Challenges in IIoT

By

Ms. Kshama Shukla

AP, MME
Wireless Coexistence

• Wireless coexistence is the capability of multiple wireless devices and services in

the same geographical area to access the same RF spectrum band simultaneously
without causing harmful interference to each other.
• Wireless coexistence involves licensed, unlicensed, and tiered-access spectrum
scenarios.
• Examples of systems where coexistence is of interest include (but are not limited
to): Wi-Fi, Bluetooth, licensed and unlicensed cellular services, internet-of-things
(IoT), machine-to-machine (M2M) and medical device communications, and others.
Wireless Coexistence
• Wireless coexistence is a critical aspect of modern communication systems, ensuring that multiple
wireless devices or systems can operate in the same environment without interfering with each other.
• The escalating proliferation of wireless technologies, from Wi-Fi networks to Bluetooth devices and IoT
sensors, has exacerbated challenges related to spectrum crowding, interference, and signal
degradation. Spectrum crowding occurs due to the limited available frequency bands, leading to an
increased likelihood of interference between neighboring wireless devices.
• Interference, in turn, can result in signal degradation, compromising the reliability and quality of
wireless communication.
• To address these challenges, various techniques are employed, such as frequency hopping, adaptive
channel selection, and power control. Frequency hopping involves devices switching between different
frequencies within the spectrum to avoid interference, while adaptive channel selection dynamically
selects the least congested channel for communication.
• Power control adjusts transmission power levels to minimize interference while maintaining
communication reliability.
Latency
• Latency, the time delay between the initiation of a process and the response, is a
crucial factor in numerous applications, particularly those requiring real-time
interactions.
• In contexts such as gaming, video conferencing, and autonomous vehicles, low
latency is paramount for ensuring smooth and responsive user experiences.
• Several factors contribute to latency, including network congestion, processing
time, and distance.
• Network congestion, stemming from high traffic volumes, can result in delays as
data packets contend for limited bandwidth.
• Processing time, reflecting the duration required for data processing at the sender or
receiver, also adds to latency.
Latency
• Additionally, physical distance between communicating devices introduces latency
due to signal propagation delays.
• To mitigate latency, strategies such as edge computing, content delivery networks
(CDNs), and quality of service (QoS) optimization are employed.
• Edge computing involves moving processing closer to the data source to reduce
latency, while CDNs distribute content across geographically dispersed servers to
serve data from locations closer to users.
• QoS optimization prioritizes time-sensitive traffic and manages network resources
to minimize latency.
Interoperability

• The ability of different systems or devices to communicate and exchange data

seamlessly, is essential for enabling integration and collaboration across diverse
technologies.
• Achieving interoperability is particularly challenging due to the wide array of
technologies and protocols employed across different systems.
• Industry standards, established by organizations such as the IEEE and ISO, play a
crucial role in ensuring compatibility and interoperability.
• Additionally, communication protocols such as MQTT, REST, and OPC UA facilitate
interoperability by defining rules for data exchange and communication.
Interoperability

• However, challenges such as diverse technologies and variations in data formats

and structures can hinder seamless data exchange between systems.
• To overcome these challenges, strategies such as the adoption of standards,
middleware solutions, and API integration are employed.
• Embracing industry standards ensures compatibility, while middleware platforms
act as intermediaries for translating data between disparate systems.
• API integration enables different systems to communicate and exchange data in a
standardized manner, promoting interoperability.
Sensor Data Streaming

• Sensor data streaming involves the continuous flow of data from sensors to
processing units or applications for real-time analysis and decision-making.
• This capability is integral to various applications, including the Internet of Things
(IoT), environmental monitoring, healthcare, and industrial automation.
• IoT devices rely on sensor data streaming to collect and transmit data for monitoring
and control of physical environments.
• Environmental monitoring systems utilize sensor data streaming to monitor air
quality, water levels, temperature, and other environmental parameters.
• In healthcare, wearable sensors and medical devices stream patient data for remote
monitoring and diagnostics.
• Similarly, in industrial settings, sensors stream data for process optimization,
predictive maintenance, and quality control.
Sensor Data Streaming

