A threat can be defined as the potential of an exploit for a given system. Threat actors refers to the adversaries who trigger or inflict the exploit. In the case of an industrial system, such as a wind turbine, a threat actor could be either natural or man-made.
In the IIoT context, threats impact both the information and physical domains. The privacy and integrity of machine data—both control and payload—have the potential to be exploited. Unauthorized access and manipulation of IoT platforms, software, and firmware are also potential threats. On the other hand, IoT devices and control systems are exposed to physical reliability, resilience, and safety threats. Control system transfer functions, state estimation filters, sensing, feedback loops, and so on can also be targeted by malicious players. For example, manipulating a sensor/actuator system can cause a control valve to transmit dangerous levels of chemicals that may damage the immediate environment or interdependent system.
There is no silver bullet for industrial security, even though some brands lay claim to it. The adoption of digital technologies expose new types of attack vectors, and newer attack surfaces. A practical approach for IIoT security is to adopt a defense in depth strategy for security, wherein each defense mechanism makes it so much more formidable for the attacker.
Defense in depth (also known as the Castle Approach) is a concept found in IA, where multiple layers of security controls (defense) are placed throughout the architecture to be protected. Its intent is to provide redundancy in the event if any one security control fails or a vulnerability is exploited, the system will still be protected. These defenses can cover aspects of personnel, procedural, technical, and physical security for the duration of the system's life cycle. For any specific use case, system architects need to consider how the data flows and how to secure the data flow. Determining which data is important and needs protection within a given context is also vital.
Threat actors, in the case of IIoT systems, include:
- Cyberattackers: The sophistication of attacks is growing worldwide and monetary gains associated with the dark web are also on the rise. Even if no monetary gains are involved, a cyberattacker may spy, spoof, inject malicious malware, or launch a DDoS attack.
- Bot-network operators: These actors launch coordinated attacks to distribute phishing schemes, spam, malware leading to DDoS, or ransomware attacks.
- Criminal and terrorist groups: Nation state actors, international corporate spies, and organized crime organizations also pose a threat and could take control of processes, identity, and so on, and are often motivated by geopolitical interests.
- Insiders: Exploits from insiders can be both intentional and unintentional. While disgruntled insiders can be threat actors causing serious damage, Wi-Fi/Ethernet/USB ports/BYOD can unintentionally result in a malicious event. In fact, unintentional human errors contribute to a high percentage of incidents in enterprises.
Other threat actors include phishers, spammers, malware/spyware authors, industrial spies, and so on.
