Integrating industrial internet of things (IIoT) technology into industrial settings is the logical next step for facility managers. It improves safety, enhances efficiency and increases productivity, resolving long-standing pain points like power, memory, wear and processing issues. However, it introduces numerous novel risks in critical environments.

1. Security Gaps Created by IT/OT Convergence

As with standard internet of things technologies, everything from building access systems to equipment monitoring sensors expands an industrial plant’s attack surface. The main difference is IIoT integration often requires infrastructure convergence, adding to information technology (IT) teams’ workloads while reducing visibility.

According to the 2024 State of Operational Technology and Cybersecurity Report, just 5% of plant operations professionals have 100% visibility into the operational technology (OT) activities occurring within central cybersecurity operations. These gaps leave room for intrusions, which require costly remediation.

How can information security (infosec) professionals deal with these blind spots? The best way to handle security issues related to IT/OT convergence is to improve monitoring via automation. Managing two newly integrated environments will be challenging for cybersecurity and IT teams, making automated monitoring and logging tools crucial.

2. Weaknesses Introduced by Off-the-Shelf Devices

When manufacturers use prebuilt infrastructure from a vendor, they may increase their chances of experiencing a cyberattack. Out-of-the-box IIoT devices have zero-day vulnerabilities attackers are waiting to exploit. Moreover, the cybersecurity team’s unfamiliarity with the new tools may cause infiltration to go unnoticed in the early stages of deployment.

Despite these risks, off-the-shelf IIoT solutions remain popular because they are more cost-effective and streamline integration, minimizing downtime. Companies that insist on using them must prioritize on-time updates, change default passwords and turn off unnecessary features like remote access. 

The ISASecure certification program asserts that commercial off-the-shelf (COTS) components should be manufactured to a minimum of security level 2 (SL2) as defined in the ISA/IEC 62443 series of standards. ISASecure published a white paper on the subject in 2024.

3. Vulnerable IIoT-Generated Data Transmissions

A joint report from the Ponemon Institute and IBM revealed a single data breach cost about 4.88 million USD on average in 2024, demonstrating the necessity of maintaining a good security posture. Healthcare, financial services, industrial, technology and energy organizations are particularly at risk, as these industries experience the highest costs per incident.

Securing IIoT-generated data in transit is vital. As it moves from edge devices to data storage systems or user dashboards, it becomes vulnerable to man-in-the-middle attacks like eavesdropping. Encryption is the only modern solution that can almost entirely mitigate the consequences of a successful breach.

Professionals shouldn’t trust just any encryption algorithm. When protecting highly sensitive information, only the most robust solutions will do. Moreover, they must consider their facility’s vendors. Will those who need shared insights receive a decryption key, or will homomorphic encryption be necessary? Data storage capacity should play a role in the decision.

4. Potential Physical Security Weaknesses

Manufacturers should also note physical security’s role in cybersecurity. Device ports can be tampered with in person to inject malware. Alternatively, someone can replace a node with their own or outright steal one. Either way, the result is likely a loss of business-critical data.

Securing the factory floor against malicious insiders is crucial. However, as of 2024, just 21% of organizations have fully implemented internal programs to deal with these threats. Decision-makers should consider them a higher priority. Even if they are not concerned with bad actors, human error is prevalent in this field.

5. Lateral Movement Enabled by Interconnection

Research shows an automated microsegmentation — a machine-learning-based solution — can prevent bad actors from moving laterally through the network. The model generates microsegments, confining IIoT traffic and blocking malicious traffic. Dividing the facility into small, isolated subnetworks secures critical systems.

6. Missing Out-of-the-Box Authentication Controls

McKinsey & Company predicts IIoT will be a 500 billion USD market in 2025 because of technological advances. Sensor prices have fallen to 50 cents per unit, fifth-generation cellular network technology supports data rates of up to 20 gigabytes (GB) per second and 1 GB of data can be stored for as low as 2 cents.

Despite these advancements, IIoT devices often still ship with weak authentication controls out of the box. While regulators are cracking down on original equipment manufacturers, the responsibility for security ultimately falls to the cybersecurity and IT teams. They must implement multifactor authentication, biometrics, adaptive authentication or token systems.

Securely Configuring IIoT Devices for Industrial Settings

In industrial settings, IIoT devices infected with malware could cause an articulated arm to swing wildly, striking a worker. Alternatively, they could trigger unplanned, plant-wide downtime. Cybersecurity and IT professionals must carefully consider the risks of inadequate security to understand the importance of securely configuring an interconnected system.