit Sinha: All IoT devices have a lifespan of about 10 to 15 years which means they are not capable of quantum security in the long run. Security needs to be future proof and there is no extra cost for adding quantum-level security so organisations should consider having it.

Click on the PodChat player to listen to Sinha on the state of the security of IoT devices in Asia.

1. How adequately do you think current IoT ecosystems are secured, especially for unmanaged IoT devices?
2. Are concerns around IoT security justified? Or Why does the IoT ecosystem require security?
3. What is the strategy that will secure IoT?
4. What are the challenges or roadblocks to securing IoT end-to-end?
5. What are the key differences between traditional IT security and IoT Security?
6. How much is post-quantum security relevant for now?

The post PodChats for FutureIoT: Securing IoT beyond 2022 appeared first on FutureIoT.

Low Power Wide Area (LPWA) network technologies, such as 3GPP standards like LTE-M and NB-IoT, offer long-range communications with broad coverage, the ability to handle a large number of devices and low power consumption to IoT devices to operate for 10 years or more.

Relay allows for battery-operated, easy-to-deploy network coverage extensions at a fraction of the cost of adding additional gateways.

Challenges however remain. Participants in a VDC Research-sponsored study, identified several challenges related to IoT system development using LPWA including 1) minimizing power consumption; 2) securing IoT data; 3) lowering project development time, and 4) reducing the total cost of ownership.

Working on the problem, the global association of companies backing the open LoRaWAN standard for the internet of things (IoT) low-power wide-area networks (LPWANs), the LoRa Alliance has expanded the LoRaWAN link-layer standard with the addition of a relay specification.

This allows LoRaWAN to achieve excellent coverage in use cases requiring deep indoor or underground coverage, or relay data on satellite-connected LoRaWAN devices within proximity.

“LoRa Alliance members identified that end users in specific markets needed a solution to achieve full network coverage due to environmental challenges surrounding their deployments,” said Donna Moore, CEO and chairwoman of the LoRa Alliance.

“With relay, we’re providing a standardized solution that allows for full end-to-end communications in the extremely challenging underground, metal and concrete environments where sensor signals could use a boost or redirect to reach either the gateway or end-device.”

Donna Moore

She added that the new relay feature is a direct response to market needs and provides an essential building block to enable massive IoT.

Relay use cases

One of the first markets to adopt relay is metering in the utility sector. Utilities represent a massive opportunity for IoT, with VDC Research estimating that worldwide LPWAN communication services revenue will reach $2.47 billion by 2025.

Adding relay to the LoRaWAN standard to achieve coverage for even the most difficult cases (e.g., meters inside metal closets) significantly strengthens LoRaWAN’s market position in metering and utilities, and more broadly across key verticals including smart cities and buildings, and industrial IoT.

Using a relay is ideal for any application monitoring static assets in challenging environments.

LoRaWAN relay feature

The LoRaWAN standard is proven for long-range communications, however, there can be physical limits to where LPWAN communications can reach, such as around turns, underground, where a signal needs to be reflected/relayed into a specific location, etc. LoRaWAN relays allow signals to go where they physically couldn’t go before.

The LoRaWAN TS011-1.0.0 LoRaWAN Relay Specification document describes the relaying mechanism used to transport LoRaWAN frames bi-directionally between an end-device and gateway/network server via a battery-operated node. By enabling relay, the device can transfer LoRaWAN frames between an end device and network when there is insufficient coverage from the gateway.

This specification enables Network coverage extension through the battery-operated relay and maintains compatibility with the LoRaWAN Link-Layer standard in terms of protocol and security. The new relay nodes are battery-powered and can be installed anywhere and do not require electricity or internet connectivity. This makes them a very easy-to-deploy, low cost and low-power way to extend network coverage, without needing to add additional gateways. Relay endpoints allow LoRaWAN to provide coverage of all devices with only a nominal cost of installation.

The post Relay feature extends LoRaWAN coverage for metering, utilities, smart cities and industrial applications appeared first on FutureIoT.

“Moving from the cloud to the factory floor, some manufacturers are turning to a micro-factory model, which relies on automation and robotics to create more flexible manufacturing frameworks that can be deployed in a fraction of the time and at scale.”

CB Insights

IoT Analytics forecasts the Internet of Things (IoT) market will grow by 18% to 14.4 billion active connections. It also posits that by 2025, as supply constraints ease and growth further accelerates, there will be approximately 27 billion connected IoT devices.

These billions of connections are a natural magnet luring cybercriminals looking for new targets and new opportunities.

According to CB Insights this “plunging deeper into virtual worlds opens up the playing field to more cybercrime: security solutions will become a major priority, especially as crypto hype and data privacy controversies continue to boom.”

Creating awareness about IoT vulnerabilities

BlackBerry EVP and CTO, Shishir Singh says the massive network of connected things will require interoperability between systems. He posits that organisations need to sensitize employees to the fact that IoT introduces unprecedented safety and privacy risks.

He believed that employees in government and enterprise organisations need to wake up to the fact that bad actors can now access records from any device, anywhere, in real-time, and cautioned that more worrisome is the fact that IoT device makers oftentimes omit rigorous testing and support just so they can get products out to the market sooner.

“They also frequently abandon development of software and security updates the moment products are released, leaving customers—both enterprise and consumers—with an ever-increasing number of unsecured devices in their environments,” Singh continued.

But while IoT is proliferating in any enterprise, it is on production floors of industrial operations where industrial IoT (I-Iot) is rapidly becoming an integral part of the Operational Technology (OT) landscape,” said Rafael Maman, vice president of OT security at Sygnia.

He posits that it is this risk related to I-IoT that is not well articulated, resulting in low awareness.

“These I-IoTs must be considered as part of the OT environment, both to work towards better cyber preparedness and resilience, and organisational awareness."

Rafael Maman

According to Srinivas Kumar, VP of IoT solutions at DigiCert, vulnerabilities in IoT extend beyond published exposures and exploits. He noted that the “closed” and “siloed” nature of OT/IoT ecosystems provide limited visibility through on-device logs or control through third-party intervention.

“OT/IoT devices are micromanaged by the original equipment manufacturers (OEMs) in production environments. This creates a blind spot for NOC/SOC supervision and mitigation. Application security by design and a security profile for device field operations are essential to qualify and certify IoT devices for compliance and achieve cyber resilience in connected systems.”

Srinivas Kumar

“A comprehensive approach to digital trust ensures that all access points and data are properly authenticated and encrypted, and that identity- and access-based attacks are given an extra layer of protection that can be enforced and monitored throughout the organisation,” said Kumar.

Recommendations for creating sustained awareness around IoT security

Sygnia’s Maman recommends considering IoT, specifically I-IoT, as an integral part of the OT environment, and managing the related risk landscape as part of the overall OT security framework.

“And include it in all your cyber awareness campaigns and training programmes – again, as an integral part of your operational technology – and make sure to highlight the additional risk it introduces to your OT environment,” he pushed forth.

Kumar adds that cybersecurity in multi-vendor and heterogeneous device ecosystems is a collaborative effort and requires OEMs, device operators, device owners, and regulators to set mandatory compliance standards and best practices for endpoint security on headless field devices.

“The paradigm shift in OT/IoT ecosystems is to harden devices for protection throughout the active service life that may span 10-30 years,” concluded DigiCert’s Kumar.

BlackBerry’s Singh believes that an effective way to drive greater awareness about IoT vulnerabilities is to inform employees about their responsibilities from day one – adapting cybersecurity processes and policies as part of the company’s onboarding is a good method to educate users.

“Besides regular and mandatory training programmes that all employees must undertake, conducting cybersecurity drills like simulated crisis management exercises can raise awareness, preparedness, and ultimately reduce the impacts of critical events.”

Shishir Singh

“Lastly, ensure that IoT security training is targeted and easy to consume. Sharing irrelevant and confusing details about the threats of IoT vulnerabilities can be counterproductive. Communications should be kept simple, concise, and easy to understand as not every employee is an IT expert,” concluded Singh.

The post Creating cybersecurity awareness for IoT appeared first on FutureIoT.

ABI Research says these headwinds are pushing security higher on the enterprise priority list as organisations seek cost-effective and agile cryptographic applications to protect increasingly distributed and ephemeral corporate assets.

In response, hardware security modules are changing rapidly to meet these new demands.

“The Hardware Security Module (HSM) market was already on track for a shake-up, as new business models and new competitors vied to take advantage of emerging opportunities around enterprise digital transformation and cloud migration,” states Michela Menting, cybersecurity applications research director at ABI Research.

She added that presently enterprises are tightening budgets amid worries about their business stemming from high inflation and a potential recession.

“For HSM vendors, the market opportunity is clearly within the cloud, as enterprises will opt out of owning expensive HSMs in favour of Operational Expenditure (OPEX) service-based models,” she continued.

Stuart Carlaw, chief research officer, concludes, “We should heed one of the most important business lessons learned during 2020—that technology will not be a casualty of uncertainty, but rather a tool to overcome it.

“Companies that embrace, invest in, and deploy technology wisely will undoubtedly emerge stronger and better prepared to handle the next spate of challenges on the horizon, no matter the weather.”

Stuart Carlaw

The post Global macroeconomic headwinds are reshaping security spending appeared first on FutureIoT.

Commissioned by Armis, The Forrester report, State of Enterprise IoT Security in North America, revealed that 74% of the respondents felt their security controls and practices were inadequate for managed, unmanaged assets across IT, cloud, IoT devices, medical devices (IoMT), operational technology (OT), industrial control systems (ICS), and 5G.

Keith Walsh, OT security and operations director at Armis, says the trouble with many installations within organisations is that each department tends to go solo on management and risk containment.

He cites the example of departments that may have managers over OT/ICS facilities, for instance: air conditioning, sanitation, telecommunications, and other functions. Server rooms and computers of all shapes and sizes may be managed by a separate IT department.

Outside a typical office, a process plant in the oil and gas, petrochemicals, and chemicals industries, or a power plant (nuclear, other renewable, or fossil), will yet have different field operations and maintenance managers managing various safety and other controllers. The expertise demanded by these fields tends to be disparate and so it would be difficult to converge all such manageable assets into a single department or system.

“For unmanaged devices, which may include OT and IoT, these may yet be another hurdle for organisations, since they may never have been defined as a security hazard, until recent times when 5G/LTE and broadband have permeated throughout every facet of an organisation.”

Keith Walsh

“So, it is safe to say, we can imagine the typical organisation may not have a complete security profile for all managed and unmanaged devices. Asset visibility is the first step in developing a security framework. You can’t secure what you can’t see,” he added.

As more devices in the homes connect to the internet, security and privacy concerns rise to new levels. The Palo Alto Networks’ The Connected Enterprise: IoT Security Report 2021 found that the problem has gotten worse with the rise of working from home. 81% of those who have IoT devices connected to their organisation’s network highlighted that the transition to remote working led to greater vulnerability from unsecured IoT devices.

“The bottom line is that while organisations are adopting best practices and implementing measures to limit network access, digital transformation is disrupting not only the way we work but the way we secure our ways of working,” explains Alex Nehmy, CTO of Industry 4.0 strategy for Asia Pacific & Japan at Palo Alto Networks.

He posits that safeguarding unmanaged and IoT devices continue to be an ongoing challenge. With most cyberattacks accessing corporate networks months before they are detected, ongoing monitoring and IoT device security should become a key focus area of a corporate IoT security strategy.

The real and present danger

The hacking events that we now remember including the Colonial Pipeline ransomware attack, meat packer JBS and the Triton malware attack against a Saudi petrochemical plant suggest that organisations will continue to be targeted as long as there are gains to be made.

Nehmy warns that most of today’s IoT security solutions provide limited visibility by using manually updated databases of known devices, require single-purpose sensors, lack consistent prevention and do not help with policy creation.

“They can only provide enforcement through integration, leaving cybersecurity teams to do the heavy lifting, blind to unknown devices, and hampering their efforts to scale operations, prioritise efforts or minimise risks,” he added.

Walsh further warns that the mature security processes that were born out of IT are now colliding with OT, as industry 4.0 becomes more pervasive. IoT devices also tend to be simplistic and lack sophisticated patching and firewalling capabilities.

“Looking ahead, Industry 5.0 is only going to increase the interaction between humans and machines to the point of necessitating real-world human safety protocols that go beyond current OT and IT security measures,” he continued.

The IT-OT convergence – who’s the boss?

Nehmy believes that the onus of IoT security rests on the shoulders of both operational technology (OT) and information technology (IT) teams and they need to work collaboratively to ensure IoT security is adequate.

Having an IoT security system that provides a single pane of glass to give these teams a consistent level of visibility, monitoring and enforcement across both IT and OT environments, also helps bring these culturally diverse teams together, regardless of the systems they’re securing.

When organisations have limited visibility of IoT and OT devices, it hampers their ability to begin securing them.

“You can’t secure what you can’t see. One of the best practices for integrated IT and OT security involves conducting continuous monitoring and analysis."

Alex Nehmy

"The key focus should be on implementing a real-time monitoring solution that continuously analyses the behaviour of your entire network,” explained Nehmy.

Additionally, IT and OT teams should work together to ensure the IoT attack surface is managed by enforcing segmentation between IoT devices, OT devices and business-critical IT systems.

Strategy to secure IoT

Asked to name one strategy to secure IoT, Armis’ Walsh suggests understanding and identifying the attack surface.

“Once we do that, we can then properly patch, segment, and monitor transactions and interdependencies of those devices. Mitigating risk all starts with understanding and identifying the attack surface of our critical assets,” he added.

IDC cautions that IoT can very easily become the weak link or entry point for attacks in any organisation, which is why IoT solutions need to be secure by design. Extending a zero trust framework to IoT deployments can enhance security and reduce risk, but it is an enterprise-wide strategy that requires a complete understanding of all IoT systems on the network.

Nehmy concurs adding that implementing Zero Trust for IoT environments is the best approach for IT and OT personnel to devise an IoT security strategy that enforces policies for the least privileged access control.

Building a business case for IoT security

IoT and OT devices usually make up more than 30% of devices within corporate networks, 57% of which are also susceptible to cyberattacks, as they are built without security in mind and contain existing vulnerabilities.

“The attack surface of IoT devices permeates across all environments of the enterprise. While organisations may not yet spend more in managing the security of all connected assets, the increasing attack surface needs to be addressed holistically,” warns Walsh.

The attacks against Colonial Pipeline and JBS may have occurred in the US, but Deloitte believes that critical infrastructure operators in Asia Pacific are increasingly being targeted by cyber espionage and sophisticated attacks with the potential for severe disruption to essential services such as energy and water supply.

As IoT use grows in importance to the daily operations of critical infrastructure, adequately securing IoT and OT devices becomes a compelling business case, posits Palo Alto Network’s Nehmy.

He suggests that a comprehensive IoT business case should involve visibility of all IoT and OT devices, ongoing monitoring to detect security breaches, analysis of device risk and also the ability to protect and segment these devices. Ideally, this should be provided in a single security platform for the lowest total cost of ownership.

He opines that the monetary, reputational, and physical security repercussions of an IoT-based cyberattack, make it imperative for organisations to invest in advanced security solutions.

“Just as vaccinations keep us safe from COVID-19, investment in proactive prevention measures will place organisations in a better position to combat the IoT cybercrime pandemic,” he concludes.

The post IoT security realities – worse than you think appeared first on FutureIoT.

One of the earliest examples of IoT was in the early 1980s and it involved a Coca-Cola machine that was located at Carnegie Mellon University. Programmers would connect through the Internet to the refrigerated appliance and check to see if there was a cold drink available before making the trip to purchase one.

Most discussions around the IoT will likely revolve around the hardware. This is understandable that most of the enterprise IoT technologies we’ve become familiar with are with simple devices that perform a few tasks. For example, monitor the temperature in a production line.

But as advances in communications converge with business demands for doing things faster, better, more safely and cheaper, even technologies like IoT are evolving to include features that in some cases incorporate intelligence, manageability, and more recently, security.

This growing sophistication in the demand for IoT and expectations of what it can do means that IoT discussion is no longer limited to hardware design but must, by default, include software considerations.

FutureIoT spoke to Joanne Wong, vice president for international markets at LogRhythm, for her take on how IoT software is evolving.

What is IoT software?

Joanne Wong: Anything from lamp posts and running shoes to fish tanks can now be connected to the Internet with the advent of inexpensive computer chips, sensors, and wireless networks, which enables them to collect and share data in real-time autonomously without human interference.

IoT software connects the computer chips, sensors and networks in the broader system together. It plays a crucial role in the data collection and communication process, as well as the management of the IoT application and device itself.

Take smart lamp posts for example. The Singapore government plans to roll out 110,000 lamp posts equipped with a network of wireless sensors and cameras that will help to detect and monitor changes in environmental conditions, and track vehicle speeds – beyond illuminating the streets.

In this case, the IoT software controls the systems such that imagery and traffic data collected from the sensors and cameras are communicated to the central management system in the cloud, which is then turned into actionable insights.

Looking back from pre-pandemic to this period (mid-August 2022), how have things changed when it comes to IoT software?

Joanne Wong: The IoT software market has grown significantly over the past few years, in tandem with the accelerating adoption of IoT solutions and devices. While the sector was briefly affected during the pandemic due to a pause in technology spending for certain sectors, it has since regained much of its initial momentum. IDC predicts IoT spending in Asia Pacific to reach US$437 billion by 2025.

Over the years, IoT solutions have become more powerful and efficient, thanks to advancements in Artificial Intelligence (AI), Machine Learning (ML), edge computing, automation and other emerging technologies. Machine learning algorithms, for example, can add predictive capabilities to IoT solutions.

For example, sensors attached to machines in the manufacturing sector can monitor the performance of the equipment and predict when failures and breakdowns will happen. Having access to such information early on allows for the repair or replacement of faulty parts, to prevent wide-scale operational disruptions.

On the other hand, edge computing technology makes IoT devices with onboard analytics capabilities possible. This brings computing as close as possible to the source of data, reducing network latency and relieving network congestion, thus allowing for quick delivery of insights to the end user. On top of that, as personal data no longer needs to leave the individual domain, a lot of data privacy and security concerns with IoT can now be mitigated.

IoT as a service (IoTaaS) offerings have also emerged as a new way for businesses to access IoT solutions. Vendors such as Microsoft are moving towards offering IoT platform management services, which allows businesses to leverage IoT software and infrastructure without having to invest heavily into building the network architecture hardware, purchasing expensive software, or hiring trained personnel to manage the process.

In the period of accelerating digital transformation, which areas of IoT software have gained importance?

Joanne Wong: IoT security has become crucial for organisations looking to successfully implement IoT solutions.  This is because digital transformation acceleration has led to an influx of devices coming online. With the exponential growth in the number of devices now connected to the internet, the attack surface has also gotten significantly larger.

Opportunistic cybercriminals now have more entry points – from insecure connections, and legacy devices to weak digital links – to take control of these IoT devices to spread malware or gain direct access into the network to obtain critical data.

For IoT devices, the risks are doubly high for two reasons. Firstly, IoT devices typically do not come with in-built security functions, which makes them an easy target for hackers. Secondly, IoT devices, especially those that are small or light, can be easily misplaced or stolen. Unauthorised users who have gained physical possession of the devices can easily access your network.

This is also why cybersecurity is now a huge area of focus for IoT devices and software. On the other hand, failure to secure IoT ecosystems could lead to eroding trust in their potential across the organisation, as well as wasted investment costs. 

