Undercutting the IT/OT Collaboration Delusion

Lately, I have seen two common themes whenever IoT security is brought up; 1) complete acceptance that IoTs pose unique security challenges, and 2) how they have an IT/OT collaboration process to address them. Everybody knows what IT is, but as a reminder, OT, or operationalized technologies, are network/Internet-connected technologies whose primary function is not IT related. Think network connected HVAC units, vending machines, elevator control systems, and the like.

I recently attended a Smart Building conference, and one of the stalwart technology companies was making a big deal about the addition of their fourth intelligent building. One of their talking points was how much they have learned from their last three smart building operations. With lessons learned, they continued, this fourth building incorporates an IT and OT collaboration process. This process is intended to ensure that their IoTs do not pose a risk to the organization.

Let’s get real. A people-driven process for cybersecurity has never, ever, ever worked– not even once. Perhaps a few got lucky, but last time I checked, luck is not a reliable component of security.

People-driven processes are what a lot of organizations fall back on when there are no meaningful legitimate security options and an issue is too center-stage to be brushed under the proverbial rug. People-driven processes work for business, not cybersecurity because an inevitable byproduct is exceptions. Managing exceptions in a business model is not only acceptable but a feature that can deliver good results. With cybersecurity, exceptions are a bug and can have a catastrophic impact. Why? Because exceptions add up quickly and require manual intervention. These exceptions can easily overwhelm teams and often wind up unaddressed.

IT/OT collaboration translated to practical terms means that OT needs to get approval from IT for whatever they need to purchase. This interaction results in one of three responses. “We can secure your IoTs right away!”, “We can secure your IoTs, but there’s a backlog and there will be some delay,” or “No, you can’t use this technology.”

Anything other than the first response will result in the user immediately focusing their attention on bypassing IT. So, the collaboration has now turned into a cat and mouse game where the user tries to circumvent IT, and IT tries to implement restrictive controls to prevent being bypassed.

Have we not learned our lesson from the use of Cloud and SaaS in business? The users beat IT and executive management so overwhelmingly that there was no option other than complete and utter surrender.

The learning lesson is, don’t turn your users against you because you will not win. Any delay in facilitating the requirements of OT will result in scorn from the user community. And to further exacerbate the issue, there are far more IoTs that tend to be unique.

So, what’s the answer? The right answer requires re-imagining how we secure. Our current model for security dates back to medieval times. How is the industry standard of securing networks any different than securing a castle with a moat and drawbridge? The right answer needs innovation — and not just innovative technology, but also a whole new innovative model for cybersecurity. This model must accomplish two major tasks:

The first major task is to Simplify Security:

Today’s security tools demand well over 90% of the security team’s attention. Simply put, eliminating security tools eliminates distractions. Buying and stringing together a bunch of different products to fulfill various security functions creates complexity and is overwhelming to any size organization. In fact, security tools should be so simple to use that even quasi-technology people could operate them with ease.

Moreover, what if you had one security across all those technology silos like offices, data centers, clouds, SaaS, mobile devices, and yes, even the IoTs. This single security non-tool will not be network sensitive. It should not matter which type of network technologies use. Eliminating complexity not only improves security but offers agility and cost savings.

Takeaway #1: Implement a common security platform that delivers uniform and consistent security across all technology silos in the form of a security utility.

The second major task is to achieve User Empowerment:

With security simplified, everyone is empowered to self-serve. This puts the power of security in the hands of users. Now users are contributing positively and in the best interest of the company rather than fighting to bypass the security edicts. User empowerment drives much more collaboration than the IT overlord model that has been dubbed “collaboration.”

Takeaway #2: Empower users to self-serve so they are aligned with the best interest of all rather than fighting IT in their own interest. 

Today, more so than innovative technologies, we need a sound, well-thought-out security model. After hundreds of years in practice, we need to retire the medieval model for cybersecurity– especially in areas that depend on people-driven processes. Aside from simply not working, people-driven cybersecurity actually increases workloads and has inherent gaps in the form of exceptions. How can this possibly contribute to better security? Ultimately, there are no well-known cybersecurity technologies or models that can claim to be simple or sustainable. Perhaps the cybersecurity industry just needs to dream bigger or stop playing it unreasonably safe — or both. I am announcing that Acreto is making a play for both simple and sustainable security that empowers people. The above rules are fundamental to the foundation of Acreto’s platform, which is intended to take on and overcome the challenges of generation IoT.