• However, sensor data streaming presents challenges such as bandwidth

constraints, data volume, and real-time processing requirements.
• To address these challenges, technologies such as edge computing, stream
processing frameworks, and data compression and aggregation are employed.
• Edge computing reduces latency by processing sensor data closer to the source,
while stream processing frameworks enable real-time data processing and
analysis.
• Data compression and aggregation techniques optimize bandwidth usage and
storage requirements by reducing the size of sensor data streams.
Intrusion Detection and Prevention

• Intrusion detection and prevention are critical components of cybersecurity, aimed at

identifying and mitigating unauthorized or malicious activities within a system or network.
• Intrusion detection involves the detection of suspicious behavior or security breaches
through techniques such as signature-based detection, anomaly detection, and behavior
analysis.
• Once detected, intrusion prevention measures are employed to stop or mitigate security
breaches before they cause harm.
• These measures include firewalls, access control, encryption, and security patches and
updates.
• Continuous monitoring is essential for effective intrusion detection and prevention, with
systems continuously monitoring network traffic and system behavior for signs of suspicious
activity.
• Integration with intrusion detection/prevention systems and other security tools provides
comprehensive threat monitoring and response capabilities.
 What Is A Network Intrusion?

• An intrusion compromises a computer system

by breaking the security of such a system or
causing it to enter into an insecure state.
• A network intrusion is any unauthorized activity
on a digital network. Network intrusions often
involve stealing valuable network resources
and usually jeopardizes the security of networks
and their data.
• Networks and endpoints are susceptible to
intrusions from unintended sources named
threat actors. A threat actor can reside literally
anywhere in the world. All they need is access
to the internet, a motive, and a method or route
of attack, which is commonly referred to as
the threat vector.
Common types of network vulnerabilities
• Malware – Malware, or malicious software, is typically installed on a user’s machine
or a host server. Types of malware include trojans, viruses, and worms.
• Social engineering attacks – Social engineering attempts to fool users into giving up
personal information. These types of attacks include email phishing and
whaling, vishing, waterhole attacks, and tailgating.
• Outdated or unpatched software – Software applications that are left unpatched
which exposes systems running the application and potentially the entire network.
• Web Server Exploits – Smartphones, tablets, and other mobile devices can be used
as devices to pass malware and other attacks on to the corporate
network. Additionally, mobile malware may be used to steal useful data from the
mobile device.
• Data Storage Devices – Portable storage devices such as unencrypted USB or Flash
drives
What Is An Intrusion
Detection System (IDS)?

• An Intrusion Detection System or

IDS is defined as a computer
network security technology
originally built for detecting
vulnerability exploits against a
targeted application.
1. The IDS as the name implies is designed to detect network traffic patterns. The IDS is not placed directly in line with the
network traffic.
2. It is usually inserted in a tap or span port mirroring device to monitor and notify an administrator of alerts, without impacting
the data flow.
3. There are three common detection variants the IDS employs to monitor intrusions including signature-based, anomaly-based,
and reputation-based systems.
• Signature-Based Detection
• Heuristic/Behavior Or Anomaly-Based IDS
• Reputation-Based
What Are The Two Main
Types Of Intrusion Detection
Systems?

There are two main types of IDS including a network

intrusion detection system or NIDS, and a host-
based intrusion detection systems (HIDS).
Network-Based Intrusion Detection System (NIDS)
1. Since the IDS is not in line with the network traffic,
it can actually be placed strategically wherever the
tap or span devices are located.
2. This feature allows the IDS to monitor and report
on traffic flow in various areas of the network. This
type of intrusion protection is referred to as
a Network Intrusion Detection System or NIDS.
Host-Based Intrusion
Detection System (HIDS)

• Another type of Intrusion Detection System

is a software package that is installed on the
endpoint or host device.
• This type of system is referred to as a host
intrusion detection system (HIDS).
• Popular anti-virus vendors include HIDS as
part of their endpoint protection suite.
Instead of relying on mirrored traffic from a
TAP device, HIDS software will examine
events on a computer on your network.
• This type of intrusion detection system
mainly operates by looking at data in system
files on the computer that it protects. Those
files include log and configuration files
What Is An Intrusion
Prevention System (IPS)?

• An Intrusion Prevention System or IPS is

a network security and threat prevention
technology that examines network traffic
flows in order to detect and
prevent vulnerability exploits. The IPS often
sits directly behind the firewall.
• Unlike the IDS, the IPS is placed inline (in the
direct communication path between source
and destination), actively analyzing and
taking automated actions on all traffic flows
that enter the network
• Popular anti-virus vendors include HIDS as part of their endpoint protection suite. Instead of relying on mirrored traffic from a
TAP device, HIDS software will examine events on a computer on your network.