More technology providers are now adopting the “security by design” approach to IoT hardware and software development, which looks at building security features right from the initial developmental stage.

Cybersecurity platform vendors too are adding specific security features to IoT data collection and storage functions, to safeguard sensitive data flowing between the IoT device and network from unauthorised access.

Which industry sectors in Asia are leading the charge in terms of IoT software adoption and development?

Joanne Wong: With the worldwide pandemic over the past two years, organisations in healthcare are understandably one of the most active areas of IoT development. According to Data Bridge Market Research, the IoT APAC healthcare market is predicted to grow with a CAGR of 30.55% between 2022 to 2029. This applies broadly to the rise in telemedicine adoption and narrowing down to connected specialised equipment, all while accommodating to recent lifestyle changes.

Medical professionals are now able to collect patient data and understand patient conditions, without the risk of large group interactions. Healthcare IoT equipment inherently addresses the areas of shortage in hospitals, where necessary patient care and attention are provided for those in dire need. Additionally, it accelerates and improves access to healthcare services, especially reaching remote areas, beyond the pandemic.

Supply chain management is another sector thriving from IoT adoption. Frost & Sullivan highlighted that almost 21% of logistics companies in Asia currently leverage IoT for their fleet management solutions and this number is only set to increase in the next few years.

Industrial IoT has been the driver for parallel growth in smart manufacturing which includes factory automation, GPS shipment tracking and machine-to-people communications. The ease of data collection and real-time data encourages calculated risk-taking, allowing organisations to maximise opportunities for growth and revenue — more data, and more cost savings. For instance, better forecasting of demand, ship and fleet tracking and better risk management.

What needs to happen for organisations in Asia for us to see greater integration of IoT software in industrial settings?

Joanne Wong: With new manufacturing and smart city initiatives underway, there are numerous opportunities for greater integration of IoT software and the development of horizontal capabilities across industrial settings. This includes predictive maintenance and connected operational intelligence in manufacturing, as well as security and surveillance for smart cities.

However, closing the gaps in IoT security will be key to maximising the potential of IoT across industries and areas of operation. With more devices now connected to the internet, greater interconnection can pose higher cybersecurity risks for these industries.

It is more important than ever that organisations maintain clear oversight across their entire digital supply chain, including their IoT endpoints, to ensure that there is constant monitoring and surveillance for potential threats.

Companies should seek to redefine security ownership within the organisation to improve the management of IoT devices. Currently, IoT security falls under both the security and operations function - which may lead to confusion on whose responsibility it falls under.

At the same time, companies should also ensure that the adoption of security solutions is also compatible with the business needs — adapting to network changes, and automatically detecting, predicting, and responding to real-time threats.

The post IoT software trends in 2023 appeared first on FutureIoT.

The second, and arguably more dramatic, are the nearly persistent cyberattacks against private businesses and the continued operation of critical infrastructure. Nearly all industries are unable to escape unscathed from these attacks.

IoT adoption in manufacturing

Specific to Asia’s manufacturing sector, IDC is projecting continued growth in the integration of IoT technologies into the region’s manufacturing sector.

IDC estimates that in 2020, US$83.4 billion was spent on IoT technology by manufacturers in Asia/Pacific (excluding Japan) with discrete manufacturing accounting for 60% of spend. Process manufacturing spent more than US$33 billion in the same year.

By 2025, IDC expects discrete manufacturers will send US$88.7 billion compared to US$51.9 billion among process manufacturers. The analyst says manufacturers can profit greatly from retrofitting smart sensors to old equipment because of the insights they can obtain about their equipment

FutureIoT touched base with Piyush Singh, senior market Analyst for IoT Insights, IDC Asia/Pacific to discuss how IoT is trending within the manufacturing sectors of Asia.

Manufacturers, whether in process or discrete, have used instrumentations to get feedback and provide some control over the production line. How can a manufacturer introduce IoT technology without disrupting the production line?

Piyush Singh: Industrial IoT uses a network of sensors to gather crucial production data, and cloud software to transform this data into insightful knowledge about how well industrial activities are run. The primary use case for expenditure was operations, followed by production asset management, maintenance, and field service.

Most of the manufacturers start with pilot testing by upgrading the existing legacy machines with the implementation of various hardware products. Additionally, it is true that replacing a plant entails a lengthy period of machine downtime.

In terms of time, this is frequently unsustainable. In this regard, a refit operation evaluation would be helpful. The most difficult barrier to a retrofitting effort is that a legacy system has machine tools from many manufacturing eras with various connection protocols.

Process control must be carried out manually by monitoring, sensing, estimating, and modifying the machine parameters due to the lack of sensors and actuators.

"Usually, in Asia, the retrofitting is completed in a phased manner wherein one production line is taken for the upgradation to avoid unnecessary downtime in production. Once the transformation of machines is completed in one production line, later the retrofitting of other machines will be considered."

Piyush Singh

Specific to manufacturers in Asia, do you see information security including cyber security, as a priority over production? How has the perception/acceptance/attitude towards security changed over the last five years?

Piyush Singh: The fourth industrial revolution, often known as Industry 4.0, is the logical outcome of the third revolution and is primarily focused on two key elements: the Internet of Things and Services (IoT) and Cyber-Physical Systems (CPS).

In Asia, retrofitting is not only the key concept of factory automation. Cyber security, data security, and enhanced data privacy are all covered under one umbrella called industry 4.0.

With the growing demand for IoT in various sectors, the demand for robust cyber security is also the need of the hour. Spending on security solutions and services in Asia/Pacific is forecasted to exceed $31 billion in 2022, an increase of 15.5% from 2021 in which almost $2 billion in security spending would be under the discrete manufacturing section, according to IDC's latest Worldwide Security Spending Guide.

Despite headwinds such as looming global recession, geopolitical conflicts, and rising inflation, investments in hardware, software, and services related to cybersecurity are expected to reach US$ 57.6 billion in 2026, with a CAGR (compound annual growth rate) of 16.4% for the period of 2021-26.

China will continue to be the region's largest market, accounting for more than 40% of total Asia/Pacific* security spending in 2022, with a five-year CAGR of 21.2% during the forecast period. This clearly showcases that the demand for security infrastructure is increasing in the Asia Pacific manufacturing sector.

If you think of IoT integration in the manufacturing process as a timeline, what IoT technologies do you see being deployed over time and what other technologies do you anticipate will follow because of IoT?

Piyush Singh: Most of the downtime and accidents are caused by the wear and tear of machines in many manufacturing plants. By virtualizing the plant and averting high-risk operator occurrences, the retrofitting goal is to ensure predictive maintenance applications.

Remote monitoring and management system, digital connectivity, cloud storage and robotic process control are some of the IoT retrofitting trends seen in manufacturing processes. 

To identify and detect upcoming errors, Deep Learning algorithms and Digital Twin (DT) approaches is something which is being used and have the tendency to grow exponentially in future. Artificial neural networks (ANN) for detecting the tool wear in a CNC machine after retrofitting is a concept which is in great demand in many production plants.

The post The IoT horizon for Asia’s manufacturers beyond 2022 appeared first on FutureIoT.

A slew of new sensing technologies and multi-function smart sensing devices are gaining traction and providing a path to smart sensing that will enable smart commercial buildings to best adapt to the changing demands from smart commercial building owners and tenants alike. 

ABI Research forecasts sensor shipments will grow from 18.5 million devices to surpass 300 million by 2030, a CAGR of 35%.

Enhancing the management of buildings

In the effort to facilitate a move back to the office, an array of competing approaches, technologies, and devices are vying to bring new levels of monitoring and control to building environments in a market where building owners, operators, and tenants are incentivized to make buildings more appealing.

“Traditionally, sensing in the commercial building sensing market has been tied to establish systems, such as heating, ventilation, and air conditioning (HVAC), fire and safety, and access control, but a range of additional environmental sensing technologies, sensors, and devices are coming to market at a time of great upheaval in the commercial building market,” says Jonathan Collins, smart home & buildings research director at ABI Research.

Concerns over occupant safety, environmental impact efficiencies as well as more flexible space utilization are necessitating greater real-time building management intelligence. Increasingly valuable applications such as occupancy sensing can be supported by a host of sensing approaches, including microphones, cameras, motion sensors, pressure sensors, and even radar.  All deliver real-time insight into building usage, but sensor deployment can be selected related to the efficacy, cost, and end-user comfort. In addition, there are competing sensor technologies within each of those approaches, again with their own strengths and weaknesses.

While sensor players such as Bosch Sensortec and TDK Invensense target multiple markets with their offerings, more specialist players such as photonic product vendor Lumentum and AI intelligence player Ambarella have partnered to support the commercial building ToF sensing market. At the same time, emerging integrators such as Mindshare are leveraging feedback sensors into commercial building systems from players such as Skiply.

“As occupancy sensing, or air quality, or energy management, space utilization, and preventative maintenance push further into commercial building operations, systems integrators, building management providers, and sensor and device developers along with manufacturers will have to ensure they select and integrate the best technologies for as many applications as possible,” Collins concluded.

The post New sensing tech to make smart buildings adaptive to the new normal appeared first on FutureIoT.

This was done through the Ministry of Trade and Industry’s (MTI) Committee on Future Economy report, charting the transformation of the manufacturing industry into Industry 4.0.

In basic terms, Industry 4.0 refers to the use of digital technologies to support automation in the manufacturing sector, delivering value to every stage of the production process. It is impacting almost every aspect of how companies do business, especially when it comes to repairing and maintaining their machines.

Historically, businesses depend on taking a preventative approach to machine maintenance. However, downtime is too costly in an industry where the product (energy) is expected to be provided reliably and consistently.

One of the ways the energy sector can benefit from digital transformation and modernisation is by utilising intelligent, connected technologies that work behind the scenes, gathering and analysing data 24 hours a day.

Why adopt IoT

Here are three main reasons to adopt the Internet of Things (IoT) – Firstly, remotely collecting data allows energy businesses to operate remote services more effectively to, for example, improve efficiency or safety. Secondly, connecting devices helps shorten feedback loops.

For example, the data can deliver real-time insights into how customers use products or services. These insights provide a window of opportunity for fine-tuning them during the engineering and design stages.

Finally, when companies are proactive in machine maintenance, they can spot potential risks before they become high-cost problems. Businesses appear to be seeing the value in that, with estimates predicting the total number of connected devices to reach some 64 billion by the middle of this decade.

According to a recent IDC report, spending on IoT technologies in Asia-Pacific (excluding Japan) would reach beyond US$400 billion by the year 2026. IoT use cases that see the highest spending in 2022 include manufacturing operations and production asset management.

At the same time, Singapore’s steadfast investment in such technologies looks to grow the value of industries utilising such tech. Of the SGD3.8 billion committed to the ICT sector here, 70% will go into application building and upgrading.

With the value of projects adopting emerging technologies such as machine learning, sensors and IoT looking set to more than double from well under a billion Singaporean dollars on-year to $2 billion this year, unlocking the potential of Industry 4.0 will require Singaporean businesses to harness solutions that enable them to gain full value from these emerging technologies.

Replacing old-school preventative maintenance

Today, instead of more traditional ways, a company can use IoT-based, data-driven insights for preventative maintenance.

For example, a solar energy company tasked with installing solar panels for the Housing Development Board (HDB) under the SolarNova programme, which provides solar energy to over 8000 housing blocks in Singapore. Systems downtime due to hardware failure would not only negatively impact consumers, but also regulatory fines and reputational damage to the government.

With remote access capabilities provided through IoT-based data collection and artificial intelligence (AI) analysis, a business can observe when machines need attention based on real-time insights into vibrations, light density, temperature, and more.

What’s more, since IoT-based systems are constantly collecting data, processes get smarter over time. As a company assesses the machines’ data flow and executes repairs based on the data, the system will learn through (AI) to make even more accurate predictions.

Secure connected devices against cyber attackers

With the rise of supply chain attacks against manufacturing organisations, organisations must also consider the security risks and manage them through proper IoT device security measures and protocols.

Ways to enhance IoT security include ensuring equipment manufacturers follow good security practices. Organisations also need to layer security controls for a defence-in-depth approach to protect critical technology such as through patching, vulnerability testing, penetration testing, and network isolation to ensure that these connected devices are secured.

Onward together

Modernisation, automation, and data management are transforming today’s energy sector. With a steady flow of data from machines, one can achieve business outcomes based on strategic insights, which empowers organisations to save on labour costs and avoid expenses associated with premature machinery replacement.

For organisations in Asia seeking to utilise ground-breaking technologies, seeking out data modernisation teams with deep technical and business process expertise should be a priority. This would help them learn to design and build data architectures fit for accelerating innovation and realising value faster, not just in productivity but in sustainability as well.

The post Connected devices fuel data-driven efficiency appeared first on FutureIoT.

To add to the magnitude of the problem, the Asia Pacific region’s expenditure on IoT is anticipated to grow, reaching US$437 billion by 2025. This signifies that governments and private organisations will continue to leverage IoT technologies at an accelerated pace, as the push for digitisation sustains momentum in the post-pandemic world.

IoT technologies and devices are the backbones of any digital transformation process. They play a key role in driving automation, monitoring, and controlling the technology in smart buildings, ensuring a safe and seamless transition to a digitally enabled future.

However, many smart devices are not designed with security in mind or may have vulnerabilities from the source code used within the manufacturer's supply chain, of which users are unaware.

These security vulnerabilities combined with the rapid proliferation of IoT devices mean there’s an urgent need for organisations to think about the security of the devices on their networks.

As companies further invest in digital transformation, they need to pay an equal amount of attention to the security of the devices and technologies they use in their everyday operations.

So, what are the security concerns surrounding IoT devices, and what can we do about them?

Security limitations in IoT devices

Alarmingly, visibility into threats from IoT devices is often dependent on manually updated databases of known devices.

For instance, certain IoT devices do not have sufficient storage or processing power to support logging or cryptographic abilities that protect sensitive information from being processed, making them vulnerable. As a result, businesses cannot accurately identify and protect against the risk posed by unknown and unmanaged IoT devices.

In fact, such risks have increased with work-from-home arrangements. Our IoT Security Report 2021 found that 81% of respondents in Singapore who have IoT devices connected to their organisation’s network, saw an increase in non-business IoT devices on their corporate networks. Some of these devices include home devices, medical wearables and even game consoles. 

The hardware limitations to security controls in IoT devices, coupled with the rise of remote work, are some of the key factors causing regulators to turn their attention toward securing IoT devices across the region.   

Regulators set the tone

In response to the growth of IoT technologies in the Asia Pacific region, regulators have developed IoT security regulations and standards for organisations and users.

In Singapore, the government has been proactively addressing this need, through initiatives such as the Cybersecurity Labelling Scheme and the National Integrated Centre for Evaluation (NiCE) to protect consumers and businesses from malicious actors and to further research and be educated about IoT cybersecurity.

It has also established standards and published practical guidelines for IoT security (TR 64: 2018: “Guidelines for IoT security for smart nation” and Internet of Things (IoT) Cyber Security Guide). These guidelines are intended to serve as a blueprint for enterprise users and vendors to secure IoT devices.

Some of the key security measures outlined in the IoT Cyber Security guide include:

• Enforcing proper access controls for IoT devices (Section 6.4.1)
• Segmenting IoT and enterprise networks (Section 7.3.1)
• Establishing proper device management (Section 7.4.1)
• Conducting periodic vulnerability assessments on connected devices (Section 7.5.2)

Complying with local market regulations, on the Cloud

Digital transformation is fuelling IoT adoption in the Asia Pacific region and making organisations increasingly reliant on these devices for critical business operations.

At the same time, companies also must manage a growing set of local regulations on the usage and management of IoT devices and data. Government policies may dictate how data can be collected and retained and may even restrict the transfer of data across borders to prevent citizen data from being exploited.

It is common today to see businesses use a multitude of cloud services that host their data in different locations around the world. As such, regional companies that are reliant on cloud services to deliver services and enable remote work will find it challenging to comply with different local regulations.

Instead of using local servers to store data for every market, companies can use a cloud hosting solution in their market of choice to ensure that they can still take advantage of the cloud while staying compliant with local data regulations. Cloud hosting solutions that are built with security and regulatory best practices in mind will also allow businesses to meet both their data residency preferences while protecting their enterprise network. 

Businesses need to be proactive too

Aside from complying with regulatory standards, organisations must take the necessary precaution to proactively secure their networks in this digital economy as well.

A prerequisite to effectively applying these security measures is visibility into and an understanding of the identity and behaviour of all network-connected devices.

A zero-trust approach to network-level IoT security - where enterprises have full visibility of IoT devices, practice continuous device and risk monitoring, and develop security policies with enforcement actions to prevent cyberattacks from happening - is needed to ensure organisations can better eliminate critical security blind spots.

Organisations can also take preventive measures a step further by deploying Machine Learning (ML) technologies to automate device identification, proactively detect malicious deviations, and automatically prevent attacks. As adversaries get more advanced, organisations can leverage ML capabilities to help them always stay vigilant.  

IoT security is everyone’s responsibility

Both governments and businesses play an integral role in maintaining IoT security. The ubiquity of IoT devices will only mean that the applications of such devices will continue to grow across all industries, and it is everyone’s responsibility to protect themselves and the organisation from cyber adversaries:

• Regulators lay the groundwork for cybersecurity regulations and standards that can be applied at scale
• A cloud hosting solution with built-in security controls helps organisations meet data residency preferences while enjoying the benefits of the cloud
• Organisations need to proactively enforce a Zero Trust approach to eliminate IoT device blind spots and deploy ML technologies to automatically prevent attacks

The post Securing the smart devices across APAC’s cloud platforms appeared first on FutureIoT.

Medical analyst at GlobalData, Ashley Clarke says the healthcare, pharma, and medical device sectors are particularly susceptible to cyberattacks.

“Medical history cannot be changed, unlike identification and credit card information, making it invaluable to hackers and resulting in high costs for healthcare data breaches,” he added.

A growing concern

Medical devices have become increasingly connected as remote medicine soared during the COVID-19 pandemic. Many companies now struggle to accommodate provider, patient, and third-party access to sensitive patient information while ensuring security.

Clarke says hackers can use healthcare information to create fake insurance claims, buy and sell medical equipment, or acquire illegal prescription medications.

“They can also target victims with fraudulent schemes related to their medical history, which are more believable than financial or legal scams due to the intimate nature of health information,” he added.

Lessons from the US

According to reports of breaches affecting 500 individuals or more by the U.S. Department of Health and Human Services (HHS) Office of Civil Rights, over 41 million individuals in the US were affected by healthcare data breaches in 2021.

Cases affecting more than 22.5 million individuals in the US are currently under investigation this year, which is a 4.6% increase compared to the same time last year.

Devices like insulin pumps, heart pacemakers, inhalers, and wearables track patient data in real-time and even transmit to the user’s phone, making the data immediately accessible to both the patient and their doctor.

This increased data access has made the medical device sector more vulnerable.

This change in technology means that medical device companies and their business associates are now responsible for increasingly large amounts of sensitive electronic patient data and have been prey to significant data breaches in recent years,” said Clarke.

Without securing all components of the cybersecurity value chain, medical device companies will remain a primary target for hackers.

Clarke adds: “It’s crucial for companies to invest in a variety of technologies such as chip-based security, network security, and cloud security, at every stage of the product development to ensure patient information is safeguarded. Older legacy devices may be unable to receive security patches, but new devices should have a security update plan in place for their entire device lifecycle.”