About Acreto:

Acreto is the first cloud-delivered, end-to-end connectivity and security platform that can connect and protect any technology, on any network, anywhere. Acreto SASE +Plus delivers Secure Access Service Edge (SASE) functionalities for access technologies such as devices, networks, IoT / OT and third-parties; while Acreto Secure Application and Data Interconnect (SADI) connects and protects application delivery infrastructure such as clouds, SaaS, data centers and co-locations. Acreto SASE +Plus is SASE plus SADI — one platform with one interface from one provider for all of your technologies around the world. Learn more at https://acreto.io or @acretoio.

IoT Security Use-case: Part 3 – Dependency Computing

Welcome to our IoT Security Use-Case series! Here’s how we’ve broken things down so far:

Part 1, The Challenge, highlights a use-case for a financial organization whose business strategy was based on replacing expensive bank branches with Automatic Teller Machines (ATM) and Interactive Teller Machines (ITM). They chose this as their growth strategy because branches are limited to specific locations, slow to roll out and expensive to outfit. On average, branches take months at time, sometimes close to a year to turn up. The IoT based ITMs can do 95% of what a customer needs including allowing them to interact with a human. All the while, the IoTs can be deployed in a matter of days or weeks.

Part 2, IoT Security Fundamentals, lays out the necessary functions required for securing purpose-built technologies. Especially when they need to operate on a number of distributed public or private networks. And purpose-built technologies don’t have the required resources to self-secure.

We’re now at Part 3, where we will outline why traditional security approaches just can’t secure an IoT platform of this type.

For Part 3, let’s start by breaking down the components of an IoT application Ecosystem before we get into IoT security. IoT Security is not limited to securing only the IoTs themselves. IoT platforms function in ecosystems that are made of not just IoTs, but one or more remote applications that are operated by one or more vendors.

For our ATM network scenario, the ecosystem includes a banking ledger application running in a colocation data center. A monitoring application running on Amazon AWS using a different set of instances in a dedicated VPC. A SaaS application providing 24×7 physical security surveillance service the bank has contracted. As well as an Authorization-as-a-Service provider the bank uses to process external transactions.

Then there are the Teller Machines. There are several types of Teller platforms that include traditional ATMs and two different Interactive Teller Machines (ITM) types. A unit with a smaller footprint and a larger unit with greater cash holding capacity. The ATM / ITM IoTs are distributed across many cities, placed in a variety of locations and location types from office buildings, stores, malls, courtyards and airports. The systems connect via a variety of Internet connection types that include LTE service, Internet WiFi service and Ethernet connections from the local facility.

In this scenario, using traditional security tools, each platform requires completely different types of security tools to perform the various security functions for the various platform types – cloud, SaaS and the different IoTs. This means that each cloud instance, each SaaS, and each IoT require a different type, batch and brand of security tools. And each different security infrastructure needs to provide access, application and content control, threat management, privacy and identity for each of applications banking and monitoring applications, another for each ATM and yet another for each ITM.

This could add up to over 24 different security tools – If the tools that provide the different functions defined above actually existed. In many cases, especially with IoTs, all of the necessary tools simply don’t exist or don’t exist consistently for the different platforms. Here is a breakdown of the security options actually available:

  • The ATMs did not have any onboard or commercial security options.
  • ITMs do have support for Access Control and Privacy but nothing else.
  • The Cloud Applications do support the full spectrum of security, but require multiple disparate technologies that have a very convoluted implementation and data flow.
  • The SaaS applications have no meaningful security options. In many instances organizations opt to use VPNs or use an encrypted connection but ultimately have to trust the SaaS provider for all other security functions.

This approach is considered perfectly reasonable today – and it is absolutely insane. The number of different technologies coupled with the complexity of acquiring, implementing, operating and refreshing each different tool is an expensive and resource intensive way of getting marginal security. All-the-while assuming and managing risk for some parts of the platform because the security functions required just don’t exist for all platforms. Furthermore, the ones that do exist are inconsistent in how they apply security.

This creates complexity. Significant complexity. And complexity is the enemy of security. The complexity of managing the many policies, technologies, products, vendor relationships and integrations between the various technologies creates insecurity and drives organizations to spend more time managing products than security. Hence spending more and more on security does not always render the desired results.

It’s fair to say that the more security tools that are implemented, the more complex the security will be. And it is complexity that creates gaps and makes you less secure.

However, there is another factor to consider as it relates to traditional security – even if an IoT or application is operating on a shared network that is protected by the latest and best security tools; and even if they are designed specifically for IoTs; the IoT platform will neuter them.

