Data Communication for the Industrial IoT

What is the IoT?  Is it really just a fancy word for the Internet?  Yes and no.  The Internet of Things is the promise of a world where billions of connected devices are connected to us and to each other, making decisions for us, coordinating among themselves, collecting and collating information, and generally relieving us of the mundane aspects of living in the physical world.

We’ve had the Internet for enough time now that it has become embedded in our lives.  My (adult) kids don’t remember a world without it.  The IoT is, at its most basic level, a continuation of that embedding.  Instant communication is taken for granted among people, and plenty of mature products provide it.  Is there anything really novel about devices participating in that communication alongside people?

In a word, yes.  Not novel in the sense that we need entirely new technologies to achieve this data communication among devices, but novel in the sense that a whole raft of new problems arise from it.  The IoT is going to remain nothing but a promise until those problems are solved (shameless plug here: I’m writing this from a backward-facing perspective.  We at Skkynet have solutions for the problems I will discuss in this series).

So what is the Industrial IoT (IIoT)?  Does it require a different way of thinking about IoT, relative to the “regular” IoT?  Not really, the IIoT just has greater consequences.  If somebody hacks your refrigerator, your food gets too hot or cold, or you become an unwitting source of spam email.  If somebody hacks your industrial process they could shut down an expensive line, damage equipment, injure people, or even put critical infrastructure out of service.  That said, the data communication, network security, privacy, speed, latency and accessibility issues surrounding the IoT are the same in the IIoT, just with more urgency.

On the other hand, is the IIoT simply the application of IoT technology to industrial applications?  Not really; rather, it is the application of IoT concepts to industrial applications.  This series of articles will examine some of these concepts related to communication for the Industrial IoT.  Even that is a very big topic, covering data acquisition, protocol gateways, cloud protocols, data storage, big data analysis, reliability, fault tolerance and security.  To keep things short we will narrow the conversation further to look at data acquisition, communication and security.

DoublePulsar – Worse Than WannaCry

In a world still reeling from the recent WannaCry attacks, who wants to hear about something even worse?  Nobody, really.  And yet, according to a recent article in the New York Times, A Cyberattack ‘the World Isn’t Ready For’, the worse may be yet to come—and we’d better be prepared.

Reporting on conversations with security expert Mr. Ben-Oni of IDT Corporation in Newark, NJ, the Times said that thousands of systems worldwide have been infected with a virus that was stolen from the NSA at the same time as the WannaCry virus.  The difference is that this second cyber weapon, DoublePulsar, can enter a system without being detected by any current anti-virus software. It then inserts diabolical tools into the very kernel of the operating system, leaving an open “back door” for the hacker to do whatever they want with the computer, such as tracking activities or stealing user credentials.

“The world is burning about WannaCry, but this is a nuclear bomb compared to WannaCry,” Ben-Oni said. “This is different. It’s a lot worse. It steals credentials. You can’t catch it, and it’s happening right under our noses.”

The concern is that DoublePulsar can remain hidden, providing a platform from which hackers can launch attacks at any time.  It may already be running on systems in hospitals, utility companies, power infrastructure, transportation networks, and more.  Ben-Oni had secured IDT’s system with three full sets of firewalls, antivirus software, and intrusion detection systems.  And still the company was successfully attacked, through the home modem of a contractor.

Closing the Door on DoublePulsar

Severity of the threat aside, this scenario points out once again the inherent weakness of relying on a VPN to secure an Industrial IoT system.  Had that contractor been connecting to a power plant, an oil pipeline, or a manufacturing plant over a VPN, it is likely that DoublePulsar could have installed itself throughout the system.  As we have explained in our white paper Access Your Data, Not Your Network, this is because a VPN expands the plant’s security perimeter to include any outside user who accesses it.

This threat of attack underscores the importance of the secure-by-design architecture that Skkynet’s software and services embody.  By keeping all firewalls closed, a cyber weapon like DoublePulsar cannot penetrate an industrial system, even if it should happen to infect a contractor or employee.  SkkyHub provides this kind of secure remote access to data from industrial systems, without using a VPN.

Growing IIoT Security Risks

As the Industrial Internet of Things (IIoT) grows, the security risks grow as well, according to a recent article by Jeff Dorsch in Semiconductor Engineering. According to his sources, the use of the IIoT is expanding both in the amount of new implementations, as well as how the data is being used. In addition to the traditional SCADA-like applications of machine-to-machine (M2M) connectivity, monitoring, and remote connectivity applications, it seems that more and more the IIoT is being used to power a data-driven approach to increasing production efficiency. Using big data tools and technologies, companies can employ better and more sophisticated analytics on industrial process data, thereby enhancing operational performance based on real-time data.