Lessons from the UK

In the UK, the National Health Service (NHS) has been on high alert for cyberattacks following the 2017 WannaCry ransomware attack that disrupted 1% of all NHS care over a one-week period.

More recently it was again the victim of another attack albeit indirectly via the software company Advanced. Disrupted were NHS’ emergency services (111). Advanced currently has 36 NHS clients, while its Adastra software works with most NHS 111 services.  

Dean Sabri, principal analyst for health and social care at GlobalData, says investment in security software and infrastructure across UK healthcare organisations increased by 53% in real terms between 2016 and 2021.

“A cyber-attack on a large healthcare software supplier such as Advanced suggests that NHS organizations could be effectively wasting as much as £62 million if they do not require tighter security measures from suppliers in future procurements,” he concluded.

The post Increased data access opens wide medical device security vulnerabilities appeared first on FutureIoT.

FileWave MDM is a multi-platform mobile device management solution that allows IT administrators to manage, monitor, and view all of an organisation’s devices. Currently, FileWave MDM supports a wide range of devices, from iOS and Android smartphones, MacOS and Windows tablets, laptops and workstations, and smart devices such as televisions.

Through FileWave MDM, IT administrators can view and manage device configurations, locations, security settings, and other device data. They may use the MDM platform to push mandatory software and updates to devices, change device settings, lock, and, when necessary, remotely wipe devices. In order to do so, all managed devices report to the main server at set intervals, and in return, the server can issue commands to the device via file packages, software, and more.

FileWave has developed a patch to fix the vulnerabilities in a recent update and has reached out to affected customers.

At risks of remote attacks

The security flaws in FileWave MDM, discovered by Claroty’s research arm Team82, allow full offsite control of the MDM platform and the devices that it manages.

“An attacker who is able to compromise the MDM would be in a powerful position to control all managed devices, allowing the attacker to exfiltrate sensitive data such as a device’s serial number, the user’s email address and full name, address, geo-location coordinates, IP address, device PIN codes, and much more,” said Noam Moshe, vulnerability researcher at Claroty, in a blog posted last Monday.

“Attackers could abuse legitimate MDM capabilities to install malicious packages or executables, and even gain access to the device directly through remote control protocols,” he added.

The first vulnerability identified as CVE-2022-34907 is  an authentication bypass that enables total control of internet-exposed MDM instances before proceeding to compromise other FileWave using devices to facilitate data exfiltration and malware delivery.

“This exploit, if used maliciously, could allow remote attackers to easily attack and infect all internet-accessible instances managed by the FileWave MDM, below, allowing attackers to control all managed devices, gaining access to users’ personal home networks, organisations’ internal networks, and much more,” said Moshe.

The other vulnerability, CVE-2022-34906, exits again within FileWave MDM and was a hard-coded cryptographic key.

The post Two security flaws found in FileWave MDM appeared first on FutureIoT.

This is one of the key takeaways from the “Emerging Giants in Asia Pacific” report, which looks into the region’s maturing technology-focused ecosystems that are producing billion-dollar companies at a rapid rate.

"Fast-growing technology start-ups are the new wave of SMEs contributing towards economic growth and more. Looking ahead, the global push towards carbon-neutrality will be a major driver of innovation as traditional sectors go green, and Emerging Giants will likely play a key role in developing the technologies that can reduce carbon emissions and promote more responsible stewardship of the environment. Asia will be a crucial battleground in the fight for a more sustainable future," said Honson To, chairman, KPMG Asia Pacific and KPMG China.

Close to over 6,500 technology startups with a valuation of up to US$500 million were studied across 12 markets, including China, India, Japan, Singapore, South Korea, Australia,  Indonesia, Hong Kong, Malaysia, Taiwan, Thailand and Vietnam.

According to the report, the emergence of new sector verticals is attracting record-breaking investments, leading to a proliferation of larger, more valuable startups in the region.

Beyond Fintech and SaaS

Beyond the traditional sectors associated with new economy businesses such as FinTech or software-as-a-service, the report identified around 120 technology-related industry subsectors among these businesses, with blockchain, smart city, and sustainability and ESG verticals being the most prominent.

Sustainability and ESG verticals such as EV charging infrastructure, sustainable packaging and sustainable fashion are among the top 20 subsectors, making sustainability-related products and services a key focus for roughly 15% of the emerging giants identified.

The top 20 list also included four health-associated verticals, including assistive tech, AI-powered drug discovery, neurotechnology and mental health technology.

Meanwhile, the smart city-associated areas, such as IoT security and digital twins were present in the leading 10 subsectors. Virtual collaboration technologies also feature prominently with two categories – virtual events and low-code/no-code – making the top 20 list.

Advanced computing technologies were also well represented, with quantum computing making the top 5 and cognitive computing making the top 20.

"Emerging Giants in Asia Pacific excites us because we see the start-up ecosystem as complimentary to the established end of the financial services industry: they're a source of innovation, and invigorate both local and regional economies with their dynamism," says Surendra Rosha, co-chief executive, HSBC Asia-Pacific.

Other key findings

Daren Yong, head of technology for media and telecommunications, KPMG Asia Pacific, noted that the region’s emerging giants are bold, ambitious and cutting-edge in the new platform and software applications they are offering.

“Most importantly, they are transforming and pioneering the technology landscape over the coming years, in addition to thinking about what is useful to their customers now," said Yong.

Meanwhile, below are other key findings from the report.

• While a repeat of the record-breaking private investment levels in 2021 is unlikely, 1Q 2022 figures suggest that 2022 is on target to exceed both 2020 and 2019 funding levels in the Asia Pacific. Australia, Malaysia and South Korea have already seen deal values pass or nearly pass 2020 totals.
• As the world's biggest fintech adopter, the Asia Pacific region has experienced a boom in financial services transformation within the last two years as fintech applications progress in tandem with user uptake. Considerable interest in cryptocurrencies has also led to a surge in crypto financial services providers and blockchain players.
• Top challenges faced by Emerging Giants include navigating regulatory complexity and securing technology talent. Formulating effective ESG and tax strategies, as well as leveraging government incentives and implementing management processes for distributed workforces, will be cornerstones of future growth.

The post Explosive growth seen for APAC’s ESG and smart city startups appeared first on FutureIoT.

The four Asia Pacific cities are joined on top of the list by Copenhagen, Amsterdam, London and Paris in Europe and New York and Washington DC in the United States.

The index was produced by Economist Impact and supported by NEC.

According to Ritu Bhandari, manager for policy and insights at Economist Impact, smart cities will be safer, cleaner and more inclusive urban landscapes, where citizens enjoy better public health and services, more efficient transport and major economic improvements to be shared as public goods.

“The index highlights how outlier cities are leveraging technology to improve quality of life for millions of citizens around the world. While we see strong leadership from cities in Western Europe, the table is led by major cities from a wide geographical spread. The most significant improvements were delivered against tightly defined goals – a critical success factor for urban digital transformation,” said Bhandari.

A peek at the top performers

Copenhagen, Amsterdam, Beijing, London and Seoul performed the best, with successful open data projects and major strides in smart technology-powered sustainability projects like utility management.

Cities with very defined goals realised the greatest benefits: European cities ran highly impactful traffic management systems, while Beijing made progress using applied digital technologies - tackling air pollution, optimising its utilities and promoting its sharing economy. The Atlantic nation cities led in open data innovation with a boom in travel and mobility apps.

Sustainability was the biggest impact area highlighted by the White Paper, with leading smart cities realising major gains in air quality through smart utility management. Sustainability brought the highest overall scores, with Copenhagen, Seoul and Toronto scoring highest for their use of digital technology to support urban sustainability.

Copenhagen and Singapore were the most connected cities, followed by Zurich, Beijing and Sydney. Singapore’s strategy for developing digital connectivity is built on the premise that AI, 5G and cyber security will drive the country’s growth and innovation post-covid. Smart cities are anticipated to drive economic growth: 5G alone will enable an estimated US$660 billion global mobility and transportation market by 2035.

Internet services impact smart city goals

According to the index, unaffordable, unreliable or inaccessible internet services impact other city level goal, with half-a-million households reportedly lack a reliable internet connection in New York City, for instance, disadvantaging low-income children for remote learning.

By contrast, Washington DC has offered low-cost or free services and devices to families unable to afford a broadband subscription and Paris has the most affordable mobile data of all the cities analysed.

Digital technologies enable progress in public health

Since the pandemic, digital technologies have enabled real progress in public health. In Asia, apps were central to managing COVID-19, while telemedicine and real-time remote monitoring of chronic patients has marked digitisation everywhere. In New York, for instance, a diabetes-prevention initiative for adults has reduced the risk of type 2 diabetes in high-risk individuals by 58%.

Singapore, São Paulo and New Delhi ranked the highest for their delivery of digital municipal services. New Delhi ranks high in part because of the success of Aadhar, India’s ground-breaking national digital identity scheme. In Korea, Metaverse Seoul, announced in November 2021 by the Seoul Metropolitan Government, will provide citizens with access to government services via the metaverse.

The index also noted that involving citizens in the design of smart city schemes underpins meaningful inclusion, a critical success factor for smart city projects, along with delivery against tightly defined goals.

The post Four APAC cities rank in top 10 of Digital Cities Index 2022 appeared first on FutureIoT.

According to Mark Verbloot, senior director of  product, solutions and systems engineering for Asia Pacific Region at Aruba Networks, the turbulence in manufacturing and the supply chain seen in the last two years have underscored the need for manufacturers to accelerate their transition from “mass production and economies of scale to prioritizing market and customer responsiveness".

"In response to the issues they face, high-tech manufacturers are increasingly aligning their technology investments to secure and optimise operations while addressing data privacy and security concerns even as they build greater resilience in the long-term,” said Verbloot.

The study, entitled “High-Tech Manufacturing Begins with High-Performance Networking and Security Solution”, was conducting by Forrester Consulting on behalf of Aruba – a Hewlett Packard Enterprise company, surveying more than 270 business and IT decision-makers from high-tech manufacturers in Australia, India, Japan, Malaysia, South Korea, Taiwan, and Thailand in the first quarter of 2022.

The study found three in four manufacturers in the region are prioritising innovation and automation for greater operational efficiency and resilience over the past 12 months.

It also found that edge solutions, IoT applications, and networks were essential to driving innovation for 63% of respondents, with 61% indicating they had optimised manufacturing processes with automation and robots. Meanwhile, 69% of respondents said they were either piloting or already using cloud-managed networking and security solutions to benefit from improved flexibility, scalability, and defense capabilities.

Furthermore, 64% of respondents who indicated their intention to build on previous investments in AI-powered software to optimise operations, implement predictive capabilities, and optimise productivity.

Data privacy and security concerns

With the increased connectivity and digitalisation of processes and operations, the study states that the collection, transmission, and utilisation of the breadth of data is becoming critical to the sectors' ability to scale operations and address the challenges posed by privacy and security concerns.

Indeed, more than half (52%) of APAC decision-makers ranked data privacy and security concerns within their top five challenges when implementing networking solutions, while 48% said the lack of cybersecurity features in legacy IoT devices is one of their top five challenges. About 18% ranked information technology/operational technology (IT/OT) divide as one of their top two networking challenges.

In response to data privacy and security concerns, manufacturers have plans to leverage emerging technologies and automation to secure their operations in the next 24 months.

These solutions include cloud-managed networking (38%) and SD-WAN (37%). More than 50% of manufacturers are also expanding, upgrading, or planning to invest in Zero Trust Edge solutions in the same timeframe, while 57% said identity-based traffic segmentation helps them to achieve their business goals.

"As we emerge from the pandemic, there is a need for the manufacturing industry to develop greater agility and flexibility in their operations. Innovation is at the heart of decision-makers’ priorities but manufacturing leaders need to act now by leveraging high-performance network and security solutions to help the smart manufacturing industry scale effectively,” said Verbloot.

The post Consistent network operations crucial to smart MFG in APAC appeared first on FutureIoT.

Collectively called “OT:ICEFALL”, all 56 vulnerabilities are divided into four main categories: insecure engineering protocols, weak cryptography or broken authentication schemes, insecure firmware updates and remote code execution via native functionality.

The 36-page report from Vedere Labs underscored the impact of “insecure by design” legacy of OT devices which leave them exposed to real-world OT malware such as  Industroyer, TRITON, Industroyer2 and INCONTROLLER.

“The rapid expansion of the threat landscape is well documented at this stage. By connecting OT to IoT and IT devices, vulnerabilities that once were seen as insignificant due to their lack of connectivity are now high targets for bad actors.” said Daniel dos Santos, head of security research, Forescout Vedere Labs. 

He added: “We a very long way to go to reach the summit of these OT design practices. These types of vulnerabilities, and the proven desire for attackers to exploit them, demonstrate the need for robust, OT-aware network monitoring and deep-packet-inspection (DPI) capabilities.”

The products affected by OT:ICEFALL are known to be prevalent in industries that are the backbone of critical infrastructure such as oil and gas, chemical, nuclear, power generation and distribution, manufacturing, water treatment and distribution, mining and building automation. Many of these products are sold as ‘secure by design’ or have been certified with OT security standards

Shifting threat landscape

The report by Vedere Labs has identified a shift in the community toward recognising “insecure by design” vulnerabilities.

“Only a few years back, well-known vulnerabilities like some that can be found in OT:ICEFALL would not get assigned a CVE ID because there was the assumption that everyone knew OT protocols were insecure. On the contrary, we believe a CVE is a community recognised marker that aids in vulnerability visibility and actionability by helping push vendors to fix issues and asset owners to assess risks and apply patches,” the report said.

The vulnerabilities and associated issues disclosed in this report range from persistent insecure-by-design practices in security-certified products to inadequate attempts to fix them.

It is crucial for asset owners to understand how the opaque and proprietary nature of these systems, the suboptimal vulnerability management surrounding them, and the often-false sense of security offered by certifications complicate OT risk management efforts.

Although the impact of each vulnerability is highly dependent on the functionality each device offers, they fall under the following categories:

• Remote code execution (RCE): Allows an attacker to execute arbitrary code on the impacted device, but the code may be executed in different specialised processors and different contexts within a processor, so an RCE does not always mean full control of a device. This is usually achieved via insecure firmware/logic update functions that allow the attacker to supply arbitrary code.
• Denial of service (DoS): Allows an attacker to either take a device completely offline or to prevent access to some function.
• File/firmware/configuration manipulation: Allows an attacker to change important aspects of a device such as files stored within it, the firmware running on it or its specific configurations. This is usually achieved via critical functions lacking the proper authentication/authorization or integrity checking that would prevent attackers from tampering with the device.
• Compromise of credentials: Allows an attacker to obtain credentials to device functions, usually either because they are stored or transmitted insecurely.
• Authentication bypass: Allows an attacker to bypass existing authentication functions and invoke desired functionality on the target device.

A full list of devices affected by OT: ICEFALL is available here, while details of each vulnerability are discussed in Forescout’s technical report.

The post Forescout reveals 56 flaws in OT devices from 10 companies appeared first on FutureIoT.

To help prevent unauthorised access of medical devices, Asimily and Extreme Networks team up to help healthcare institutions prevent unauthorised access of IoT-based medical devices.

Asimily is a provider of Internet of Medical Things (IoMT) risk management platforms, while Extreme Networks is a provider of cloud-based networking solutions.

With this partnership,  Asimily Insights will be integrated into the  ExtremeCloud IQ Controller, a cloud-based wired and wireless network management solution from Extreme Networks.

“Asimily’s intuitive platform helps us identify and respond to the most critical risks to our organisation, and the integration with Extreme’s solutions enables us to enforce policies on devices as needed and address any concerns that can impact the confidentiality, integrity or availability of IoT and medical devices and their data,” said Ali Youssef, director, Medical Device and IoT Security at Henry Ford Health.

“Together, these solutions allow us to fill the gaps we previously had in our ability to manage device security and ensure we can continue to deliver patient services, which is always our top concern,” he added.

Asimily Insights integration with ExtremeCloud IQ Controller provides a seamless solution to detect exploitable vulnerabilities and enforce policies to help identify and prevent cyberattacks.

“ExtremeCloud IQ Controller provides unified services and features in a simplified management console for on and off-premise deployments. On-Premise deployment is critical for many Healthcare Delivery Organizations (HDOs),” said Dinesh Katiyar, Head of Business Development, Asimily. “This integrated solution provides HDOs a best vulnerability management platform with the flexibility to deploy on-premise.”

Asimily Insights uses AI-based analysis to prioritise exploitable vulnerabilities and prescribe clinically viable remediations outside of segmentation and blocking that are easy to implement. These remediations are transmitted to ExtremeCloud IQ Controller to centrally enforce network access policies to secure the device.

In addition, for devices where segmentation is the only option, Asimily Insights generates policies which are transmitted to ExtremeCloud IQ Controller to configure, isolate, segment and micro-segment the devices on the network.

“Extreme’s solutions are trusted by hospital systems and healthcare providers around the world. Our integration with Asimily creates a solution that is specifically designed for healthcare IT teams and enables them to find and address vulnerabilities before they are exploited, as well as ensure that security measures necessary for safe clinical operations are in place,” said Bob Zemke, Director, Business Development at Extreme Networks.

The post Asimily, Extreme Networks team up to secure medical devices appeared first on FutureIoT.

Gartner observed that in the past three years, nearly 20% of organisations have already observed cyberattacks on IoT devices in their network.

While 64% of respondents to the Kaspersky study, Pushing the limits: How to address specific cybersecurity demands and protect IoT, use IoT solutions, as much as 43% do not protect them completely.

This means that for some of their IoT projects – which may be anything from an EV charging station to connected medical equipment – businesses don’t use any protection tools. Kaspersky posits that may be due to the great diversity of IoT devices and systems, which are not always compatible with security solutions.

Barriers to protecting IoT

The study noted that 64% of businesses fear that cybersecurity products can affect the performance of IoT while 40% fear it can be too hard to find a suitable solution. Other common issues businesses face when implementing cybersecurity tools are high costs (40%), being unable to justify the investment to the board (36%) and lack of staff or specific IoT security expertise (35%).

Barriers to implementing IoT

The study also noted that 57% of surveyed organisations see cybersecurity risks as the main barrier to implementing IoT. This can occur when companies struggle to address cyber risks at the design stage and then must carefully weigh up all pros and cons before implementation.

Stephen Mellor, chief technology officer at Industry IoT Consortium, insists that cybersecurity must be front and centre for IoT. He posits that managing risk is a major concern as life, limb and the environment are at stake.

He warns that an IT error can be embarrassing and expensive; an IoT error can be fatal. But cybersecurity is only one part of making a system trustworthy.

“We also need physical security, privacy, resilience, reliability and safety. And these need to be reconciled: what can make a building secure, (locked doors for example), could make it unsafe if you cannot get out quickly,” he continued.

While IT projects such as messaging/communication, analytics, CRM, etc., have around 80% of common requirements, IoT deployments are very fragmented, loosely coupled, domain-specific and integration-heavy in nature.

Eric Kao, director for WISE-Edge+ at Advantech comments that in the case of IoT implementation, companies must deal with all kinds of legacy systems, physical constraints, domain protocols, multiple vendor solutions. They must also maintain a reasonable balance in availability, scalability and security.

“In pursuit of higher availability and scalability, certain cloud infrastructure has to be leveraged, the system has to be open to some extent, then security becomes an enormous challenge,” he added.

The bright side

Challenges aside, there remains optimistic about the potential benefits of the technology and the possibilities of protecting IoT solutions as they are integrated into operations and IT.