This is not a matter of better or different tools, the traditional security model is broken!

Dependency Computing: A New World of IoT Security Challenges

The security model is broken because how we compute has changed dramatically. IoTs use a compute model called dependency computing. With dependency computing, the IoT is dependent on the application and the application is dependent on the IoT.

Consider the impact of dependency computing on IoT security.

In a shared network, where multiple IoT brands exist (think smart thermostat, TVs, Fridge, smoke detector, etc.), each IoT brand has a dependency, and by virtue of that dependency, a connection to a different application that is 1) remote, 2) operates in the cloud, 3) is controlled and managed by a third-party, and 4) has privileged access to one or more IoTs that operate on your network.

IoT brand A is dependent on and connected to application A. IoT brand B is dependent on and connected to application B. IoT brand C is dependent on and connected to application C, and so on. It would not be unreasonable to foresee an organization using hundreds, if not thousands, of IoT brands in the next few years.

Each application that an IoT on one network is connected to is also connected to countless other IoTs on different networks. And that application has privileged access to all of these IoTs – often over the public Internet. To complicate matters further, many IoTs are also remotely managed, either directly or via their application via another set of devices.

This creates a platform triangle in which many distributed IoTs and the application or applications managed by remote devices are interconnected and dependent on each other. The risk and exposure of this model are numerous in the event of a compromised IoT, application or device. These include:

  • In a case of compromised applications, especially those accessible over the Internet.
  • The compromised application has privileged access to the IoTs and can use the existing privileged access to scan and capture communications on the network the IoT operates on.
  • The compromised application can also be used to fully compromise the IoTs on one or more customer networks, allowing the attacker further access and control.
  • With compromised IoTs on a network, the attackers can:
    • Denial-of-service other devices, systems, application or platforms;
    • Inject manipulated data that can be fed to various systems;
    • Compromise other systems on the network otherwise known as cross contamination.
  • Attackers can also gain access through compromised IoT management, especially mobile phones.

Denial-of-service, data manipulation or compromise of other systems – including other IoTs – could impact critical systems such as:

  • Medical devices such as infusors, ventilators, respirators, or monitors for various body functions.
  • Vehicle and transportation system functions such as the car mechanical sensors, engine and transmission functions, braking system, navigation, infotainment systems However, drones, aircraft and ships with many critical functions are also vulnerable.
  • Building systems such as HVAC, elevator controls, and life safety systems.
  • Financial systems like the credit card machines, ATMs and ITMs described here.
  • Critical infrastructure control systems such as electrical grid, dam controls, air traffic controls.
  • Supply chain and manufacturing platforms that incorporate aspects of the platform from raw resources to retail.


Social Apps Plugins and Integrations

Another dynamic in this equation is social media integration, including apps and plugins. Systems like Facebook, Spotify, Pandora, Google, LinkedIn, and Amazon should be recognized as spyware, albeit sanctioned spyware. IoT Social media integration, though it may apply to only a portion of IoTs used in organizations, can significantly convolute how they are secured.

As you may have already concluded, the IoT application platform ecosystem is a tangled web of interdependencies between distributed devices on many different networks, using remote applications that are operated and controlled by a third-party, both of which are managed by one or more users with a variety of further devices that can connect from anywhere.

The IoT dependency computing model has many, many parts owned and operated by multiple parties, each with no visibility or control over platform elements they don’t own. The network the IoT runs on may be owned and operated by one party, the IoT itself by another, the application(s) by yet another, all of which may be managed by a different third-party.

Any security implemented between the many interconnected parts of the IoT ecosystem ultimately has no teeth. The security of one party impacts the security of all other parties!

With today’s remote cloud and SaaS applications, along with the pandemic rate IoTs are infiltrating every use-case, the concept of fence and gate security for a bunch of devices on the same network is naive, soon to be negligent. It’s no longer about better tools, it’s about a better model!


About Acreto

Acreto is the first cloud-delivered, end-to-end connectivity and security platform that can connect and protect any technology, on any network, anywhere. Acreto SASE +Plus delivers Secure Access Service Edge (SASE) functionalities for access technologies such as devices, networks, IoT / OT and third-parties; while Acreto Secure Application and Data Interconnect (SADI) connects and protects application delivery infrastructure such as clouds, SaaS, data centers and co-locations. Acreto SASE +Plus is SASE plus SADI — one platform with one interface from one provider for all of your technologies around the world. Learn more at https://acreto.io or @acretoio.