With the increase in use of the IIoT comes a corresponding increase in the potential for risk.  Looking at big picture, Robert Lee, CEO of Dragos, and a national cybersecurity fellow at New America commented, “There are two larger problems that have to be dealt with. First, there are not enough security experts. There are about 500 people in the United States with security expertise in industrial control systems. There are only about 1,000 worldwide. And second, most people don’t understand the threats that are out there because they never existed in the industrial space.”

Both of these problems are real, and need to be addressed.  And is often the case in issues of security, the human factor is closely intertwined with both. On the one hand, there is a crying need for security experts world wide, and on the other hand the man on the street, or in our case factory floor, control room, or corporate office, needs to quickly get up to speed on the unique security risks and challenges of providing data from live production systems over the Internet.

Addressing the Problems

As we see it, correctly addressing the second problem can help mitigate the first one.  When we understand deeply the nature of the Internet, as well as how the industrial space may be particularly vulnerable to security threats from it, then we are in a position to build security directly into control system design.  A secure-by-design approach provides a platform on which a secure IIoT system can run.

Like any well-designed tool, from electric cars to smart phones, the system should be easy to use.  When the platform on which a system runs is secure by design, it should not require someone with security expertise to run it.  The expertise is designed-in.  Of course, the human factor is always there.  Users will need to keep their guard up—properly handling passwords, restricting physical access, and adhering to company policies.  But they should also have confidence in knowing that security has been designed into system they are working on.

Thus, the most effective use of our world’s limited security manpower and resources is to focus them on understanding the unique security challenges of the IIoT, and then on designing industrial systems that address these challenges. This has been our approach at Skkynet, and we find it satisfying to be able to provide a secure IIoT platform that anyone can use.  We are confident that through this approach, as the IIoT continues to grow, the security risks will actually diminish for our users.

Secure by Design for IIoT

Securing the Industrial IoT is a big design challenge, but one that must be met. Although the original builders of industrial systems did not anticipate a need for Internet connectivity, companies now see the value of connecting to their plants, pipelines, and remote devices, often over the Internet. The looming question: How to maintain a high level of security for a mission-critical system while allowing remote access to the data?

As you can imagine the answer is not simple.  What’s called for is a totally new approach, one that is secure by design.  This blog entry, published on the ARC Advisory’s Industrial IoT/Industrie 4.0 Viewpoints blog, gives an overview of why standard industrial system architecture is not adequate to ensure the security of plant data on the Internet, and introduces the two main considerations that must go into creating a more secure design.

Don’t WannaCry on your Industrial IoT System

Pretty much anyone who has a computer or listens to the news has heard about the WannaCry virus that swept across the world a few days ago, installing itself on computers in businesses, hospitals, government agencies, and homes, encrypting hard drives and demanding ransom payments.  After scrambling to ensure that our operating systems are up-to-date and protected against this latest threat, the question soon comes up: How can we protect ourselves against similar threats in the future?

“How?” indeed.  That would seem difficult.  Our reliance on networked computers for business and personal use is fully entrenched, and business/personal PCs will remain vulnerable for the foreseeable future.  In the industrial arena, some may conclude this latest attack is yet another reason to hold off on their IoT strategy.  Or, at least: “You should use a VPN to keep it safe.”

And yet neither of these instincts is necessarily correct because (i) it is possible to build a secure Industrial IoT (“IIoT”) system, and (ii) VPN is not the way to do it.  Industrial control systems may use the same underlying operating systems as PCs but they are different in one critical aspect.  They exchange real-time control data, not files and emails.

How WannaCry Got In

WannaCry comes in two parts – an email “bomb” that exploits your anti-virus software and a “worm” that propagates throughout your network by exploiting configuration weaknesses and operating system bugs.  The special danger of WannaCry is that it can infect a computer through email even if you never open the email message.  Once WannaCry arrives through email, the worm takes over to attack the rest of the computers on your network.