Andrey Suvorov, CEO at Adrotech in Russia, says IoT is widely used in smart cities (62%), retail (62%) and industry (60%). These include projects such as energy and water management, smart lighting, alarm systems, video surveillance and many more.

“Experts around the world are working on the task of effective protection for such projects but efforts should be made at every level – from equipment manufacturers and software developers to service providers and companies that implement and use these solutions,” he added.

Next steps for securing IoT

To help organizations fill the gaps in their IoT security, Kaspersky suggests the following approaches:

• Assess the status of a device’s security before implementing it. Preferences should be given to devices with cybersecurity certificates and products from manufacturers who pay more attention to information security.
• Use a strict access policy, network segmentation and a zero-trust model. This will help minimize the spread of an attack and protect the most sensitive parts of the infrastructure.
• Adopt a vulnerability management program to regularly receive the most relevant data about vulnerabilities in programmable logic controllers (PLCs), equipment and firmware, and patch them or use any protection workarounds.
• Check the “IoT Security Maturity Model” – an approach that helps companies evaluate all steps and levels they need to pass to achieve a sufficient level of IoT protection.
• Use a dedicated IoT gateway that ensures the inbuilt security and reliability of data transferring from edge to business applications.

The post 43% of businesses don’t protect their full IoT suite appeared first on FutureIoT.

Moving forward, the two companies will strengthen cooperation for product development optimised for bio-cold chains and global expansion, such as technology cooperation to develop bio-medicine monitoring IoT devices and to ensure a stable supply of IoT modules by combining industry-leading security and IoT technology.

“In 2022, we plan to develop and supply competitive products in cooperation with various overseas partner companies to enter the global market while stably supplying new products to the domestic bio/medicine cold chain market,” said Moon Jin-soo, CEO of M2cloud.

M2Cloud delivers scalable logistics and monitoring solutions for use by hospitals, pharmaceutical manufacturers and wholesalers in their supply chains. It owns the first IoT Security System in South Korea – certified by Korea Internet & Security Agency (KISA) – that satisfies all standards of IoT security testing such as stability, integrity, security and unauthorized manipulation defence.

Last year, the company established an integrated logistics system for COVID-19 with real-time visibility into the entire supply chain, ensuring integrity, proof of compliance to ensure product quality, IoT technology optimized for temperature sensitivity, and cloud technology for ESG practices.

M2 Cloud has also established and operated a cold chain system throughout the process of receiving, storing, and delivering COVID-19 vaccines from AstraZeneca (refrigeration), Janssen (freezing), and Pfizer (ultra-low temperature), which are all biological agents.

New IoT-based LTE monitoring system

M2Cloud and Thales revealed their strategic partnership two weeks ago as they unveiled the first product of their collaboration – an IoT-based LTE monitoring system optimised for biopharmaceutical monitoring.

Unlike Bluetooth devices for near-field communication, the newly developed IoT cold chain system which is equipped with a low-power LTE communication chip, does not require additional gateway adoption or complex setups such as internet connectivity.

It can remotely check temperature and location information in real time by just turning the power on, making it suitable for real-time monitoring of refrigerators, refrigerated warehouses, etc., as well as tracking the delivery boxes being transported in real time.

In particular, because it ensures real-time visibility and data integrity, and can check temperature history without data loss in the event of a power outage or network failure, it  enhances the safety of pharmaceutical products with technologies optimised for biopharmaceutical management, such as vaccines that confirm the validity of products with a temperature history.

“For a quarter of a century, customers across all industries have trusted Thales’ industry-leading IoT solutions to seamlessly connect and secure IoT devices and to help them transform real-time data into efficient decision making. We are proud to work with M2cloud to help keep their cold chain monitoring and management solutions connected, and to contribute solutions that support the healthcare industry in Korea,” said Sandy Gillio, country director and chief executive,  Thales Korea.

The post M2Cloud, Thales to develop IoT-based bio-cold chain systems appeared first on FutureIoT.

It is estimated that 1.5 billion IoT breaches occurred between January to June of 2021, most using the telnet remote access protocol, used by network admin to access and manage network devices remotely.

Kamal Brar, vice president and general manager, Asia-Pacific and Japan, Rubrik says the proliferation of unsecured (or less than enterprise-grade secure) IoT devices connected to the enterprise make them great entry points for ransomware and malware attacks.

“Depending on where we're talking about in terms of the IoT devices, the nature of the devices and the complexity of the ecosystem, it varies, but it's an obvious place for everyone to go look at, given the simplicity and the fact that it's so integral to our lifestyles,” he added.

Identity of Things

According to Brar, the identity of things relates to the verification or validation of a trusted device. Within an IoT environment, this ranges from a simple environment involving a single IoT device to a very complex one involving multiple IoT sensors working together to operate a large domain.

“The identity of things or identity of IoT refers to how we authenticate, verify and trust a device on the network, whether it is doing what it is designed to do, for example controlling a process in a manufacturing environment,” he elaborated.

He added that having that validation or the trust in that device is critical. It that sensor is compromised, for example, then it becomes difficult for that system to operate.”

He cited the Colonial Pipeline incident in 2021 where the billing system infrastructure was crippled by a ransomware attack. While the company could continue to pump gas, it was unable to bill customers forcing the company to shut down the operation until the ransom was paid.

How and where threat actors hijack IoT

According to Brar, there are three areas where an IoT-focused attack can occur.

One, the IoT device are forcibly encrypted and therefore the company is unable to control these devices.

The second is along the communication channel. A compromise can occur if the communication channels and/or protocols that the IoT device uses to communicate are hijacked, for example, a denial of service or spoofing of the network, then the company again loses access to the infrastructure.

The third is the hijacking of the data that the IoT captures. “If you're using credentials to connect between the sensors and a central, for example, a database, then you're potentially compromising the application security layer,” he explained.

Can zero-trust be applied to IoT?

At the core of the zero-trust principle is trust no one, always verify. This means that even if someone’s identity has been verified already, that credential is ignored when the user accesses the same application or data in the future. Zero-trust requires identity verification each time a request to access the network, data or application.

IDC acknowledges that IoT can very easily become the weak link or entry point for attacks in any organization – just ask the people at Colonial Pipeline, meatpacker JBS, even Verkade, a Silicon Valley-based security as a service provider.

IDC says extending a zero-trust framework to IoT deployments can enhance security and reduce risk, but it is an enterprise-wide strategy that requires a complete understanding of all IoT systems on the network.

Brar concurred adding that with zero trust, you are always in the process of reconfirming (validating identity and rights) – always!

He however cautioned that contextual information is necessary to ascertain the authenticity of identity.

“For example, if you're in multiple zones on how those IoT devices operate together, to provide an operational outcome, you want to understand the contextual information on what those devices are doing, to being able to have that outcome,” he explained.

He goes on to elaborate that: “If I'm having a three-phase deployment across my power generation, I want to understand exactly which parts or which zones of those devices are actually functional to do, what parts of that delivery of three phases, so I can really understand the blast radius, or the impact, potential impact that ought to have if I was compromised.”

The third element is around automation – specifically, how quickly to recover from a potential threat or exploit.

“If you think about the IoT devices, because the configuration management is large, and it's complex across the general environment, depending on how big it is. That's an area where many customers get it wrong,” laments Brar.

Applying behaviour analysis to IoT

Brar acknowledges that the approach to security varies from company to company. Some focus on the perimeter, others on application hardening data security.

He posits that from the behaviour standpoint, what you want to look at is end-to-end. Is there a way to capture how this device or how this potential workload or payload behaves from point of entry to potentially how it interacts with the application or how that information flows between all the systems and relevant network interfaces?

Click on the PodChat player to listen to the full dialogue with Brar and his recommendations for better securing IoT in the enterprise. 

• What makes IoT devices a valuable target for threat actors? 
• How does the Identity of Things play a role in protecting IoT devices? 
• How do threat actors exploit IoT devices through the Identity of Things? 
• What makes zero trust crucial for protecting IoT devices?
• How can behaviour analysis detect threats in IoT networks?
• What makes Rubrik an expert on IoT security?

The post PodChats for FutureIoT: Zeroing in on securing IoT in 2022 and beyond appeared first on FutureIoT.

Vishnu Andhare, a consultant with the Information Services Group (ISG), believes that IoT (IoT) digital twin technology will continue to mature rapidly because of the demand for this technology across many industries as well as the remote needs required by pandemic workforces.

With the integration of IoT into the enterprise comes the potential for cybersecurity vulnerabilities. Ian Lim, field chief security officer, Asia-Pacific at Palo Alto Networks, offered his perspective on where IoT is headed and how securing IoT needs to step up or catch up with IT security.

Major enterprise IoT trends in Asia for 2022

Ian Lim: We see private 5G gaining popularity as people capitalise on its low-latency, high-bandwidth capability. Organisations will be looking into overlaying a private 5G network to facilitate their future use cases.

Another major IoT trend will be digital twins, which is the concept of having a virtual version of a physical object. This creates the need for better connectivity with 5G technology so that any physical changes can be synced in the virtual model in a responsive and near real-time manner.

State of IoT Security in Asia

Ian Lim: The latest IoT security survey from Palo Alto Networks found that nearly all (96%) respondents reported their organisation’s IoT security needs improvement. Part of the reason is due to lack of visibility at scale because IoT falls in the grey area between security teams and operation teams. Organisations need to define their security ownership for better management and visibility over IoT devices.

Another challenge is the knowledge gap between security tools and IoT technology. For example, there are still very few tools that can interpret 5G traffic, so the tools themselves are not ready to protect an organisation from IoT attacks.

IoT use case in Asia where security needs to be addressed early on

Ian Lim: The Internet of Medical Things (IoMT) has been leveraged heavily during the pandemic and is likely to stay. Handling IoMT devices means dealing with a patient's private data and physical health, so there can be severe ramifications if IoT data is compromised.

The entire lifecycle of IoMT architecture needs to have embedded security to ensure it is secure by default. The IoMT network should also be segmented and secured with visibility, monitoring and response.

Left out in securing enterprise IoT

Ian Lim: People should be aware that many IoT devices are not secure by design. According to another IoT report by Palo Alto Networks, over 50% of IoT devices are vulnerable to medium- or high-severity attacks, making them low-hanging fruits for attackers.

The next aspect is visibility. Many organisations often don’t know all the devices that are plugged into and lack understanding of any attacks targeting them and how they can remediate the attacks.

The third question is the tug and pull of “who owns securing IoT”. Organisations should start defining IoT security ownership and promote collaboration between security teams and operation teams. Security teams will be responsible for defining strong security standards, while operation teams will need to comply with these standards and provide feedback on what works and doesn’t.

IT-Ops working together

Ian Lim: These teams should align around four common goals: visibility, context, control, and response.

Organisations need a toolset that can automatically scan all IoT devices for visibility. Then, they need the context of what the device is by understanding its functions and vulnerabilities. Machine learning can help to build knowledge of the ecosystem at large. Next is control – organisations need to identify if a device is segmented and under a specific protocol. These rules lower the probability of attacks as access is limited. Lastly, response – systems that can automatically respond to threats gives us the ability to orchestrate a response swiftly.

Key trends in IoT governance

Ian Lim: Within Asia, we are looking at regulating IT manufacturers. We want to be able to see more devices that are secure by design, hopefully using government regulations. There’s also another area where we hope to see actions from governments, which is the architecture and infrastructure these IoT devices live on.

Key trends in Persona-based IoT

Ian Lim: Some general examples include Alexa, Siri and Google Home. Persona-based IoT is use case-based as it fits in some cases and not in others. When you align a persona with an IoT device, it’s much easier for people to understand and associate the IoT device.

Key trends in sustainability initiatives around IoT

Ian Lim: We need to be conscious about how we use energy, maintain our environment, and treat waste. Because of the proliferation of IoT, billions of devices are going to come online. We need to have a very strong strategy around sustainability because of its big numbers.

Key trends in IoT-as-a-service

Ian Lim: Much like how anything can be provided as a service nowadays, we may have companies that capitalise on their understanding of a device at scale in future. Take security robots as an example, instead of having every single organisation know how to manage those robots, it makes more sense for them to outsource the management process to an IoT-as-a-service provider. However, there are also IoT devices that are very specific to manufacturing plants and factories and will require specific in-house knowledge for managing them.

Click on the PodChat player to hear Lim share his perspective on how to improve the security of IoT.

1. What are the major enterprise IoT trends in Asia in 2022?
2. Please describe the state of IoT Security in Asia in 2022.
3. Can you cite one or two emerging IoT applications/use cases in Asia in 2022 where security needs to be addressed early on?
4. What often gets left out in securing enterprise IoT?
5. How should CIOs, the CISO and the IT team work with operations to improve the overall security of the entire operation?
6. Coming into 2022, what are the key trends to expect on the following topics:
   a. IoT governance
   b. Persona-based IoT
   c. Sustainable initiatives
   d. IoT-as-a-services

The post PodChats for FutureIoT: Securing the enterprise IoT in 2022 appeared first on FutureIoT.

"Users' security and privacy is the top priority of Xiaomi, and we promise that this applies to all markets where we operate,” said Cui Baoqiu, Xiaomi vice president and chairman of Xiaomi Security and Privacy Committee.

He added: “Over the years, we have made great efforts to protect users' security and privacy. I'm confident and proud to say that Xiaomi is in the leading position of IoT security policies and practices in the world, and we will continue to work hard to build a better IoT ecosystem for our users."

According to Xiaomi, its proposed security guideline meets the need of the consumer IoT industry as there is no such general standard that can be publicly queried and implemented.

Now companies can use this guide to avoid some basic security and privacy protection risks, and to quickly improve the security and privacy protection capabilities of their IoT products

Entitled "Cyber Security Baseline for Consumer Internet of Things Device Version 2.0",  the guideline aims to protect security and user privacy with a comprehensive set of requirements that span across device hardware, device software to device communication.

The document  also states the requirements on data security and privacy, which include communication security, authentication and access control, secure boot and data deletion among others.

It is a security baseline that all Xiaomi smart devices should follow.

Xiaomi owns the world's leading consumer AIoT platform. As of November 2021, Xiaomi's AIoT platform has connected more than 400 million devices, excluding smartphones and laptops, and there are more than 8 million users with 5 or more Xiaomi IoT devices around the world.

Achieving BSI Kitemark for IoT devices

The guideline comes as the British Standards Institution (BSI) confirmed that Xiaomi Mesh System AX3000 has obtained the BSI IoT Kitemark Certificate, which has proved the high degree of consistency between the Cyber Security Baseline for Consumer Internet of Things Device of Xiaomi and the international IoT security standards held by BSI.

David Mudd, BSI global digital and connected product certification director, said: "Connected devices can bring huge benefits to society, but it is imperative that their function and security can be trusted throughout the required device life. By achieving the BSI Kitemark for IoT Devices for its product and having its systems regularly and independently tested and monitored, Xiaomi is demonstrating to consumers their commitment to safeguarding information."

The BSI IoT Kitemark is a product and service quality certification owned and operated by BSI. It conducts technical testing and security audits for IoT systems, giving consumers reassurance and confidence of secure and trust-worthy IoT devices under the highest standards. Obtaining the BSI IoT Kitemark Certificate means that Xiaomi products are in compliance with multiple cybersecurity standards, including the ETSI/EN303645 standard issued by European Telecommunications Standards Institute (ETSI), as well as the Open Web Application Security Project® (OWASP) Top 10 security requirements.

It is the third time that Xiaomi received this international security accreditation, following Mi 360° Home Security Camera 2K and Xiaomi Home App, which achieved the BSI Kitemark Certificates in July 2021.

Commitment to IoT security

In the past few months, Xiaomi has been focused on putting more teeth into the security of its IoT products.

In June 2021, Xiaomi published the Xiaomi IoT Privacy White Paper , explaining the security and privacy policies and practices of Xiaomi's IoT products, gaining trust by increasing the transparency.

In November of the same year, in The Contemporary Use of Vulnerability Disclosure in IoT (Report 4: November 2021)  published by the Internet of Things Security Foundation (IoTSF), Xiaomi was listed as one of the 21 IoT device suppliers that met the extended threshold test, namely received the highest rating for security vulnerability disclosure policy, which shows Xiaomi's leadership in IoT security.

In the future, Xiaomi will keep improving its IoT security framework, while strengthening its security management and technical testing capabilities to fulfil the responsibility of a global industry leader and let everyone in the world enjoy a better and smarter life through innovative and safe technology.

The post Xiaomi laid out proposed global standards for IoT security appeared first on FutureIoT.

Called Visa Acceptance Cloud (VAC), the platform will allow acquirers, payment service providers, point of sale (POS) manufacturers, and Internet of Things (IoT) players move payment processing software from being embedded in each hardware device to being universally accessible in the cloud.

“Cloud acceptance is the future of payments,” said Mary Kay Bowman, senior vice president and global head of payment and platform products, Visa. “Cloud-connected POS lets sellers accept payments across a range of devices quickly, simply, and safely, whether at an unattended kiosk in a hotel, a mirror in a high-end retail store or virtual in-home gym, or a smart phone in the hands of a small seller with a roadside newsstand.”

Already live across six geographies, VAC not only  turns virtually any device into a cloud-connected payment terminal, but it will also provide seamless, cloud-based software updates, robust analytics, and network services from Visa. Since VAC runs on Visa’s data centers, it also offers leading data security capabilities.

“VAC is a universal platform that helps open up acceptance for all – by freeing our leading technology partners to innovate. On one end of the spectrum, cloud acceptance helps drive inclusion for more small sellers who want to offer digital payments. On the other end, Visa Acceptance Cloud enables advanced shopping and buying experiences that will be central to the future of retail for businesses of all shapes and sizes,” said Bowman. “Moving acceptance to the cloud opens up the possibility of so much innovation from the entire payments ecosystem. This is only the beginning.”

Changing the payment landscape

The new VAC platform comes on the heels of Visa’s successful “Tap to Phone” solution – another industry-first – that transforms current generation Android smartphones and tablets into contactless point of sale terminals.

Introduced in January 2020, it is Visa’s first offering that let sellers accept payments on the devices they already own, just by downloading an app. As of December 2021, there were more than 300,000 devices across 54 countries using Tap to Phone.

Now, expanding beyond phones, VAC enables any POS or connected device to seamlessly accept payments and to incorporate a range of added services, including buy now, pay later, fraud management, Rapid Seller Onboarding, and advanced data analytics.

Ongoing pilots test VAC real-world viability

According to Visa, ongoing pilots of VAC in North America, South America, Europe, Africa, Asia and Australia cater to a variety of use cases, including retailers and restaurants in Australia through Visa’s work with U.S.-based fintech, Bleu, NOBAL Technologies’ smart mirror and public trains in Brazil.

“Bleu is working with Visa to bring seamless payments to businesses across Australia for the very first time,” said Sesie Bonsi, president & CEO, Bleu. “While the average business owner can spend as much as $1,000 on POS devices, plus countless hours and more money on time consuming certification processes, moving to Visa Acceptance Cloud removes the barriers of traditional hardware and burdens of device-bound kernel certifications, making it easier for the independent business that we serve to deliver touchless payment options to their customers through any connected device.”

“Retailers are looking to enhance their in-store customer experience to meet the speed and convenience of the online and in-store checkout experiences,” says Bill Roberts, CEO, NOBAL Technologies. “NOBAL‘s intelligent mirror in partnership with VAC from Visa provides payment experiences on our mirror without the expense and expertise required for embedded hardware modules, helping us push the future of retail in new ways.”