• This type of intrusion detection system mainly operates by looking at data in system files on the computer that it protects.
Those files include log and configuration files
Runtime Security Monitoring

• Runtime security monitoring involves real-time monitoring of system behavior to

detect and respond to security threats as they occur. Continuous monitoring of
network traffic, system logs, and user activities enables the timely detection of
suspicious behavior or deviations from normal patterns.
• Automated alerting and response mechanisms provide rapid responses to security
incidents, minimizing the impact of security breaches.
• Security information and event management (SIEM) systems, combined with
automated threat detection and response platforms, facilitate efficient runtime
security monitoring.
• By integrating with intrusion detection/prevention systems and other security tools,
runtime security monitoring provides comprehensive visibility and control over
system security.
What is runtime security and why is it so
important ?
• Runtime security is the ability to detect Indicators of Compromise (IOC) at runtime,
in an attempt to alert your incident response team as soon as possible, and deploy
countermeasures.
• In more concrete terms, this vague statement translates into multiple layers of
security that can be combined to reduce the probability of an attack slipping
through your fingers, regardless of all the security measures taken during the
development phase of your application, or the configuration of your infrastructure.
• For example, at the infrastructure layer, Network Intrusion Detection Systems (NIDS)
are often positioned at critical places in an infrastructure, to detect abnormal
network activity, or known malicious network signatures.
• At the host level, Host Intrusion Detection Systems (HIDS) are usually deployed to
detect abnormal process behaviors, or suspicious resource usage.
Contd..
• An HIDS with prevention capabilities would be classified as an Host Intrusion
Prevention System (HIPS).
• Add a backend to gather alerts and match the collected events against a threat
intelligence database, and the HIDS is now part of an Endpoint Detection and
Response (EDR) platform.
• Then if you go one layer deeper, at the application level, Web Application Firewalls
(WAF) are often deployed as a middleware before your web applications, in an
attempt to detect and block abnormal requests before they reach a service.
• And if you finally reach the code level instrumentation, you’ll find Runtime
Application Self-Protection (RASP) tools.
• The main difference between a WAF and a RASP is the ability of the instrumentation
to understand how the application will react to a specific attack signature.
IIoT Security
• Fundamental idea - IoT will connect all objects around us to
provide smooth communication
• Economic of scale in IoT presents new security challenges for
global devices in terms of
– Authentication
– Addressing
– Embedded Security
• Devices like RFID and sensor nodes have no access control
functionality
• Can freely obtain or exchange information from each other
• So authentication & authorization scheme must be established
between these devices to achieve the security goals for IoT
• Privacy of things and security of data is one of the key challenges
in the IoT
Vulnerabilities of IIoT
Vulnerabilities of IoT
• Unauthorized Access
– One of the main threats is the tampering
of resources by unauthorized access
– Identity-based verification should be done
before granting the access rights

• Information corruption
– Device credential must be protected from tampering
– Secure design of access rights, credential and
exchange is required to avoid corruption
Vulnerabilities of IoT

• Theft of Resources
– Access of shared resources over insecure
channel causes theft of resources
– Results into man-in-the-middle attack
• Information Disclosure
– Data is stored at different places in different forms
– Distributed data must be protected from disclosure
– Context-aware access control must be enforced
to regulate access to system resources
Vulnerabilities of IoT

• DoS Attack
– Denial of Service (DoS)
– Makes an attempt to prevent authentic user from
accessing services which they are eligible for
– For example, unauthorized user sends to
many requests to server
– That flood the network and deny other
authentic users from access to the network
Vulnerabilities of IoT

• DDoS Attack
– Distributed Denial of Service
– Type of DoS attack where multiple compromised
systems are used to target single system causing DoS
– Compromised systems – usually infected with Trojan
– Victims of a DDoS attack consist of both
• End targeted systems
• All systems maliciously used and controlled by the
hacker in the distributed attack
Vulnerabilities of IoT

• CyberBunker Launches “World’s Largest”