The worm portion of the virus spreads itself by finding other machines on the network.  According to analysis of the code by Zammis Clark at Malwarebytes Labs, “After initializing the functionality used by the worm, two threads are created. The first thread scans hosts on the LAN. … The scanning thread tries to connect to port 445, and if so creates a new thread to try to exploit the system using MS17-010/EternalBlue.” (the bug that the virus exploits)

If there is no open port on the other computer, the virus cannot spread.  But the VPN is not much help here.  If anyone on the VPN is struck by the virus, then every machine on the LAN is exposed.  Suppose you have an IIoT system connecting a corporate office to a process control system over a VPN.  If the virus activates on any of the connected machines in the IT department, it can easily propagate itself to any of the connected machines on the industrial LAN.

How to Keep WannaCry Out

The tongue-in-cheek answer is “don’t use email”.  More seriously, industrial systems and IT systems should be separated from one another.  There is no need to read email from the industrial LAN.  Don’t install email software on your industrial computers, and don’t allow email traffic through your firewall.

But industrial systems still need to communicate their data.  How can you reach the data without exposing the industrial network?  The solution is spelled out in detail in the latest white paper from Cogent (a Skkynet company) titled: Access Your Data, Not Your Network. This paper explains why the traditional architecture of industrial systems is not suitable for secure Industrial IoT or Industrie 4.0 applications, and discusses the inherent risks of using a VPN.  But most important, it introduces the best approach for secure IIoT and Industrie 4.0, which is to provide access to industrial data without exposing the network at all.

Specifically, the Skkynet-provisioned devices and the DataHub can make outbound connections to SkkyHub without opening any firewall ports.  These connections are robust channels that support bidirectional, real-time communications for doing monitoring and supervisory control.  The WannaCry virus or anything similar cannot spread into this system because they can’t see anything to infect.  The devices on the network are completely invisible.  Skkynet’s approach provides access to the data only, not to the network.

5G Wireless Seems Optimal for Industrial IoT

A few weeks ago two hardware giants in the telecom and chip industries, Ericsson and Intel, launched a 5G Innovators Initiative, along with Honeywell, GE, and the University of California Berkeley.  5G wireless is the next standard after 4G that will convey much more data at much higher speeds, making it ideal for IIoT applications.  In fact, the 5G Innovators Initiative’s action plan states that “The first industry segment to be explored is Industrial Internet of Things (IIoT).”

Honeywell and GE, the primary industrial partners in this initiative, both recognize the value of 5G for industry.  “Industrial companies looking to optimize their assets and operations need connectivity from the edge to the cloud. … using the innovations emerging from 5G wireless will help them unlock efficiency, increase manageability and drive sustainability,” said Peter Marx, Vice President, Advanced Concepts, GE Digital.

“5G technology will be a key enabler as we continue to develop and deploy new connected solutions to improve worker productivity, safety and asset performance across our customers’ global supply chains,” said Suresh Venkatarayalu, Chief Technology Officer, Honeywell Safety and Productivity Solutions.  “It will help us bring to market new IoT solutions for aircraft, buildings, homes, industrial plants, logistics providers, manufacturers and retailers.”

Commenting on the value of 5G wireless for industrial applications, Bob Gill at ARC Advisory Group said last year, “The ramp-up in speed and performance that goes with the next evolution of the cellular story, 5G, brings with it increased relevance to the industrial flavor of IoT, i.e. IIoT, and some interesting potential applications. … More specific to Industrial IoT, 5G’s extremely low latency of one millisecond (versus about 25 ms for 4G) makes it viable for critical industrial applications involving control rather than just monitoring.”

This is the kind of performance that Skkynet users can appreciate. Already recognized by Nokia for its cutting-edge technology, Skkynet is well positioned to take full advantage of the high speed performance that 5G can provide.  The SkkyHub service adds only a few milliseconds to overall device-to-user data transmission via the cloud.  Running on a 5G network would mean real-world M2M response times of under 5 milliseconds for industrial applications.

“Remotely controlled operations are particularly applicable in industries like mining, construction, oil & gas, and power, where the operating environment may be hazardous and the sites distantly located, hard to reach, and inhospitable,” Gill continued. “For a remote worker to operate a machine in a mine, for example, as safely and efficiently as an on-site operator necessitates a level of sensory awareness of the surroundings, and this becomes possible with a fast, low latency 5G network transmitting live video and enabling real-time force feedback and haptic interaction.”

At Skkynet we are following the development of 5G wireless with interest, while we continue to build and enhance the necessary secure infrastructure to support Gill’s vision.  Even with just 3G or 4G, engineers and managers are able today to do supervisory control with live video in real time using DataHub and SkkyHub technology.  5G can only enhance the performance and user experience.