The post Visa’s new cloud platform turns any device into a POS terminal appeared first on FutureIoT.

According to latest analysis by Frost & Sullivan, the growth of IoT adoption in the country is backed by strong connectivity and coverage, rising internet penetration, a surge in smart applications adoption, new business models, and government initiatives such as smart city projects.

"IoT solution deployment for manufacturing industries, including automotive, energy and utilities, smart cities (government), retail, and other industries such as logistics, will drive investments for enterprise IoT products and services," said Apalak Ghosh, associate director, Information & Communications Technologies, Frost & Sullivan. "Enterprises are becoming more technology-focused and increasing investments in cellular IoT to generate value from their digital transformation."

Ghosh added: "Use cases such as industrial automation, building automation, security, and surveillance account for the majority of the market revenue. Telcos may benefit from a share of this revenue, depending on their strategic partnerships with hardware providers and their roles in the IoT value chain."

India offers multiple opportunities for IoT providers, and the country's IoT ecosystem is expected to continue growing to offer entire new streams of revenue. Market participants should focus on:

• Private long-term evolution (P-LTE) for enhanced security: Indian telcos should focus on marketing the benefits of P-LTE to create awareness and approach enterprises with vertical-specific P-LTE solutions.
• Real-time operational intelligence for heightened risk and compliance management: IoT providers must develop hardware and applications that are interoperable and pre-integrated to offer brand-agnostic IoT solutions.
• Visual matrix solutions for improved CX: IoT providers should establish partnerships with visual surveillance system original equipment manufacturers (OEMs) to jointly offer in-store, live consumer analytics along with core security solutions.
• IoT as a Service for Smart Diagnostics Laboratories: Starting with open source-based IoT solutions can reduce costs substantially and encourage the adoption of smart laboratories as a service.

The post India IoT market to reach US$9.28 billion by 2025 appeared first on FutureIoT.

IoT is one of the newest conduits for ransomware attacks. In the State of the Network Security 2021 report by Barracuda, 83% of respondents perceived the level of Operational Technology (OT)/Industrial Control Systems (ICS) cyber risk as either critical, high or moderate.

Ransomware attackers are increasingly employing more sophisticated attacks and defeating existing defences.

Click on the link to download this checklist for an effective ransomware protection plan for your organization.

The post Barracuda checklists for defending IoT against ransomware appeared first on FutureIoT.

IoT is one of the newest conduits for ransomware attacks. In the State of the Network Security 2021 report by Barracuda, 83% of respondents perceived the level of Operational Technology (OT)/Industrial Control Systems (ICS) cyber risk as either critical, high or moderate.

In the Barracuda Networks e-book, Don’t pay the ransom: A three-step guide to ransomware protection, Barracuda lists three focus areas to direct an organization’s strategy: protecting your credentials, securing your web applications and access, and backing up your data.

Key takeaways in this new e-book include:

• The most effective detection and response tools and user training to help protect against credential theft and create a culture of awareness.
• The current best practices to secure web applications and access, stop cybercriminals from exploiting vulnerabilities, and protect your network infrastructure.
• The backup and disaster recovery solutions to ensure you always maintain access to your data and never have to pay a ransom.

Click on the link to download your copy of this Barracuda Networks ebook.

The post A three-step guide to ransomware protection for IoT appeared first on FutureIoT.

"Human augmentation is a burgeoning area of technology which in fact remains underexplored. That’s why making a first step towards clarifying issues related to its use, as well as strengthening security, will help us to ensure its potential is used in a positive way. We believe that to build a safer digital world for tomorrow, we need to digitally secure the future of human augmentation today,” said Marco Preuss, director of Kaspersky’s Global Research & Analysis Team (GReAT) in Europe.

Bionic devices are artificial implants which replace biological functions which have been lost due to nerve damage. They use electrical signals to stimulate the remaining nerve cells following disease or injury. They have been around since the 1950s with the invention of cardiac pacemakers and  then cochlear implants, which made their appearance in the 1970s. Today, there are a diverse range of bionic devices from prosthetics to replace damaged limbs, other implants and NFC biochips.

According to Global Market insights, the bionic devices market is projected to reach nearly US$8 billion in 2027 spurred by technological developments and rising disposable income in emerging economies. Between 2021 and 2027, the market is expected to grow at  a CAGR of more than 8.1%

Safeguarding the future

Amid all the excitement and innovation surrounding human augmentation, however, too little attention is paid to the security of the dedicated devices.

There are legitimate fears among cybersecurity experts and the wider community  about lack of awareness around the topic, which can lead to uncertainty and risks for both further development of human augmentation technologies, and a safer digital world in the future.

The cybersecurity policy developed by Kaspersky experts governs procedures for using bionic devices within the company and aims to reduce the associated cybersecurity risks in business processes.

The proposed document creates a scenario where augmented employees become more common in the company in the future, and takes into account Kaspersky’s real-life tests with employees’ biochip implants. It addresses the entire company’s infrastructure and all of its business units.

As a result, it applies to the full access control system, as well as administration processes, maintenance processes, and the use of automated systems.

The policy is to be applied to both employees and temporary staff, as well as employees of third-party stakeholders that render contract services to the company. All these factors aim to enhance the cybersecurity of the corporate infrastructure on a larger level.

It offers a range of standardisation processes, enhancing security and granting better inclusion of employees using bionic devices when in the office.

“One of the major objectives of this initiative is also to engage the global IT and augmentation community in the discussion and pursue a collaborative effort for further steps of human augmentation security development. This includes ensuring digital privacy of devices, proving different levels of access rights to stored information, and mitigating any threats related to human health,” said Preuss.

The post Kaspersky creates cybersecurity policy for bionic devices appeared first on FutureIoT.

“As these technologies are being explored, there is a need to address the data challenge with more data residing in these new end points and devices at the edge. We see businesses adding new apps and functionality to the edge as a result,” said Joseph Chan, senior director for Hong Kong and Taiwan at Veeam Software, a provider of backup, recovery and data management solutions.

Reindustrialisation has been on top of the Hong Kong government agenda for several years now and has been one of the major focus for technology innovation in the city. In fact, the government launched  in July this year the HK$2-billion Re-industrialisation Funding Scheme under the Innovation and Technology Fund. The scheme subsidise to subsidise the cost for local manufacturers to set up new smart production lines.

“We expect advanced manufacturing and high-quality processes to be areas of growth which will drive more IoT adoption [in the city],” Chan said, adding that Veeam has been in talks with the Hong Kong Productivity Council and other organisations who are helping businesses implement industry 4.0 technologies.

Data management at the edge

Together with the projected growth of installed IoT devices in Hong Kong, Veeam predicts increase data management at the edge as companies seek to process data close to where the devices are located before moving them to the cloud.

“As businesses seek to run their applications and manage data efficiently at the edge, we're going to be there to be able to protect that data, and then I'll obviously unlock it and make it portable as well,” said Anthony Spiteri, senior technologist – global product strategy at Veeam.

Spiteri pointed out that with Veeam’s acquisition of Kasten, a cloud-native backup and recovery solution for Kubernetes workloads and applications, would enable them to protect IoT data at the edge.

“With Kasten, we are able to protect the data  no matter where it is. A piece of software like Kasten positions us very well to be able to backup data that's being generated at the edge,” Spiteri said.

Indeed, looking at technology trends in 2022, Veeam predicts fluidity in the movement of data across the enterprise – whether physical or virtual.

Data portability will be a big thing in the coming 12 months. Last year with the rise of working-from-home due to COVID-19, this concept has been somewhat suppressed. However, as employees return to office workspaces, data portability will again take centre stage.

“In 2022, there will be a significant focus on the ability for users or owners of a given dataset to easily duplicate information across different software applications, platforms, services, and storage environments,” said Spiteri.

He added that reducing the friction of data movement and enabling cloud acceleration are among the top benefits.

“According to our 2021 Data Protections Trends report, 36% of executives believe the ability to move workloads from one cloud to another is the most important element to modern data protection. The goal is to allow any user to experience flawless services across cloud environments, and in turn help the data economy thrive. Veeam’s vision of ‘your data, when you need it, where you need it’ will be vital to ensure teams can access data anywhere, at any time,” Spiteri said.

The post Veeam: reindustrialisation will drive IoT adoption in HK in 2022 appeared first on FutureIoT.

“Many businesses and consumer products will struggle with the availability and price increases through 2022. IoT devices will feel the pinch particularly hard because they generally use mature sensor, microcontroller and communications technologies that have significantly more availability issues than advanced chips like CPUs and GPUs,” said analysts at the technology research firm.

They also predict that as a result  of the chip shortage, IoT-based products such as  appliances, automobiles, and consumer electronics will be unavailable, delayed, or overpriced.

“In turn, this will increase demand for less smart equivalents,” the analysts added.

The impact of  the shortage in semiconductors supply is one of the key takeaways in the 2022 Forrester Predictions report on IoT, Edge and Networking.

Edge and IoT edge will power sustainability innovation in the supply chain

According to Forrester, demand for sustainability-related services powered by edge and IoT will grow in 2022 for energy efficiency and resource management. The two technologies will drive new solutions for scope 3 emission reduction.

Scope 3 emissions are all indirect emissions in an organisation’s value chain; they come from assets not owned or directly controlled.

“High-demand use cases will include environmental monitoring (e.g., air quality, CO2 levels, and pollution); resource management (e.g., water, power, electricity, and lighting); and supply chain processes (e.g., fleet management, material sourcing, and asset tracking). These technology-led sustainability solutions will be especially fruitful for stakeholders who are keen on recognising business value and creating competitive differentiation with their sustainability investments,” the analysts said.

Traditional smart-technology product vendors, IT, and professional services players and platform vendors that specialise in edge and IoT will bring these solutions to market in 2022 as standard offerings and bespoke IT solutions.

Satellite internet will challenge 5G as the connectivity of choice

Government red tape and delays in developing 5G have opened the door for the satellite internet market, according to Forrester.

“In rural areas, low earth-orbiting satellite internet services like SpaceX’s Starlink show more promise than 5G does. Enterprises’ remote worker initiatives and remote facilities will benefit significantly from satellite internet in 2022,” the analysts said.

They also predicted that wired connectivity providers — with no cellular business — will offer satellite internet services as a backup option instead of positioning competitor with a cellular backup connection.

“Rural areas will see a significant proportion of users subscribing to satellite services; 85% of satellite users will be in rural locations,” Forrester analysts said.

Smart infrastructure will increase by 40%

Meanwhile, large government spending in China, Europe and the US will drive a 40% increase in investments in smart infrastructure, Forrester forecasts.

“To facilitate pandemic recovery, city planners will prioritize initiatives that provide citizens with internet connectivity, address public health, and manage critical resources (e.g., water, power, and lighting) by using smart meters and predictive grid monitoring,” analysts said.

They added that stakeholders will also harness insights captured from edge devices and IoT-enabled infrastructure to modify traffic patterns to reduce congestion; evaluate multimedia data to deliver insight for security applications; and combine 5G, V2X, and edge technologies to enable autonomous vehicles (e.g., container trucks and automated guided vehicles) in ports and airports.

With the proliferation of connected devices, Forrester analysts warns that an IoT botnet will successfully take down communication infrastructure via DDoS.

“Many IoT devices have notoriously weak security. Cybercriminals have been able to compromise these devices and build massive botnets that can launch disruptive DDoS attacks,” they said.

This summer, they pointed out Cloudflare mitigated a DDoS attack of 17 million requests per second from the Mirai botnet, which was three times larger than any previously seen DDoS attack. That record was quickly shattered when Yandex repelled a DDoS attack of 22 million requests per second.

“In 2022, we predict that an IoT botnet will launch a DDoS attack that surpasses 30 million requests per second, setting a new record. That level of traffic will successfully cause economic pain by denying some critical communications infrastructure,” they said.

“Enterprises should evaluate their current DDoS mitigation vendors and test response plans in preparation for larger attacks in 2022,” they added.

The post Chip shortage will hinder IoT growth by 10% to 15% in 2022 appeared first on FutureIoT.

The new manufacturing facility is fitted with advanced pipe processing, welding, and assembly process equipment. It deploys real-time information connectivity and automatic processing in key processes such as frame manufacturing, iron and plastic parts coating, motor manufacturing, and whole motorcycle assembly. Moreover, its production equipment in the workshop is using the Internet of things (IoT) to improve efficiency and reduce labour cost.

When fully operational, the smart factory can  produce an electric motorcycle can be produced in 30 seconds, with a frame accuracy error of less than 0.5 mm. Automatic cutting, bending and welding are realised in frame manufacturing of electric motorcycles, which are monitored with the MES system, so that the accuracy error of finished products is less than 0.5 mm.

It is planned to equip the intelligent factory with 10 automatic production lines for synchronous pre-assembly, five of which have been completed to date.

"We will try our best to cultivate a 100-billion-level new energy electric vehicle industry cluster, and strive to achieve the '311' project target for the electric vehicle industry during the '14th Five-year Plan', that is, 30 million electric vehicles (sets of accessories) will be produced every year, to achieve the output value of RMB 100 billion and the tax revenue of RMB 10 billion,” said Huang Yingmei, party secretary of Gangbei District.

The district is capitalising on Guangxi’s proximity to the borders of Vietnam to tap into the burgeoning Southeast Asian market.

In recent years, the Gangbei District in Guigang City, Guangxi, has seized the development opportunity brought by the Belt and Road Initiative, and continued to optimise the business environment, planning to build a 10,000-mu China-ASEAN New Energy Electric Vehicle Production Base.

At present, nearly 100 electric vehicle enterprises have been introduced and more than 50 electric vehicle enterprises have started operation. Guangxi New Energy Electric Vehicle Products Quality Testing Center and Guangxi Electric Vehicle Industry Association have been established successively.

An annual production capacity of 4 million two-wheeled electric motorcycles, 500,000 three-wheeled electric vehicles and 5 million sets of spare parts has been formed, with the local matching rate reaching 80%.

From January to September this year, the industrial output value of enterprises above the designated size in the new energy electric vehicle industry of Gangbei District increased by 37.9% year on year. Key components such as motors and plastic parts are continuously sold to domestic and ASEAN markets.

In addition, Gangbei District also creates "Marshal Travel", a local shared electric bicycle brand, which has been put into operation, and it plans to put more than 500,000 shared electric bicycles in Guangxi within five years, and expand to the whole country in the future.

The post RMB400-M smart factory for EVs opened in Gangbei District appeared first on FutureIoT.

Operational Technology is less understood and only with the adoption of IoT, and more importantly, the attacks on infrastructure critical systems have the issue of securing OT become a point of contention starting with those is responsible for IT-OT or OT-IT converged systems.

The implication of convergence to business

Richard Farrell, Eaton Asia-Pacific director for Cloud, Data and Digitalization, is quick to remind us of what constitutes information technology (IT) comprise of servers, storage, switches, routers, and software.

He goes to remind us of that operational technology as what is typically associated with facilities or commercial buildings, power generators, chillers, lighting systems, as well as SCADA software systems.

Is it convergence or integration?

Most discussions involving both IT and OT tend to use the term convergence. So, when FutureCIO asked Farrell for his opinion, he acknowledged that ‘integration’ is not something he is asked on the subject. He conceded that convergence has become a buzz term, losing its meaning in the process.

For Farrell, the discussion is more than just the technology itself. He believed that it is about bringing the two, IT and OT, together. It is also about the people that have traditionally been associated with each technology.

“To make that convergence is to bring these people together for governance and cultural purpose to have a common purpose. The integration for me is probably more on the technical side of things. How do we integrate our IT and OT systems? How do we integrate those and how do we converge teams to work together?” he opined.

Influence of 5G on IT-OT

At a compound annual growth rate of over 46%, Farrell says 5G is one of those technologies that are ‘smashing the IT and OT worlds together’. He opined that 5G is an enabler of the growth of IoT.

“Think about what the Internet of Things is. It's a bunch of sensors that are gathering data and transporting that data to the internet. It is transporting back and forth, whether it be in the storage, back to the sensors, lots of lots of information, you know, coming in. The transport mechanism is 5G. And because this 5G is super quick, that's going to transport even more masses of data,” he continued.

He is quick to remind that the growth is not exclusive, not strictly IT or OT or IoT or Industrial Internet of Things – as both benefits from the connectivity that 5G enables.

“You are going to find that a lot of the information that is used in IT systems is going to be used to operate more efficiently, the Operational Technology systems. And vice versa, all that data we're getting through the Internet of Things, and 5G being an enabler, is going to send all the information back to IT networks works as well,” he elaborated.

He believes these things are going to be smashed together, but it's going to be IoT and 5G that are rapidly, rapidly growing in the region, which is going to be the enabler for this.

Holistic IT-OT cybersecurity programme

Asked for his recommendation on best practices for a holistic IT-OT cybersecurity programme, Farrell suggests a better approach is cybersecurity lifecycle service. It is not about fixing the problem only once, and it is fixed forever.

“We strongly advocate having a lifecycle service, meaning regularly assessing and auditing physical and virtual networks,” he added. He was emphasized that network is one network as IT and OT are interconnected today.

“If you do an assessment, you can do asset management checks –checking what is physically and virtually connected to your network. It is having somebody who knows how to do this, comes out, sniffs around your network, walks around your facilities, and with the help of the local IT and OT teams map out all those devices virtually and physically that are connected,” he elaborated.

You don't know what you don't know!

He also advocated thinking like a customer.

“The last thing you want to do is suddenly start to think you are having an attack or denial of service attack, and you have no idea what device is being affected, or where it is originating from. So, the simple thing first - know what's connected to your network, physically and virtually,” he reiterated.

“What does a customer want? Customers want everything as a service. They want everything to be cloud-based. They want it to be accessible 24/7. They want to have zero security risks when they do it, and they want to know who is accessing the data, and they want to know what to do with that data,” he continued.

Assume that the customer can see the data, will it help them make facilities operate more efficiently? How does this attach back into the IT world?

“The reason we say everything as a service is because at the end of the day, anything as a service is going to live in the cloud, and it's going to have security vulnerabilities, right? If we look at just one, just something in isolation on the OT network, or something in isolation on the IT network, we're not looking at everything. So, look at everything as a service in there, and how that affects the organisation,” he explained.

Lastly, he believes that best practice is about people and psychology.

“It is a mixture of convergence and integration. You want one team that is working together for one goal. Whether you have operational people sitting in your IT team, or IT people sitting in your operations team, whichever way it may be – you have got to have the right governance in place,” he explained.

Having the right culture – of ‘us’ and not ‘them’ in place will be important in this IT-OT connected world.

“As these technologies integrate more, and they converge more, as well, there is probably not going to be an IT person. There is probably not going to be an operations person. They are just going to be the network security people in general,” he concluded.

Click on the PodChats to listen to Farrell offer his expertise and opinion on IT-OT convergence.

1. What is IT-OT convergence? What are the implications for businesses?
2. Should it be considered IT-OT convergence or IT-OT integration?
3. How has the growing adoption of 5G and IoT technologies led to the convergence (integration) of IT and OT systems?
4. How should these be connected to the IT systems be secured?
5. Please name 3 best practices for a holistic IT/OT cybersecurity programme?

The post PodChats for FutureIoT: Securing IT-OT convergence appeared first on FutureIoT.

According to ABI Research, the total installed based of LiDAR sensors in smart cities, security, and industry verticals will reach 16 million by 2030, higher than the 13 million LiDAR sensors to be installed in vehicles during the same time period.

This coincides with technological innovation, such as the shift from mechanical to solid-state LiDAR sensors and the maturity of 3D perception software that enable the integration into and the automation of a growing number of important processes and applications.