DDoS Attack
• Slows down the Entire Internet
• CyberBunker - Dutch web hosting company
• Caused global disruption of the web
• Slowing down internet speeds for millions
of users across the world, according to BBC
report
Safety, Security, and Privacy

• Safety, security, and privacy are paramount considerations in the design and
operation of modern systems, particularly in contexts involving sensitive data or
critical operations.
• Safety entails ensuring that systems operate without causing harm to users or the
environment.
• In autonomous vehicles, safety measures include collision avoidance systems and
fail-safe mechanisms to prevent accidents.
• Security focuses on protecting systems, data, and communications from
unauthorized access, breaches, and cyber threats.
• Measures such as encryption, access control, and intrusion detection/prevention
systems are employed to safeguard against security threats.
• Privacy involves protecting personal or sensitive information from unauthorized
access or disclosure.
Security Requirements
• Access Control
– Provides authorized access to network resources
– IoT is ad-hoc, and dynamic in nature
– Efficient & robust mechanism of secure access to
resources must be deployed with distributed nature

• Authentication
– Identity establishment b/w communicating devices
– Due to diversity of devices & end users, an attack
resistant and lightweight solution for authentication
Security Requirements

• Data Confidentiality
– Protecting data from unauthorized disclosure
– Secure, lightweight, and efficient key
exchange mechanism is required

• Availability
– Ensuring no denial of authorized access
to network resources
Security Requirements

• Trust Management
– Decision rules needs to be evolved for
trust management in IoT
• Secure Software Execution
– Secure, managed-code, runtime environment
designed to protect against different applications

• Secure Storage
– Involves confidentiality and integrity of
sensitive information stored in the system
Security Requirements

• Tamper Resistance
– Desire to maintain security requirements even
when device falls into hands of malicious parties
– Can be physically or logically probed
• Scalability
– IoT consist of various types of devices with
different capabilities from intelligent sensors
and actuators, to home appliances
– Communication (wire or wireless) & protocols
(Bluetooth, ZigBee, RFID, Wi-Fi, etc.)
Security Requirements

• Flexibility and Adaptability

– IoT will consist of mobile communication devices
– Can roam around freely from one type
of environment to others
– With different type of risks and security threats
– So users are likely to have different privacy
profile depending on environment
Challenges
• Long-lived components.
• IIoT devices have a significantly longer lifespan compared to consumer IoT
devices
• This increases the necessity to already consider application and
communication security during the development of such devices and, more
importantly, to update the software regularly once devices are deployed.
• This challenge does, however, not only refer to newly deployed devices; it
mainly concerns already deployed devices, which came with little or no
security mechanisms and with a cumbersome update mechanism, yet are
expected to be operated for decades.
• With increased connectivity in the IIoT, the risk of security breaches also
increases, especially when previously isolated legacy
components are likewise integrated into the network
Challenges

• Large number of devices.

• The IIoT consists of an increasing number of (mainly resource-
constraint) devices.
• These devices need to be deployed, configured, and managed
in evolving automation tasks.
• The sheer number of devices, especially compared to the
significantly smaller consumer deployments, thus imposes a
need for scalable, automatic approaches not only for operation
but also for the implementation and configuration of security
measures.
Challenges

• High connectivity.
• The major benefits of the IIoT are based on strong connectivity
between IT and OT, and even to the Internet, enabling more
efficient and flexible industrial productions.
• Given this paradigm, it is increasingly difficult to separate and
isolate devices according to their functionality and thus to restrict
unauthorized access.
• However, according to NIST, network segmentation is a practical
approach to protect Industrial Control Systems (ICSs) and thus
needs to be further pursued for the IIoT.
Challenges

• Critical processes.
• A crucial part of ICSs is safety- and mission-critical processes, which
do not tolerate outages and thus require high availability.
• Moreover, such processes highly depend on data integrity, since even
small deviations may pose a safety risk or harm product quality.
• Security measures, however, may conflict with these requirements, e.
g., when they increase the communication and process latency.
• Instead of trading security against low latency, adapted security
measures for safety- and mission-critical processes are needed.
Challenges

• Data confidentiality.
• With the IIoT, increasing amounts of data are collected, e. g.,
cloud services use process and meta information for control and
optimization.
• This data also includes customer data and business secrets,
which need to be protected from unauthorized access.
• The key challenge is thus to ensure confidentiality while also
providing access to authorized IIoT services for processing and
analysis.