Security IoT and OT Security: Zero-Trust Security as the Key to Resilience

Related Vendors

Zscaler Germany GmbH

Wuxi InfiMotion Technology Co., Ltd.

In light of increasing attacks on IoT and OT devices and connected infrastructures, Zero Trust is coming into focus as a permanent approach to greater resilience.

The growing threat landscape for IoT and OT devices remains a central topic in the cybersecurity debate. With an alarming 45 percent increase in IoT malware, according to the Zscaler Threatlabz 2024 Mobile, IoT & OT Threat Report, alongside numerous successful attacks, it becomes clear that these devices continue to serve as a preferred entry point into corporate environments for cybercriminals. A single compromised IoT device can jeopardize an entire corporate network – a fact exacerbated by the lack of integrated security mechanisms in IoT hardware.

But the challenges extend beyond IoT: the increasing convergence of IT and OT infrastructures amplifies the risk. These systems still often rely on outdated devices and software and are associated with long lifecycles. More than 50 percent of OT devices run on obsolete operating systems that have reached the end of their lifecycle and typically contain known vulnerabilities. Furthermore, risky legacy protocols and services often account for more than 20 percent of internal East-West network connections. The inadequate ability to patch critical assets and the growing use of cloud services make OT environments an attractive target for threat actors.

Ransomware and Targeted Attacks on Critical Infrastructures

Ransomware remains one of the biggest threats to IoT and OT. The manufacturing sector, identified as particularly vulnerable for the second consecutive year, is a primary target for such attacks. The reliance of this industry on connected OT environments provides attackers with numerous entry points. Data centers are also increasingly coming into focus, as their classification as critical infrastructure in the UK, and potentially soon in Europe, creates new threat scenarios. The growing use of service provider infrastructures by companies heightens this risk: attacks on data centers can have far-reaching effects along the entire service chain and significantly impede productivity.

The manufacturing sector accounted for 36 percent of all observed IoT malware attacks for the second consecutive year. Over 75 percent of blocked IoT transactions were linked to the Mirai malware family. Meanwhile, around 50 percent of all malicious payloads originated from the Mirai and Gafgyt malware families. Other malware families active in this environment include Mozi (12.8%), "VPNfilter" (5.6%), and Agent (3.5%). Of all analyzed attacks, 2.7 percent targeted IoT and OT infrastructures in Germany, and 1.6 percent targeted those in Switzerland.

Not surprisingly, the manufacturing and transportation sectors are the primary focus of cybercriminals, with over 50 percent of their attacks targeting these two industries. Regarding the devices in focus, it is unsurprising that the majority of compromised IoT devices are routers. In other industries, the most vulnerable IoT devices are data collection terminals (79.8%), which are predominantly used in retail.

Nearly 75 percent of exploited Common Weakness Enumerations (CWEs) were related to command injection vulnerabilities, which allow attackers to execute unauthorized commands, often leading to the download and installation of so-called stager scripts or malicious binaries. Improper input validation ranks second with only 10.5 percent.

AI Is Used for Both Attack and Defense

Networks of critical infrastructure operators, such as in the manufacturing, healthcare, transportation, and energy sectors, have always been difficult to secure. Due to the many unprotected identities and OT/IoT endpoints, these industries remain a primary target for cyberattacks. This threat is not limited to initial compromises by threat actors but extends to their ability to move laterally through OT and connected IT networks before embedding ransomware and preparing malicious payloads.

AI tools will further transform management in IoT and OT security. AI will assist defenders in automating critical functions such as detecting IoT and OT assets in complex environments and enabling IoT/OT segmentation and control on a large scale. Moreover, AI can help align IoT/OT security policies more effectively with real-time risks. This will allow defenders to regain control over their IoT and OT environments and better prioritize their actions to achieve greater security.

The following tips are intended to provide security teams with suggestions for improving IoT and OT security:

• Discover, classify, and inventory all IoT and OT. A comprehensive understanding of the IoT and OT attack surface is required, encompassing the detection, classification, and inventorying of both managed and unmanaged or "shadow" devices. This enables defenders to better understand and counter IoT/OT threats while prioritizing remediation efforts.
• Collecting and monitoring network logs for user access, application, and system events. Network logs should be continuously monitored and analyzed for key indicators, especially given that threat actors like Volt Typhoon can have significant dwell time within enterprise systems.
• Phishing-resistant multi-factor authentication (MFA) must be enabled wherever possible. Default passwords should be changed, and administrative credentials must be protected.
• Critical vulnerabilities and internet-connected systems should be patched. Unpatched systems connected to the internet are the most vulnerable to threat actors. Automatic updates must be enabled, and IoT and OT assets should be patched quickly to minimize the risk of new vulnerabilities. AI-powered threat intelligence platforms can assist in prioritizing and effectively managing security patches.
• A Zero Trust device segmentation for IoT and OT helps restrict access. Segmentation from device to application, user to application, and application to application should be implemented, and access should be restricted through least privileged access controls to prevent lateral movements and minimize data exposure.
• Privileged remote access to OT systems may be allowed. However, given the convergence of OT systems with traditional IT networks and services, it is crucial to secure third-party access and remote access to OT systems. Security teams should utilize trusted, outbound-only connectivity that employs fully isolated RDP and SSH sessions between users and the OT system.
• Encrypted data traffic should be continuously and comprehensively inspected to prevent attackers from compromising systems.

The analysis of last year's threat landscape shows that the IT security of IoT and OT, data centers, and supply chains should not play a subordinate role. Companies must adopt integrated approaches that include both advanced technological concepts like Zero Trust and training for their employees. At the same time, it remains crucial for service providers to optimize their security measures and response times to meet the growing demands of increased connectivity between IT and OT. In a connected world, the ability to react quickly and effectively to threats is key to resilience.

*Deepen Desai is the CISO at Zscaler.