“This extends the opportunity for LiDAR manufacturers to not only serve highly competitive, concentrated, and price-sensitive markets like automotive, but also several large IoT markets, such as security, smart cities, and industrial automation, characterized by a larger and more diversified end-customer base,” said Dominique Bonte, vice president for End Markets and Verticals, ABI Research.

In a recent whitepaper entitled “Demystifying LiDAR: IoT and Automotive Applications, Industries, and Business Models”, the technology intelligence firm explores how the unique features and benefits of LiDAR technology will drive innovation and value across industry segments.

While the driverless vehicle market remains the largest opportunity for LiDAR sensor technologies in the longer term, there is a more imminent business proposition in various IoT markets.

“With the autonomous car market now not expected to take off until well into the second half of this decade, LiDAR suppliers are actively exploring many new use cases across various non-automotive verticals such as smart cities, security, and industrial automation,” Bonte said.

He added: “These markets are primed to leverage LiDAR’s inherent advantages of robustness in outdoor environments, reliability, range, and 3D resolution compared with other sensors such as camera, radar, and infrared sensors. Also, these IoT markets have less concentrated ecosystems representing both much larger addressable markets in terms of the number of potential buyers and more promising profit margins compared with automotive.”

Moreover, the IoT markets will reach mass-market maturity faster than automotive, yielding significant business value before the middle of this decade.

LiDAR use cases

Bonte predicts that LiDAR technology  and its supplier ecosystem will continue to evolve in two important respects.

“First, the shift from mechanical to solid-state LiDAR sensor technology will drive lower price levels, ultimately dropping below US$500, higher manufacturing scalability, and lower maintenance levels due to reduced tear and wear. Second, the LiDAR supplier ecosystem, currently consisting of more than 100 players, will mature and consolidate to between 10 and 20 key players by 2030,” he said.

Specific aspects of the use of LiDAR in the various markets are highlighted below:

• Smart Cities – While the use of LiDAR for vehicle traffic and pedestrian safety monitoring is already quite well established in the Intelligent Transportation Systems (ITS) market, new opportunities include people counting, flow monitoring, and management at airports and retail locations as well as building occupancy detection. Value propositions include protection against Covid-19, higher safety levels, increased efficiency and cost savings, improved user experiences, and the collection of marketing intelligence data.
• Security – LiDAR sensors can be deployed in security contexts for a wide range of applications and use cases, including outdoor/indoor surveillance and public safety, border control, intruder detection, access control, and perimeter defence. Critical infrastructure represents the largest security market for LiDAR with data centres, energy generation and distribution, water and utilities, nuclear facilities, and oil and gas as the main segments. Other security categories include commercial buildings, warehouses, and border control. In many environments, LiDAR will coexist with biometrics sensors to offer a full range of security features stretching from early, long-range detection to facial recognition.
• Industrial – LiDAR is currently adopted by automated material handling solutions in the industrial sector, including automated forklifts, pallet stackers, towers, and tuggers. These automated solutions help to resolve labour shortages and provide the necessary productivity gain. For effective operation, these automated solutions rely on 2D LiDAR for critical functions, including operational safety, localization, and navigation. As autonomous robots are increasingly deployed in dynamic and outdoor environments, 3D LiDAR is expected to play an important role in sensor fusion, mapping, and path planning in field environments, like mines, industrial plants, ports, and farmland.
• Automotive – LiDAR has a well-established use case in the automotive industry, providing extra redundancy in the perception stack for unsupervised autonomous applications. As a ranging sensor able to deliver helpful semantic insight, LiDAR is ideally positioned to add the vital “third opinion” to the current camera-radar mix once the human driver has been taken out of the loop. However, these unsupervised autonomous applications will take years to materialize at scale, limiting the market potential for automotive LiDAR for the next five years.

The post Non-automotive LiDAR adoption to reach 16M by 2030 appeared first on FutureIoT.

The paper claims that Smart Destinations require this smart management as well as the integration of the stakeholders’ value-chain throughout the entire process. In this process, IoT has a crucial role in enhancing the experiences of tourists, managing the destination more efficiently, and offering a channel of information exchange.

Sanjiv Verma, vice president, Ruckus Networks, APAC from CommScope, acknowledged that personalised guest experience remains at the top of the must-achieve for guests. That said, following the prolonged, there is a greater focus on sustainability.

“From the hotel properties side, they are looking into how they can improve the operational efficiencies when they're delivering these services,” he opined. At the same time, there is pressure on these businesses to improve asset utilisation, so they have a better return on capital.

According to Verma, IoT devices are used to improve facilities management by deploying sensors to regulate conditions such as temperature and air quality in tooms. “If somebody left the door open in the balcony, rather than the AC running, (sensors) can turn the AC off automatically so that there is much better conservation of energy,” he suggested.

He conceded that one of the biggest challenges here is the integration of operational technologies (OT) with information technology (IT) – so that you have a single network where you can optimise your cost and efficiency, he continued.

In addition, IoT can also be used to ensure both the security of guests and staff.

He suggested that if a guest room is accidentally left open, sensors can inform hotel management of such and assign staff to check out what has happened and take appropriate actions.

Verma is quick to remind that with more connected devices the more complex the ecosystem becomes, and the more important cybersecurity becomes.’

“Any kind of connected devices poses the same risk as IoT devices will. Those that can be leveraged to make sure that when guests are in the hotel, their information is protected, their payments through the card system are protected and things like phishing attacks can be protected. A lot of this stuff is treated in the same way as an enterprise network. We need to make sure that those tools are in place and that the customer can be protected from all these attacks,” he suggested.

Improving IT-OT connectivity

Verma commented that the reality is that businesses maintain multiple networks that operate in silos. He acknowledged that some hotels are working to improve efficiencies by merging networks.

The (merger) process starts with a consolidation of network protocols with the intent of merging the OT and IT on a single platform.

“There is software like “SmartCell Insights” which are labelled, which can give you a common dashboard and will be able to provide all the visibility from various IoT devices that allows you to manage them from the control centre,” he elaborated.

Click on the PodChat player and listen to Verma go into details about how the hospitality industry, one segment of the Tourism and Travel industries, can take advantage of IoT to move into the digital economy.

1. How will the hospitality industry shift in the next few years in a technology perspective in terms of streamlining processes and ensure hotels operate more efficiently?
2. Beyond the current IoT implementations in hotels, what are the other ways hotels can leverage IoT to increase efficiency level in building maintenance and what are the potential challenges they might face?
3. With hotels adopting more advance security systems (for entire property and individual guestrooms), how do we ensure that they will not be bypassed by a third person?
4. With travel slowly restarting, what can hotels implement to boost travellers’ confidence within the property, while at the same time allow hotels to ensure safe distancing and have sufficient health & safety protocols in place?
5. You mentioned the need for OT to work with IT for better network efficiency. How do we bridge the divide between IT and OT to maximise value for the business and experience for customers?

The post PodChats for FutureIoT: How IoT brings the hospitality industry to the digital economy appeared first on FutureIoT.

“With most of the region working remotely, demand for digital services in APJ is growing, and with digitalisation comes inherent risk. In the industrial world, that risk is particularly high as previously isolated OT networks become more integrated with IT networks, and thus exposed to a whole host of cyber threats they were not designed to face,” said Yaniv Vardi, CEO of Claroty. “Our expansion in in Asia Pacific and Japan is a reflection of this growing demand as well as the success we’ve achieved to date in the region, and we look forward to working with our strong ecosystem of partners to continue building upon this success.”

According to ResearchandMarkets,  global OT cybersecurity market will be worth US$18.13 billion by 2023, with Asia-Pacific's OT cybersecurity market projected to grow at a higher CAGR in the forecast period. Manufacturing and mining will be the largest sectors with a strong growth trajectory over the study period. The impact of COVID-19 will be significant across these sectors and other key segments, including oil and gas, transportation and smart cities, and power verticals from 2020 to 2023.

Claroty noted that spending on OT cybersecurity in the region is increasing as large-scale cyber incidents impacting critical industrial operations have become more pronounced – pointing out that countries in Southeast Asia have increased their spending on industrial cybersecurity as critical infrastructure in industries such as telecommunications, finance, energy and technology become targets of persistent threat actors.

The company added that such incidents have also made regulators aware that they need to prioritise the security of critical national infrastructure, whether publicly or privately held. Thus, regional agencies are assessing how they will mandate that incident-reporting procedures and cybersecurity practices be installed and required of companies which operate in certain sectors, especially those in energy, oil and gas, transportation, finance, healthcare, and food and beverage. For one, Singapore’s Cyber Security Agency (CSA) has drafted a Master Plan for OT cyber resilience, and are installing expert panels to advise them.

Eddie Stefanescu, general manager of Asia-Pacific and Japan (APJ) at Claroty said the company’s remit with existing customers in the region has significantly expanded, as their industrial cybersecurity programs continue to mature.

“It takes specialist knowledge and experience to effectively implement cybersecurity for OT networks, and what differentiates Claroty is the depth of visibility we have into those networks when our platform is implemented,” said Stefanescu. “That’s why public and private entities, including Coca-Cola EuroPacific Partners (Australia, Pacific, Indonesia), BHP, IRPC Public Company Limited, and Aboitiz Power, are investing in Claroty.”

To date, the company  is experiencing hyper growth in the region, having doubled its client base and achieving 250% growth in revenue year-over-year from the first half of 2020 to 1H 2021. The company has tripled its headcount in the region over the past year, with hiring occurring across seven countries.

“Across Australia and Asia, Claroty is a strong partner for companies in the oil and gas, utilities, manufacturing, water, and electrical power industries, but our customer base is broadening. In the past year, we have also experienced strong growth in the food and beverage sector, and in the pharmaceutical sector for the distribution of Covid-19 vaccines,” said Stefanescu.

Meanwhile, the opening of Claroty’s regional office in Singapore comes shortly after Claroty’s US$140 million in its Series D financial round, which included participation from Temasek.

The post Claroty opens APAC regional office in Singapore appeared first on FutureIoT.

The new solution  leverages more than 20 years of experience in network security testing to reveal security vulnerabilities across any network technology. The software offers comprehensive, automated testing to rapidly cover a large matrix of known and unknown vulnerabilities.

IoT security assessments include novel cybersecurity attack tools and techniques for wireless interfaces such as Wi-Fi, Bluetooth, and Bluetooth Low Energy (BLE) to test known vulnerabilities, as well as to discover new vulnerabilities.

 Development organisations can easily integrate Keysight’s API-driven solution into their development pipeline with a single API for control and reporting. Organisations deploying IoT devices can leverage the software to validate IoT devices before they are delivered to end users and as new vulnerabilities become a concern. Ongoing research from Keysight’s Application and Threat Intelligence Research Center provides updates to the latest protocol fuzzing and attack techniques.

IoT security vulnerabilities – BrakTooth discovery

Recently, researchers at Singapore University of Technology and Design (SUTD) discovered a group of vulnerabilities, they named BrakTooth, in commercial Bluetooth chipsets that impact billions of end-user devices. The SUTD research was funded with a grant from Keysight. The SUTD published results were leveraged into improvements in Keysight’s IoT Security Assessment software.

BrakTooth captures fundamental attack vectors against devices using Bluetooth Classic Basic Rate/Enhanced Data Rate (BR/EDR) and is likely to affect Bluetooth chipsets beyond those tested by the SUTD team.

"It is hard to accurately gauge the scope of BrakTooth affected chipsets,” commented Sudipta Chattopadhyay, assistant professor, SUTD. “We advise all Bluetooth product manufacturers to conduct appropriate risk assessments, especially if their product may include a vulnerable chipset. We are thankful to Keysight for generously supporting our research and the opportunity to collaborate with the experienced Keysight security team.”

The vulnerabilities, which include 20 common vulnerabilities and exposures (CVEs), as well as four awaiting CVE assignments, are found in Bluetooth communication chipsets used in System-on-Chip (SoC) boards.  These pose risks that include remote code execution, crashes and deadlocks. The SUTD team responsibly disclosed the findings to the affected vendors, providing a means to reproduce the findings and time to remediate vulnerabilities.

“Research activities like these at SUTD are critical to improving cybersecurity in the connected world. If the good guys don’t improve it, the cyber criminals will take advantage of vulnerabilities for nefarious purposes,” said Steve McGregory, senior director of Keysight’s security research and development team. “While investment into research is needed and helpful, software and chipset manufacturers are responsible for delivering secure products using rigorous security testing.”

IoT devices are the weakest cybersecurity link

Increasing numbers of connected IoT devices enable hackers to leverage cybersecurity vulnerabilities for a range of attacks including malware, ransomware and exfiltration of data.

According to Statista, the total installed base of IoT connected devices worldwide is projected to grow to 30.9 billion units by 2025 from 13.8 billion units expected in 2021.

“IoT device vulnerabilities are especially dangerous as they can facilitate sensitive data breaches and lead to physical danger, such as industrial equipment malfunction, medical device defects, or a home security system breach,” wrote Merritt Maxim, vice president, research director, and Elsa Pikulik, researcher, Forrester, in the State of IoT Security Report 2021. “In 2020, IoT devices were the second most common vector for an external breach and technology leaders rank security issues as a top concern plaguing or hindering IoT deployments.”

The post Keysight launches new IoT security assessment software appeared first on FutureIoT.

According to Gemalto, another worrying stat, 48% of businesses admit that they cannot detect IoT security breaches on their network. Nearly half of the companies that use IoT can’t identify when their network is compromised. As more businesses invest in IoT technology, we can only hope that this number decreases.

According to Pieter Danhieux, the co-founder and CEO of Secure Code Warrior, an average building will have air conditioning, automated doors, surveillance cameras – many running on IoT systems. In the agriculture business, tractors, measuring devices and rainwater stations also run IoT.

“In homes today, you will find IoT in Christmas lights, door locks, etc. IoT has infiltrated both enterprise and our personal lives, which is a good thing because it allows us to do many, many great things. But it could also be a very scary thing,” he commented.

State of security in IoT devices

Danhieux opined that when manufacturers build IoT devices they don’t think that these things would be exploited. He argued that manufacturers are under pressure to build these devices at the lowest possible cost and deployed them quickly.

“People don’t think about the potential threats we could face with some of these IoT devices, whether it is hardware or IoT software development kits (SDKs). The vulnerability could be in how the IoT communicates from within the network,” he added.

His point was that it's a very complex environment. “I think, and not many people, when they are building those devices are thinking about all the different problems that can go wrong, around IoT security,” he continued.

In the IoT manufacturing space, everything needs to be minimal. This may mean a lack of processing power to do proper cryptography. “Those are the trade-offs that manufacturers make. Some cannot do remote updates, remote patching of firmware vulnerabilities. It is stock firmware that never changes even though it [may have] weaknesses in it,” Danhieux elaborated.

Buyer beware

At the personal level, there is increasing awareness and concern about device insecurity. Danhieux believes the same should apply to enterprises. He noted that very often the IoT network is separated from the IP network and managed by a different group.

He warned that IoT can still be used as a launchpad for attacks. He cited the Mirai botnet that exploited vulnerabilities on software development kits of some 83 million IoT devices.

“I do think both from an enterprise, we should ask the right questions to the manufacturers. I think from a personal life perspective, as well, we should make sure that manufacturers of IoT devices, that there is a level of responsibility they take around building secure devices, rather than just building a device and getting it out there,” he opined.

Key considerations for revisiting security for infrastructure

Danhieux recommends scanning and testing networks for vulnerabilities. This includes all devices connected to the network, regardless of age.

The next step in the process is determining whether it makes sense to build layers of defences into the infrastructure. Can device manufacturers update the firmware of these devices? He recalled that some of these devices could be 20 to 30 years old.

He recalled that 20 years ago, enterprises were dealing with web application securities. He now sees those same vulnerabilities appear in IoT devices today. Things like remote command injections and buffer overflows are well-known problems but are now appearing in the IoT world.

Skills gap

Danhieux warned that looking for a security expert that knows IoT may be a problem. It is a very specialist role, and there are very few firms around the world that focus on IoT security, including at the network, data, and software layers.

He acknowledged the skills can be developed in-house.

“Developers can be taught to write securely at the data and software layer. Network security architects and security engineers can be tasked with assessing the network component. You might find somebody that can work with physical devices to assess the physical side,” he continued.

“But to find it all in one person inside an enterprise. I think it's almost impossible. That's probably a security expert. You need to hire for that. You can kind of split them up in the different layers of your organization.”

Pieter Danhieux

Ownership of IoT security

Danheiux acknowledged that ownership of IoT security remains a philosophical issue. Internet Protocol (IP) security people normally do not care about the security of buildings.

“However, at the end of the day, if it is a threat to your business, if it can damage your enterprise, if you could damage your reputation, does it matter which C level person in the company takes ownership of it? He queried.

He opined that at the end of the day, it is a business risk. It doesn’t matter which C letter is responsible. Not covering it [security] is the big problem, he concluded.

Click on the PodChat player and hear Danhieux talk about the state of IoT security in Asia.

1. Let’s frame our discussion first: where can we find IoT technologies in a typical enterprise in Asia?
2. What are prevailing misconceptions about IoT security?
3. From your perspective, should leaders be concerned about IoT security?
4. Where should senior leadership begin the discussion of IoT security?
5. What should be the key considerations for revisiting the security of their IoT infrastructure?
6. What about the skills/know-how around IoT security? Do we hire or outsource?
7. What preconceived ideas should leaders set aside when discussing IoT security?

The post PodChats for FutureIoT: State of IoT Security appeared first on FutureIoT.

Established in 2019, Cloud Energy specialises in IoT energy management for smart cities. It develops solutions for smart energy building management, smart utilities management and smart solar monitoring systems.

The wireless rooftop-mounted solar power system being developed by Cloud Energy will feature Semtech’s Lo-RA devices and LoRaWAN connectivity are designed to provide a comprehensive, accurate and independent data management from inverters, electrical meters and sensors to its customers.

“We believe that the future of monitoring solutions will largely adapt to LoRaWAN wireless technology, which is highly scalable, simple to deploy and provides a reliable wireless connection. Solar power monitoring solutions that use LoRaWAN technology may be a new future trend that not only solves the problem of reliable wireless connectivity, but also provides additional benefits of IoT standardisation, scalability, data analytics, and interoperability,” said Tuan Anh Pham, Cloud Energy founder.

Furthermore, the company claimed that solar-powered system solutions saved its customers more than 30% on initial investment for a monitoring system.

The company opted for a wireless LoRaWAN-based network for the solar power system because a wired solution has a higher hardware and installation costs and requires a high-level of maintenance, particularly in Vietnam’s rural areas where cables are like to encounter damage caused by rodents.

The Cloud Energy wireless solar power system is a plug-and-play solution consisting of multiple wireless Cloud Energy modules, one Kerlink gateway using LoRaWAN and a Cloud Energy web-app to monitor real-time data to review and forecast performance independently across meters, inverters and sensors.

Through the integration of LoRaWAN, the Cloud Energy solar power system is a true wireless solution offering stable data transmission for end users to manage energy usage across wide areas.

“Cloud Energy’s successful implementation of the LoRaWAN standard for its wireless solar power systems showcases the versatility of the IoT technology to adapt to nearly any setting and budget. The robust connectivity from LoRaWAN is creating smarter buildings for more informed business decisions,” Marc Pégulu, vice president of IoT product marketing and strategy at Semtech’s Wireless and Sensing Products Group.