IoT Security Use-case: Part 2 – IoT Security Fundamentals

In the previously posted An IoT Security Use-Case: Part 1 – The Challenge, we highlighted the IoT environment and the challenges associated with securing such a platform.  In this Part 2, we will outline the various security fundamentals necessary to properly and sustainably secure a distributed and mobile platform that is made of various disparate and vastly different technologies.  Moreover, many of these technologies that make up the platform lack the resources required for robust IoT security.

With traditional security models, each type of technology in the platform winds up with a different level of security.  This inconsistency in the application of security lessens security effectiveness more than any other factor. Uniform and consistent security across all distributed platform components is essential to effective IoT security.

To implement effective IoT security, let’s break down the functional components necessary for the entire platform. By the entire platform, we refer to all applications, clouds, IoT, vendors and associated relevant components. Today, protecting even a single component of an overall platform such as an application means piecing together a number of disparate functions and technologies for each and every individual platform component.  These include:

Control – The ability to trigger on some attribute with a defined action that will allow or deny the communication. Control falls into the following three sub-categories.

Access Control – Tools with the mechanism to allow specific sources to talk to specific destinations via specific communication channels.

Application Control – Mechanism to allow sources to talk to destination using specific application programs such as outlook, Oracle, Gmail and the like.

Content Control – Functionality that allows looking beyond the communication’s attributes like channels or programs to peek at the content. For example, looking for credit cards, social security numbers or any other type of content. Another example is identification and control of site categories such as Adult or Pharma.

Threat Management – This function scans all communications on an ongoing basis and determines if the communication is well or Mal-intended. Threat management comes in two forms – Signature Threat Management and Behavioral Threat Management.

Signature Threat Management – Compares communications to a data base of known exploits. If and when a communication pattern that matches known exploits the threat management system immediately mitigates the malicious communication.

Behavioral Threat Management – This function is focused on identifying unknown attacks and exploits by creating a sandbox environment that assesses the impact of the communication. By measuring the impact of the communication on the sandbox, the system determines the intent of the communication.

Privacy – Privacy is tightly bound to encryption. Encryption prevents content from being seen and recognized by anyone not authorized. Many often call encryption security – it is not! Encryption is privacy and does nothing to implement controls or manage threat.

Identity – Allows the validation of a specific or group of devices and users and is used in conjunction with the various control mechanisms.

The above functions are foundational to IoT security and must exist in in order to achieve a minimum standard of security. In today’s market, the above functions are not provided by any single tool nor are the many tools necessary protect the full spectrum of any distributed platform. Multiple tools must be combined to deliver on the security functions required.  Furthermore, the combined tools only protect one component of the platform such as individual cloud application. Second or third cloud applications, data center applications, offices, or distributed IoTs each require yet another set of multiple combined tool sets. Building one-off security for each platform technology means piecing together a number of different technologies, often from different vendors, to satisfy the various security functions for each.  On average anywhere between 6 to 12 different products are needed, especially when device redundancy is necessary to properly secure each platform component type.

Each of these products have to be evaluated, acquired, implemented, integrated, operationalized, managed, monitored, troubleshot, and refreshed every 3 – 5 years. Furthermore, each of these products require hard to come by and expensive expertise. Different types and levels of expertise are required for each of the installation process, ongoing management, and on-demand troubleshooting. This makes for a very expensive and burdensome process – that is if you can find adequate expertise at all!

Using traditional security models to try and implement effective IoT security – for highly distributed, diverse and resource challenged platforms – is a non-starter in every sense from security effectiveness, cost, and operations to sustainability.

Check out Part 3 – IoT Dependency Computing…


About Acreto

Acreto is the first cloud-delivered, end-to-end connectivity and security platform that can connect and protect any technology, on any network, anywhere. Acreto SASE +Plus delivers Secure Access Service Edge (SASE) functionalities for access technologies such as devices, networks, IoT / OT and third-parties; while Acreto Secure Application and Data Interconnect (SADI) connects and protects application delivery infrastructure such as clouds, SaaS, data centers and co-locations. Acreto SASE +Plus is SASE plus SADI — one platform with one interface from one provider for all of your technologies around the world. Learn more at https://acreto.io or @acretoio.

Interested in seeing Acreto SASE+Plus in action? Let’s start with some basic information.

    Interested in seeing Acreto SASE+Plus in action? Let’s start with some basic information.

      Interested in seeing Acreto SASE+Plus in action? Let’s start with some basic information.

        Interested in seeing Acreto SASE+Plus in action? Let’s start with some basic information.