The post Semtech teams up with Vietnam-based Cloud Energy appeared first on FutureIoT.

Provided by the Tokyo International Air Terminal Corporation (TIAT), the service eliminates the need to show passports and boarding passes at baggage check, security screening and boarding gates. The self-service kiosks captures facial images  to authenticate the  identity of passengers registering for the Face Express service.

Initially, the self-service kiosks and Face Express are only available to passengers of Japan Airlines and All Nippon Airways.

TIAT has chosen German-based Materna to integrates its IPS One ID software into the kiosks. The biometric software uses facial recognition technology to capture a passenger’s image and matched it with his picture from the scanned government-issued ID.

Personal information collected from passengers are used solely for the purpose of providing and operating Face Express and is not given to anyone other than the participating airline. TIAT is responsible for recording and storing the data, and erasing it within 24 hours

By allowing passengers to identify themselves at the self-service touch points, physical contact with airport staff, minimising the risk of COVID-19 infection.

“Contactless technology has become an important way to maintain strict security standards during the pandemic,” said Yuya Yamazaki, technical project manager at TIAT. "We greatly appreciate that Materna completed the deployment of its IPS into the kiosks before the Tokyo 2020 Olympics and Paralympic Games, which is one of our goals of this project."

Last year,  Materna  also installed its IPS  in 104 self-bag drop kiosks in Terminals 2 and 3 of the Tokyo Haneda Airport. These kiosks have now been upgraded to handle the facial biometric authentication needed for the Face Express Service.

The post Facial biometric systems installed at Haneda Airport appeared first on FutureIoT.

Radiflow has introduced the Cyber Industrial Automated Risk Analysis Platform (CIARA), which allows for a digital twin of multiple facilities to be created on the same UI in order for security and risk teams to execute OT-BAS (Breach & Attack Simulations) in a global enterprise view.  The  new enterprise-level risk management system for OT facilities allow CISOs to view all their sites in one dashboard.

This takes the guesswork out of OT by letting teams anticipate the impact of potential threats via simulations of known attacks from a continuously updated global database. They can then simulate WHAT-IF scenarios of mitigations to decide which course of action would be most suitable in light of the changes in the threat landscape.

While this has been a common practice to prepare for attacks in the IT world through twin-network simulations, it is the first time that an OT environment can benefit from this proven strategy. CIARA offers a first-of-its-kind, non-intrusive breach attack simulator that takes into account the business importance of each site so the CISO can find the most vulnerable points on their industrial automation networks across all their sires, allowing them to practice the most effective mitigation tools.

The ability to configure business importance for each site and benchmark top sites in a central dashboard – while allowing site managers to view their individual risk posture and optimise their security roadmap – is  a major step in securing potential vulnerabilities across multiple facilities. Allowing CISOs to continuously monitor and simulate vulnerabilities, based on recent attacks that have been attempted in their industry or location, has a significant impact on the quality of OT monitoring, without slowing down or stopping critical infrastructure.

“CIARA is now a central environment where CISOs can evaluate proven security techniques against the latest threats without tampering with their existing network”, said Ilan Barda, founder & CEO of Radiflow. “Using the revolutionary all-in-one dashboard to keep an eye on all global operations is a critical step to preventing any cyberattack on vital OT facilities.”

Based in Tel-Aviv, Radiflow work directly with managed security service providers to oversee the discovery and management all relevant data security points. The company’s solution is currently installed in over 5,000 sites worldwide.

Its newest CIARA software release was recognized as a vendor in the Cyber-Physical Systems (CPS) risk management category, which is in the Innovation Trigger of the Gartner® report titled, “Hype Cycle for Cyber and IT Risk Management”, 2021. Since its release, CIARA has earned acclaim for its capabilities in providing a data-driven approach to OT Security, especially following multiple major OT attacks, such as on the Colonial Pipeline and JBS.

The post OT risk platform allows attack simulations through digital twin appeared first on FutureIoT.

Now on its fourth edition, the index, is the centre piece of a research project sponsored by NEC Corporation. It ranks 60 cities across 76 indicators, organised along five pillars: personal, health, infrastructure, digital and – new this year – environmental security.
The Lion City ranks third in the worldwide survey behind Copenhagen and Toronto, which place first and second respectively.

“Digital security is now an even higher priority as more work and commerce have moved online; those responsible for infrastructure safety have to adjust to dramatic changes in travel patterns and where residents consume utilities,” said Naka Kondo, senior editor of The EIU and editor of SCI 2021.

“Agencies responsible for personal security need to address a large, lockdown-driven shift in crime patterns; and the priority that urban residents and officials assign to environmental security has risen markedly as covid-19 serves as a stark warning of unexpected crises,” she added.

Research shows that the performance of different safety pillars correlates very closely with each other, signifying that different kinds of safety are thoroughly intertwined. The top performers in each pillar are as follows:

• Digital security: Sydney (1), Singapore (2), Copenhagen (3), Los Angeles / San Francisco (4),
• Health security: Tokyo (1), Singapore (2), Hong Kong (3), Melbourne (4), Osaka (5)
• Infrastructure security: Hong Kong (1), Singapore (2), Copenhagen (3), Toronto (4), Tokyo (5)
• Personal security: Copenhagen (1), Amsterdam (2), Frankfurt (3), Stockholm (4), Brussels (5)
• Environmental Security: Wellington (1), Toronto (2), Washington DC (3), Bogota (4), Milan (5)

The Safe Cities Index reveals that different global region have distinct strengths. In particular, well-off Asia-Pacific cities tend to perform better on average when it comes to health security and infrastructure security, while European cities on personal security and North American cities on digital security.

Meanwhile, the introduction of the new pillar for environmental security in this year's index reflects the increased importance of sustainability issues and climate adaptation measures amid the pandemic. Toronto and Copenhagen performed noticeably better in the new environmental security pillar than do any of the top-three cities from earlier years. Interestingly, the index also shows that leading middle-income cities do far better in this area than in any other categories. In particular, three at this income level finish in the pillar's top ten: Bogota (4th); Rio de Janeiro (8th); and Kuala Lumpur (10th).

The post EIU: Digital security a high priority among cities appeared first on FutureIoT.

Tokyo-based CG provides Japan's first decentralized ID platform called UNiD, while the Yokohama-based TSSR, has  strong expertise in IoT device software development.

The rise of the Stay-at-Home economy has accelerated the adoption of contactless transactions at the consumer level, and both companies see a huge business potential in providing verification  of IoT devices used contactless transactions. Particularly with the shift to contactless transactions in smart bank branches, virtual concierges at healthcare and government services, digital orders at restaurants, and automated receptions at offices and hotels.

According to a Deloitte study, the market size of the contactless economy in Asia Pacific will reach US$11 trillion, double the current level.

“With the COVID-19 pandemic, the number and type of businesses that need to interact with users contactless have exploded beyond the specific industries. We believe that the verifiable data exchange platform between "people" and "machines" in a decentralised manner, will support the transformation to contactless systems in a wide range of fields, including new work styles, mobility, logistics, and smart cities, and will contribute to progress our digital society. We are pleased to be the first mover in the world to take on this challenge,” said Masayoshi Mitsui, CEO, CollaboGate Japan.

A decentralised  IoT platform

With the alliance, both companies will be working on a proof-of-concept project that intends to build a "decentralised IoT platform" that smoothly connects people and things, and a "smart concierge" that enables the contactless economy by using "UNiD" decentralized ID platform developed by CG and TSSR's expertise in embedded system development on Renesas’ MCUs.

“In the current Internet system, it is difficult to automatically verify the data provided by users without a trusted third party. In reality, the manual verification process of the data is still necessary for businesses. By introducing a decentralised identity mechanism to IoT devices, we can build a mechanism that allows them to autonomously verify the data provided by users. This will enable the safe and quick delivery of services of their needs,” the companies said in a press statement.

They added: “In this project, we will build a prototype of a "smart concierge" with an identity verification function for use in BFSI, healthcare, government, and access management at offices, hotels, factories, logistics warehouses.”

IoT devices must be able to correctly identify, authenticate, and authorised users, automatically verify the data applied for, consider user privacy, and ensure the security of unattended IoT devices. A decentralised IoT platform that meets these requirements is needed for a smooth transition from the face-to-face to the non-face-to-face system.

CG”s and TSSR’s “smart concierge model has four steps: first, service provider issues credentials (identity verification information, usage permit) to the user's mobile wallet; second,the user sends the credentials stored in the wallet to the IoT device; third, the IoT device verifies the credentials and opens/closes the gate; and fourth, access log is sent to the cloud server.

With the smart concierge model,  people can check in to hotels, accommodations, and other lodging facilities and unlock their rooms by simply carrying their mobile app. It can also streamline the validation and entrance for live music, concerts, baseball, football, and other sports, as well as theme park facilities. The system is also expected to enable contactless operations and efficiency that have been conducted face-to-face, such as the efficient management of office visitors, logistics warehouses, medical and educational facilities.

Raising IoT security

IoT devices that are connected to the network are subject to security risks such as hacking and identity theft. For one,  the access IDs and passwords hard-coded into IoT devices are vulnerable if they are left as default settings or are easy to guess. In fact, there was a case where a large number of IoT devices were illegally accessed and used as a botnet to launch DDoS attacks.

For this reason, security by the PKI standards has significant advantages over the password method. However, the conventional PKI standards using CA certification authorities require manual management of many certificates for each IoT device. In addition to being a very time-consuming task, there are risks such as the leakage of private keys managed by the service operator. In addition, the time and effort required to renew certificates lead to the use of certificates with a long expiration date, which causes vulnerabilities. Thus, the conventional PKI standards have problems in terms of cost, operation, and security.

By introducing a decentralised ID mechanism to IoT devices, first, a key pair is generated within the IoT device, then the public key corresponding to the digital signature is registered in the decentralised PKI network. Anyone from the network can reference this public key, and a cloud server communicating with the IoT device can retrieve this public key and verify the digitally signed data. This is expected to eliminate the need for manual verification, increase security strength, and significantly reduce the operating costs of IoT devices.

Enabling privacy-preserving data transactions

CG and TSSR will also design the decentralised IoT platform to comply with current regulations such as GDPR and CCPA, which impose a separation between holding data and using the data.

In Japan, the Act on the Protection of Personal Information is scheduled to take effect in April 2022, and the handling of personal data via IoT devices will require system design based on the same consideration of individual privacy. Decentralized IoT platforms provide a mechanism that enables IoT service providers to provide the desired services without retaining unnecessary personal information. It provides a mechanism for safe and smooth authentication and data transactions between people and IoT devices based on personal consent, using a mechanism where individuals control their personal information.

Sakae Ito, vice president of IoT Platform Business Division at Renesas Electronics is pleased to contribute in the decentralised IoT platform with its secure MCU/MPR technologies.

“We hope that this demonstration experiment of the decentralized IoT Platform by the CollaboGate and Tessera will prove IoT devices can bring security and reliability as well as improved convenience to users, expanding the demand for contactless applications,” he said.

The post Japanese firms to build world's first decentralised IoT platform appeared first on FutureIoT.

Gartner says organizations implementing IoT are increasingly focusing on the business outcomes of the technology. IoT initiatives are no longer driven by the sole purpose of internal operational improvement.

The bad news is that this expanding universe of applications of IoT in industrial, government, consumer and commercial is drawing the interest of cybercriminals recognising a burgeoning opportunity.

From the Mirai Botnet (aka Dyn Attack) of October 2016 to the discovery of hackable cardiac devices at St. Jude Medicals in 2019 to the hacking of a Bluetooth speaker that allowed the criminals to eavesdrop on a CFO’s private conversation, the threat is real, and it is now.

The why of IoT security

Beng Hai Sim, head of Technical Sales at ESET, Asia Pacific, defines IoT security as the act of securing the IoT device and the network it is connected to.

“The interconnection of IoT poses a significant challenge for organisations due to the serious security risks posed by unmonitored and unsecured devices connected to the network. The need to think about security on a daily basis has never been greater, especially given that the number of internet-connected devices is expected to grow at an exponential rate,” he added.

Bots: the who/what of IoT security

Sim said IoT botnets are a type of malware that commonly targets IoT devices. He explained that IoT devices that have been compromised by bots are frequently used as communication channels to other compromised devices in the network known as botnets. Unpatched vulnerabilities may also exist in routers to which the IoT devices are connected.

Citing ESET telemetry, Sim revealed that ESET scanned nearly 200,000 routers during the first four months of 2021 and discovered that over 2,200 of them had at least one known vulnerability. The most common type of router attack is distributed denial of service (DDoS).

DDoS attacks affect 70% of organisations polled on a monthly basis.

IoT security starts here

Echoing a security industry theme, Sim says cybersecurity is a shared responsibility.

From an IoT security perspective, he says the CISO has the responsibility to educate employees on cybersecurity awareness training.

Beyond regular training and continuous awareness, he suggests that when purchasing IoT devices, organisations should first select a well-known, dependable IoT device provider who is likely to be around in the long term. This ensures that the manufacturers will be able to provide patches and fixes to the IoT devices in the future in a timely manner.

“It is crucial that the IoT devices that they have selected are secure by design, with security being a key goal at all stages of product development and deployment,” he added.

The reality of IoT security

Sim acknowledges that not everything can be secured immediately!

“Given that there are so many IoT devices out there, it is unrealistic to consider the security design of every single IoT device, but businesses can look at cybersecurity infrastructure and techniques to reduce risk,” he opined.

He recommended adopting the Zero Trust security model requiring all users, both inside and outside of an organisation's network, to be authenticated, authorised and continuously validated for security, configuration and posture before being granted or maintaining access to application and data.

He also suggested network segmentation as a useful approach to isolating IoT devices from other network systems.

“A simple analogy I’d use is the current pandemic situation, where we enforce social distancing to minimise the spread of the Coronavirus,” he continued.

According to Gartner, utilities will be one of the highest users of IoT endpoints, totalling 1.37 billion endpoints in 2020.

An expanding universe of applications

“Electricity smart metering, both residential and commercial will boost the adoption of IoT among utilities,” said Peter Middleton, senior research director at Gartner. “Physical security, where building intruder detection and indoor surveillance use cases will drive volume, will be the second-largest user of IoT endpoints in 2020.”

Building automation, driven by connected lighting devices, will be the segment with the largest growth rate in 2020 (42%), followed by automotive and healthcare, which are forecast to grow 31% and 29% in 2020, respectively.

In healthcare, chronic condition monitoring will drive the most IoT endpoints, while in automotive, cars with embedded IoT connectivity will be supplemented by a range of add-on devices to accomplish specific tasks, such as fleet management.

Click on the PodChat player and listen to Sim describe the why and some options for securing the Internet of Things.

1. Define security as it relates to the Internet of Things?
2. What some of the most common vulnerabilities in IoT devices found in enterprises?
3. Why is it important for organisations to pay attention to securing IoT devices?
4. Who is responsible for securing IoT devices in an enterprise?
5. What should organisations do to secure their IoT devices?
6. Is it realistic to think that we can secure all the 50 billion IoT devices connected out there?
7. It’s been said that remote work has accelerated IoT further. What is your advice to organisations today as regards securing known devices and protecting against the unsecured unknown?
8. What should enterprises look for when it comes to security solutions to address IoT devices in the network?

The post PodChats for FutureIoT: Securing the Internet of Things appeared first on FutureIoT.

These are the findings of the 2020 Report on Threats Affecting ICS Endpoints released today by Trend Micro researchers who warned of the  growing risk of downtime and sensitive data theft from ransomware attacks aimed at industrial facilities.

"Industrial Control Systems are incredibly challenging to secure, leaving plenty of gaps in protection that threat actors are clearly exploiting with growing determination," said Ryan Flores, senior manager of threat research for Trend Micro. "Given the US government is now treating ransomware attacks with the same gravity as terrorism, we hope our latest research will help industrial plant owners to prioritise and refocus their security efforts."

Flores is referring to the cyberattack on Colonial Pipeline at the US East Coast  that locked down its systems last May for several days, causing a spike in gas prices, fuel shortage and panic buying in affected areas. US authorities suspected Russian hackers behind ransomware attack. In response, the U.S. Department of Justice, last month, was reported to have issued a guidance elevating investigations of ransomware attacks to a similar priority as terrorism.

Downside of IT/OT convergence

The growing trend towards Internet of Things (IoT) has accelerated the coupling of IT and OT networks. While great business and operational benefits are derived from being able to access data from connected devices, it also unfortunately expanded the enterprises’ attack surface. And it has been recognised for several years now that ICS endpoints are the weak links in the chain.

IT/OT networks use ICS endpoints in the design, monitoring, and control of industrial processes. These endpoints are a crucial element of utility plants, factories and other facilities.

According to the Trend Micro research paper, there has been a significant rise in ransomware activity affecting industrial control systems in 2020, mostly due  to increased Nefilim, Ryuk, LockBit, and Sodinokibi attacks from September to December. Together, this  group of ransomware makes up more than half of ransomware attacks affecting ICSs last year.

The US is by far the country with the most ransomware detections affecting ICSs, with India, Taiwan, and Spain a far second.

“The US is a big country, with a vast number of organizations that can fall victim to ransomware. If we take the percentage of organizations running industrial control systems that had ransomware affecting their systems, Vietnam, Spain, and Mexico actually makes up the top three,” Trend Micro researchers said.

They added that Vietnam’s ransomware detections were residual infections of GandCrab, a ransomware that  was seen targeting Vietnam in 2018. but has since been mainly out of sight — likely because of its distributor’s arrest in 2020.

Legacy malware thrive

Legacy malware such as Autorun, Gamarue, and Palevo became rampant in 2013 and 2014 but have since waned as security policies that disable autorun have become widely adopted.

However, Trend Micro researchers pointed out that they still thrive in IT/OT networks. While they are found in less than 2% of organisations, they are detected frequently and on several endpoints within the same network, signifying a localised outbreak.

“There are a couple of practices that contribute to the situation. First, transferring files and data via USB thumb drives is usually performed as a convenient solution for bridging air-gapped networks; however, this allows the propagation of such legacy worms.

“Second, asset owners create system backups or cold standby terminals and store them in removable drives but do not perform security scans against the package that might harbour malicious software,” the researchers said, adding that their continued presence in IT/OT networks suggests inadequate security and poor maintenance of data backups and removable drives.

Other threats

According to Trend Micro, coinminers are another financially motivated malware affecting ICSs. While a coinminer’s code is not designed to destroy files or data, the mining activity’s CPU utilisation can  adversely affect ICS endpoint performance.

“In our factory honeypot research, we have experienced  unresponsive ICS endpoints after attackers installed coinminers in them. Indirectly, a coinminer can cause loss of control and view over an ICS, especially if those computers have low CPU capacity and/or running outdated operating system, a setup that is not rare in industrial environments,” researchers said.

The top coinminer family found on ICS endpoints for 2020 is MALXMR, a post-intrusion coinminer. It was usually installed through fileless techniques, but starting in 2019, we have seen MALXMR infections that use Equation group tools to exploit the EternalBlue vulnerability to aid distribution and lateral movement.

Of the countries with MALXMR running on ICS endpoints, India accounts for more than a third of detections. However, this does not mean that India is specifically being targeted by MALXMR gangs to run their cryptominers. A look at WannaCry ransomware infections showed that India also had more than a third of WannaCry infections on ICS endpoints.

“This suggests that India has the most MALXMR infections because a lot of computers running ICS software are vulnerable to EternalBlue, as Equation group tools used by MALXMR and WannaCry both exploit the said vulnerability. This data shows how a country’s general patch level makes it susceptible to certain threats,” they said.

Meanwhile, Trend Micro still sees Conficker (aka Downad) as a persistent threat for ICS endpoints. First discovered back in 2008, this computer worm is still being persistently detected on 200 unique endpoints.

“We found that at least 94% of the endpoints we analysed were running Windows 10 and Windows 7 operating systems. The most widely known propagation method of Conficker is exploiting the MS08-067 vulnerability that could allow remote code execution if an affected system received a specially crafted Remote Procedure Call (RPC) request. But MS08-067 does not apply to Windows 10 and Windows 7, which leads us to the conclusion that these infections are propagated using either removable drives or dictionary attacks on ADMIN$ share,” researchers said.

Trend Micro said security should be a major consideration when interconnecting the IT network with the OT network. Specifically, security issues that are used by both the legacy malware and the latest attack trends should be addressed.

“We recommend that IT security staff approach ICS security by understanding the unique requirements these systems have and why they were set up that way. With that in mind, IT security staff should work with OT engineers to properly account for key systems, identify various dependencies such as OS compatibility and up-time requirements, and learn the process and operational practices to come up with a suitable cybersecurity strategy to properly protect these important systems,” researchers said.

The post Trend Micro: ICS endpoints prone to cyberattacks appeared first on FutureIoT.

As enterprises accelerate their digital transformation, and with it, the shift to the cloud of many of its core technologies, it becomes quickly imperative for organisations to revisit their security strategy, else they come the next victim to the increased cybercrime activities observed that started in 2020 and continues today.

Traditional firewall solutions have proven to be difficult and cumbersome to dynamically scale up to meet unpredictable traffic patterns, as seen with Denial of Service (DoS) attacks, new product launches, breaking news, or other sudden increase in demand for firewall processing capabilities.

This Check Point Software Technologies white paper, Making the jump to hyperscale network security, offers a detailed and practical look at the technical and operational challenges that enterprises looking to tap the hyperscale growth must address.

Click on the link and download this Check Point whitepaper to learn Check Point Maestro addresses current and future network security requirements in the cloud.

The post Making the jump to hyperscale network security alongside IoT appeared first on FutureIoT.

The new funding will also be used to accelerate the company’s expansion into new verticals and regions.

“Our mission is to drive visibility, continuity, and resiliency in the industrial economy by delivering the most comprehensive solutions that secure all connected devices within the four walls of an industrial site, including all operational technology (OT), Internet of Things (IoT), and industrial IoT (IIoT) assets,” said Yaniv Vardi, CEO of Claroty. “With this new investment, we have the financial runway to execute on our proven product strategy in a hyper-growth market, with a world-class leadership team and a strong ecosystem of partners to take us there.”

That latest round of funding is led by Bessemer Venture Partners’ Century II fund and 40 North, alongside additional strategic investors such LG and I Squared Capital’s ISQ Global InfraTech Fund. All previous investors, including Team8 and long-time customers and partners Rockwell Automation, Siemens, and Schneider Electric, have also participated. The round brings the company’s total funding to US$235 million.

According to Cybersecurity Ventures, global ransomware damage costs are predicted to exceed US$265 billion by 2031, up from US$20 billion in 2021. As these incidents show no signs of slowing, Claroty’s new investment has firmly placed the company at the forefront of the market with the resources, experience, and capabilities needed to shore up industrial cyber defences for the future.

Claroty protects organisations’  industrial assets, connections, and processes, with deployments in thousands of locations and facilities across 50 countries in all seven continents. For one, the company has worked closely with Pfizer to secure its COVID-19 vaccine supply chain in its race to meet unprecedented global demand.

Other customers include General Motors, BHP, Coca-Cola EuroPacific Partners (Australia, Pacific, Indonesia), IRPC Public Company Limited, Aboitiz Power, Rockwell Automation, Siemens, and Schneider Electric.

The company’s  platform connects seamlessly with customers’ existing infrastructure and programs while providing a full range of industrial cybersecurity controls for visibility, threat detection, risk and vulnerability management, and secure remote access—all with a significantly reduced total cost of ownership.

To date, Claroty has deployed its solution in a range of verticals, including pharmaceuticals, food & beverage, automotive, chemicals, mining & materials, manufacturing, medical devices & life sciences, oil & gas, electric, water & waste.

Meanwhile, the Claroty Research Team continues to lead in investigating potential risks to industrial control systems (ICS). The team is known for its development of proprietary threat signatures, protocol analysis, and discovery and disclosure of ICS vulnerabilities. Equipped with the industry’s most extensive ICS testing lab, the team works closely with leading industrial automation vendors to evaluate the security of their products. To date, the team has discovered and disclosed more than 120 ICS vulnerabilities.

The post Claroty to bolster IoT security of industrial assets appeared first on FutureIoT.

Serious security vulnerabilities have been found in  Bluetooth Core and Mesh Profile Specifications, which allow hackers to impersonate legitimate devices and carry on Man-in-the-Middle(MITM) attacks.

Researchers from Agence nationale de la sécurité des systèmes d'information (ANSSI) disclosed several vulnerabilities in the two Bluetooth specifications used  for low-energy and Internet of Things (IoT) devices or and many-to-many (m:m) device communication for large-scale networks.

Both the Bluetooth Core and Mesh specifications define the technical and policy requirements for devices that want to operate over Bluetooth connections.

Depending on the vulnerability exploited, a successful attack could lead to impersonation attack, AuthValue disclosure or man-in-the-middle attack.

“Devices supporting the Bluetooth Core and Mesh Specifications are vulnerable to impersonation attacks and AuthValue disclosure that could allow an attacker to impersonate a legitimate device during pairing,” said an advisory from the Carnegie Mellon University CERT Coordination Center.

An attacker within wireless range of the vulnerable Bluetooth devices could use a specially crafted device to exploit the vulnerabilities.

According to the Carnegie Mellon CERT Coordination Center advisory, the Android Open-Source Project (AOSP), Cisco, Cradlepoint, Intel, Microchip Technology, and Red Hat are vendors affected by the security flaws.

A spokesman from Cradlepoint told FutureIoT: "Cradlepoint was notified of the BLE vulnerabilities prior to public disclosure. We have a production release of our NetCloud OS code available (NCOS version 7.21.40) that fixes the cited issues. As a result, we consider this security vulnerability remediated.”

Companies are advised to install the latest recommended updates from manufacturers into their Bluetooth devices..

Identified vulnerabilities

Researchers have discovered the following security flaws in the Bluetooth Core and Mesh specifications:

• Impersonation in the Passkey Entry Protocol: The Passkey Entry protocol used in Secure Simple Pairing (SSP), Secure Connections (SC), and LE Secure Connections (LESC) of the Bluetooth Core Specification is vulnerable to an impersonation attack that enables an active attacker to impersonate the initiating device without any previous knowledge (CVE-2020-26558).

An attacker acting as a man-in-the-middle (MITM) in the Passkey authentication procedure could use a crafted series of responses to determine each bit of the randomly generated Passkey selected by the pairing initiator in each round of the pairing procedure, and once identified, the attacker can use these Passkey bits during the same pairing session to successfully complete the authenticated pairing procedure with the responder. Devices supporting BR/EDR Secure Simple Pairing in Bluetooth Core Specifications 2.1 through 5.2, BR/EDR Secure Connections Pairing in Bluetooth Core Specifications 4.1 through 5.2 and LE Secure Connections Pairing in Bluetooth Core Specifications 4.2 through 5.2 are affected by this vulnerability.

• Impersonation in the Pin Pairing Protocol: The Bluetooth BR/EDR PIN Pairing procedure is vulnerable to an impersonation attack (CVE-2020-26555). An attacker could connect to a victim device by spoofing the Bluetooth Device Address (BD_ADDR) of the device, reflect the the encrypted nonce, and complete BR/EDR pin-code pairing with them without knowledge of the pin code.

A successful attack requires the attacking device to be within wireless range of a vulnerable device supporting BR/EDR Legacy Pairing that is Connectable and Bondable. Devices supporting the Bluetooth Core Specification versions 1.0B through 5.2 are affected by this vulnerability.

• Impersonation in Bluetooth Mesh Provisioning: The Mesh Provisioning procedure could allow an attacker without knowledge of the AuthValue, spoofing a device being provisioned, to use crafted responses to appear to possess the AuthValue and to be issued a valid NetKey and potentially an AppKey (CVE-2020-26560).

For this attack to be successful, an attacking device needs to be within wireless range of a Mesh Provisioner and either spoof the identity of a device being provisioned over the air or be directly provisioned onto a subnet controlled by the provisioner.

• Predictable AuthValue in Bluetooth Mesh Provisioning Leads to MITM:The Mesh Provisioning procedure could allow an attacker observing or taking part in the provisioning to brute force the AuthValue if it has a fixed value, or is selected predictably or with low entropy (CVE-2020-26557).

Identifying the AuthValue generally requires a brute-force search against the provisioning random and provisioning confirmation produced by the Provisioner. This brute-force search, for a randomly selected AuthValue, must complete before the provisioning procedure times out, which can require significant resources. If the AuthValue is not selected randomly with each new provisioning attempt, then the brute-force search can occur offline and if successful, would permit an attacker to identify the AuthValue and authenticate to both the Provisioner and provisioned devices, permitting a MITM attack on a future provisioning attempts with the same AuthValue.

• Malleable Commitment: The authentication protocol is vulnerable if the AuthValue can be identified during the provisioning procedure, even if the AuthValue is selected randomly (CVE-2020-26556). If an attacker can identify the AuthValue used before the provisioning procedure times out, it is possible to complete the provisioning operation and obtain a NetKey.

Similar to CVE-2020-26557, identifying the AuthValue generally requires a brute-force search against the provisioning random and provisioning confirmation produced by the Provisioner. This brute-force search for a randomly selected AuthValue, which can require significant resources, must complete before the provisioning procedure times out.

• AuthValue Leak:The Mesh Provisioning procedure could allow an attacker that was provisioned without access to the AuthValue to identify the AuthValue directly without brute-forcing its value (CVE-2020-26559).

Even when a randomly generated AuthValue with a full 128-bits of entropy is used, an attacker acquiring the Provisioner’s public key, provisioning confirmation value, and provisioning random value, and providing its public key for use in the provisioning procedure, will be able to compute the AuthValue directly.

The post Bluetooth flaws open devices to impersonation attacks appeared first on FutureIoT.

This is one of the major pieces of advice given by Frost & Sullivan in its latest analysis of the global critical infrastructure cybersecurity market. Segmented into oil and gas facilities, utilities (electric and water), maritime (ports and entry points), and airports, the research firm estimates the market will reach US$24.22 billion by 2030 from US$21.68 billion in 2020.

Despite the ever-increasing threat landscape and their incredibly high-risk profile, the Frost & Sullivan study pointed out that critical infrastructure organisations remain far behind where they should be in their cyber maturity and digital resilience strategies, necessitating a rapid push to fortify cyber defenses and manage their cyber-risk profiles.

"While oil and gas facilities will continue to remain, the largest segment investing in cybersecurity solutions, airports will prove to be the fastest-growing one, with a CAGR of 10.1%. Spending is expected to reach US$1.87 billion by 2030," said Danielle VanZandt, industry analyst for security at Frost & Sullivan.

"This is driven by the ongoing construction of new facilities, significant digitalization upgrades within existing airports, and the incremental updates being made to cybersecurity systems to keep up with the changing cyber-threat landscape and improve detection capabilities," she added.

Besides ensuring that their data traffic monitoring for OT systems are up to scratch, the Frost & Sullivan analysis said cybersecurity vendors should focus on the following in order to tap into a potentially lucrative market:

• Network topology solutions for vulnerability and risk assessment: Market participants seeking to provide network topology capabilities need to ensure that they can identify and discover the variety of information technology (IT), Internet of Things (IoT), and operational technology (OT) devices within an organization's network architecture to begin building the topological model.
• Continuous discovery for organisational assets: For security vendors, emphasizing continuous monitoring and automatic discovery tasks will help attract new customers and improve their market share.
• Predictive analytics and threat intelligence for incident detection: Cybersecurity solutions providers must emphasize automatic and predictive capabilities in their system tests and proofs of concept with customers to show how these systems will not overwhelm their existing security functions.
• Secure-by-design initiatives for operational technology assets and systems: Security operators that want to update older OT assets and devices should look at any components that are not engineered via secure-by-design manufacturing.

The post OT systems of CI a lucrative market for cybersecurity appeared first on FutureIoT.

"This strategic partnership allows Johnson Controls to offer our customers increased peace of mind by mitigating the risk of costly operational interruptions due to cybersecurity attacks while providing resilient, trusted smart building solutions that use the most advanced PKI technology from DigiCert, the clear leader in its field," said Mike Ellis, executive vice president and chief customer & digital officer at Johnson Controls. "Our domain expertise in healthy, secure and smart buildings, combined with DigiCert's trusted digital identity and automated certificate management capabilities, will further enhance our OpenBlue suite and offer a clear advantage for smart building operations."

Johnson Controls-DigiCert PKI solution elevates operations within the Operational Technology (OT) and Internet of Things (IoT) space to ensure that hardware, software and communication remains trusted throughout the lifecycle of the smart building. This approach brings modern PKI security as well as advanced expertise in managing digital certificates to provide device authentication and identity, data encryption and integrity for each component of the ecosystem.

"Johnson Controls is taking an important leadership stance in providing building owners confidence that their devices are safely and securely connected to the network using robust PKI solutions," said Mike Nelson, vice president of IoT security at DigiCert. "DigiCert ONE singularly offers container-based, cloud-native technology for fully automated certificate management with flexible deployment and secure and simple integration with the OpenBlue ecosystem. DigiCert ONE's IoT Device Manager provides complete IoT device lifecycle management that, together with OpenBlue, will ensure secure digital transformation of smart buildings."

DigiCert's vigilance in addressing the current and future landscape of digital identities and cryptography combined with Johnson Controls unmatched experience across all building systems will allow for OpenBlue to provide and maintain trusted smart building solutions within an ever-changing cybersecurity landscape.

Johnson Controls also recently announced its partnership with Pelion, to accelerate innovation in connectivity, security and intelligence at the edge for Johnson Controls OpenBlue technology. Pelion's device and edge management capabilities will be used with DigiCert services to ensure digital identities maintain the most stringent level of trust in OpenBlue solutions.

The post Johnson Controls, DigiCert raise security of smart buildings appeared first on FutureIoT.

Called FIDO Device Onboard (FDO) for IoT,  the new specification was collaboratively developed to solve the issue of IoT security in onboarding – just as the alliance has done with its FIDO authentication standards to help address the global data breach problem.

The FDO specification has reached Proposed Standard status and is open and free to implement. Initially, the specification is targeted at industrial and commercial applications.

“The FDO standard builds on our ongoing efforts to help close the security gaps that currently exist on the web, by expanding this work into IoT applications,” said Andrew Shikiar, executive director and CMO of the FIDO Alliance.

He pointed out that companies see the huge potential of the IoT and the enormous benefits it can bring to manufacturing, retail, healthcare, transportation, logistics and more.

“The paradigm needs to shift immediately so we can move IoT technologies ahead with safer, stronger and more secure means of authentication for these important uses in industrial and commercial environments,” Shikiar said.

Formed in 2012, the FDO Alliance addresses the lack of interoperability among strong authentication technologies, and remedy the problems users face with creating and remembering multiple usernames and passwords.

The FIDO Alliance has been introducing standards for simpler, stronger authentication that define an open, scalable, interoperable set of mechanisms that reduce reliance on passwords. FIDO Authentication is stronger, private, and easier to use when authenticating to online services.

To date, the alliance is composed of over has 250  of the world’s  most influential and innovative companies and government agencies,  working on cybersecurity to eliminate data breaches and  to secure online experiences.

Security a major barrier to IoT adoption

IDC expects the IoT market to maintain a double-digit annual growth rate and surpass the US$1 trillion mark in 2022.

Despite this projected growth, a recent survey has found a majority of businesses have serious concerns about breaches to their infrastructures. Of the 170 IoT leaders polled, the survey found that 85% say security concerns remain a major barrier to IoT adoption. Almost two-thirds (64%) of respondents stated that end-to-end IoT security is their top short-term priority, surpassing edge compute (55%), artificial intelligence (AI)/machine learning (50%) and 5G deployments (28%).

The new FDO standard is an automated onboarding protocol for IoT devices, leveraging asymmetric public key cryptography to provide the industrial IoT industry with a fast and secure way to onboard any device to any device management system.

“This is a major milestone that aims to solve one of today’s critical challenges with deploying IoT systems. The new FDO standard will help reduce cost, save time and improve security, all helping the IoT industry to expand rapidly,” said Christine Boles, vice president, Internet of Things Group and General Manager, Industrial Solutions Division at Intel. “Implementation of the FDO standard will enable businesses to truly take advantage of the full IoT opportunity by replacing the current manual onboarding process with an automated, highly secure industry solution.”

The business benefits from the FDO standard include:

• Simplicity – Businesses no longer have to pay more for the lengthy and highly technical installation process than they do for the devices themselves. The highly automated FDO process can be carried out by people of any level of experience quickly and efficiently.
• Flexibility – Businesses can decide which cloud platforms they want to onboard devices to at the point of installation (as opposed to manufacture). A single device SKU can be onboarded to any platform, thereby greatly simplifying the device supply chain.
• Security – FDO leverages an “untrusted installer” approach, which means the installer no longer needs – nor do they have access to – any sensitive infrastructure/access control information to add a device to a network.

Open-arm welcome

IoT industry stakeholders expressed optimism over the new FDO standard, which is expected to enable device makers to deploy, onboard and manage secure IoT devices faster at a lower cost.

“As the IoT rapidly expands, the security of devices cannot be optional, and a strong foundational root of trust is essential. It will help scale IoT across both industrial and consumer use cases,” said Mohamed Awad, vice president, IoT Business at Arm

Mohammad Zoualfaghari, research manager and IoT Architect at BT said: "FDO is a revolutionary standard, which can address a critical need for the IoT, Edge Compute and 5G industries and help them to scale up securely and fully automated, from the manufacturer to the consumer, from the device to edge, and from edge to the cloud."

Joe Pearson, technology strategist, IBM Cloud and Technical Steering Committee Chair, Open Horizon project, is looking forward to implementing FDO in their smart agriculture use cases and in the open retail reference architecture.

“The Open Horizon project wanted a simple solution to zero-touch provisioning that would have wide support from hardware manufacturers, maximum flexibility, and a staged approach. The FDO specification from the FIDO Alliance certainly meets those requirements,” said Pearson. “After implementing and shipping support in Open Horizon, we're pleased with the results and with the feedback we've received from those using it in the field.”

Jürgen Rebel, senior vice president and general manager Embedded Security at Infineon Technologies is pleased that the FDO protocol is built with security in mind.

“It enables FDO based systems to store the private key secrets and device credentials in a Trusted Platform Module. TPM is a widely accepted and used technology that creates trust in manufacturing and supply chain. It is a major contribution towards the acceleration of IoT device deployment,” Rebel said.

Sam George, VP of IoT, Microsoft Azure, echoed the same sentiment:  “Device onboarding through a standardised protocol like FDO simplifies device set-up by abstracting the underlying complexities of the hardware, which will accelerate the adoption of IoT in industry. We are thrilled to see the FIDO Alliance address such a critical piece of the IoT device lifecycle.”

The post New IoT standard automates and secures device onboarding appeared first on FutureIoT.