Investment PrioritiesInvestment Priorities

This study is a deep dive into investment spend and priorities for approximately 400 IT leaders.

Related Tags
What’s the biggest threat to the industrial internet of things (IIoT) space?

Top Answer: A native industrial cyber attack has truly yet to happen. Most of the cyber attacks that have touched industrial environments have been IT-level attacks, like ransomware, or breaking in through enterprise remote access protocols. But for example, the world has yet to see a legitimate massive DNP3 attack, which is an industrial protocol, or a Modbus/TCP denial-of-service attack. When that starts to happen, it will be a game changer, because most security initiatives and products focus on protecting the IT side. The thinking is that those attack vectors are the only ones that will be relevant to the industrial side, but that is an incorrect way of looking at this space. That's an outside-in approach. If you look at it from the inside out, you’ll see that there are so many different attack surfaces on the inside of these networks, which is why native-level protection is important.  The challenge is that native-level protection is difficult. It requires an in-depth understanding of the network, protocols, devices and the settings of those devices. If you consider Stuxnet, the fanciest part of that attack, from the ICS perspective, was a settings change on the centrifuge controllers. That change took the target out of its normal range of operation in terms of a numerical value. There was nothing on the network that could prevent that numerical value from surpassing an acceptable threshold. And that led to physical damage.

Related Tags
Was the need for security in the industrial internet of things (IIoT) underestimated?

Top Answer: Early on in the IIoT space, none of the technologies underlying those devices had changed in 30 years. But the business opportunity turned out to be far more challenging than anybody foresaw at the outset. Back then I would deal with SCADA operators who would tell me, "I've been sitting here for 30 years clicking this button. I know that when I click this button, this happens over there, and that's all I care about. We don't get attacked. I don't care about security. Leave me alone." So how do you sell security to somebody with that mindset? It was challenging, but everything's changing. I see our federal government's involvement in critical infrastructure protection and cybersecurity reporting, which is wonderful. That forces people to do something as opposed to hiding behind the belief that if something isn’t broken, you shouldn’t touch it.

Related Tags
What are the key differences between securing industrial internet of things (IIoT) devices and other IoT?

Top Answer: When I joined Bayshore Networks, I was one of the founders on the tech side. At the time, the entire industrial internet of things (IIoT) space was in its infancy, but the underlying technologies had already been around for 30 years. That's a critical consideration because there was a lot of learning to be done there, especially from a communications protocol perspective. We had to decipher these protocols that were designed for serial communications, not ethernet-based network communications. We were able to create this protocol-agnostic product that performs native protection for those devices at the protocol level. That was critical, because most products operated at the most generic level possible in order to sell to a larger population. But we wanted to solve a real problem. It meant a lot to us because something like a traffic light system is so important to protect. There's human life depending on that system. The engineering team believed that what we were doing was important to society.  The industrial control system (ICS) devices that we dealt with are radically different from some of the consumer IoT devices that have come out, particularly in terms of their hardware resources, the communication protocols, and their actual protectability. With old PLCs, you can't even add security code to them because they don't have enough power to run it. When we were doing regular security scanning on a network of industrial devices from 20 years ago, we would end up knocking them off the network. That's how fragile those things are and they run our critical infrastructure, which is disturbing. When we started getting involved in the commercial IoT space, we were dealing with familiar enterprise protocols, like CTP, FTP and STP. When you look at an old PoC and a new IoT device, they almost look like resources from the outside that are constrained on the same level. But they're not because hardware's come so far in terms of what's put into these devices. With older devices, it’s the same form factor, but what can you do with only 64K of memory? So protecting IIoT versus IoT requires different angles. Protecting PLCs for which you can't inject anything requires a network-centric approach. You want to catch bad actions at the protocol level. But for some of these new IoT devices, you want to do security at the host level because they have the ability to run that type of code. That doesn’t mean you wouldn't do network protection for them as well, but you have different options.

Is a native-level attack an immediate threat to industrial internet of things (IIoT) devices?

Top Answer: A native-level attack in the immediate future is very plausible. Considering some of the APT modes of operation that I've encountered, the bad actors that would launch an attack like that have already infiltrated their target. They just haven't had the right motivation to kick things off. And that's disturbing. For instance, if you look at the Mirai botnet, the attackers owned thousands of devices and just had them sitting idle until they decided to turn it on. The breached devices went about their normal day-to-day operations until someone upset the owner, or customer, of the botnet. And all of a sudden, the internet as we know it got impacted on a mass scale. The heat maps of Mirai’s impact show how powerful it was. Imagine a native attack on that level happening to our critical infrastructure. That's never happened before, but no one can tell me that the code is not out there. We were able to write some of that offensive code as a Proof of Concept (PoC) when I was at Bayshore Networks, so I know bad actors are able to do the same. 10 years ago, the argument was that nefarious actors don't understand the ICS protocols, therefore they don't think that way. But it’s a mistake to think they haven't learned in 10 years. I'm convinced they have and that's why I'm concerned about the IoT space.

Related Tags
If you are a current SAP customer, when do you plan to migrate to SAP S/4HANA?

Top Answer: No plan to migrate soon.

Related Tags
People & Leadership
Strategy & Architecture
End-User Services & Collaboration
Applications & Platforms
Governance, Risk & Compliance
Data & Analytics
Business Intelligence
Disruptive & Emerging Technologies
Team & Organizational Design
Security Strategy & Roadmap
IT Strategy & Roadmap
Outsourcing & Managed Services
Backup & Disaster Recovery
Public Cloud
Hybrid Cloud
Contact Center & Telecom
Data Center
Device Management
End-User Devices
Productivity Tools
Collaboration Solutions
Document Management
Business Applications
Human Resources (HRIS)
Technical Product Management
Software Development
Quality Assurance
Continuous Integration/Continuous Deployment (CI/CD)
Enterprise & IT Service Management (ITSM)
Availability & Capacity Management
KPIs, Metrics & Reporting
Financial Management
Vendor Management
Service Desk
Management Tools
Risk Management
Data Privacy
Artificial Intelligence & Machine Learning (AI/ML)
Data Warehouse
Security & GRC
Identity & Access Management (IAM)
Peer Insights
Vendor/Product Recommendation
Business Continuity & Disaster Recovery
Crisis Management
Customer Engagement
Customer Relationship Management (CRM)
Enterprise Resource Planning (ERP)
Business Relationships
Talent Management & Performance
Portfolio, Program & Project Management
Data Management
Big Data
Vendor/Product Assessment
Process Management
Asset & Configuration Management
Operations Management
Mobile Development
How will security practices for internet of things (IoT) devices evolve?

Top Answer: When we start to get native, protocol-level attacks on industrial internet of things (IIoT) and IoT devices, it will be interesting to see how the players in this space will react. They're going to realize that their products cannot stop those attacks. Even if you have a traditional next generation firewall (NGFW), for instance, someone could create a denial-of-service attack using native, valid, DNP3 functions. I wrote a lot of the offensive code when we were designing security for the products at Bayshore Networks, so I know that can happen. Those NGFWs would see this DNP3 traffic and just let it through. While there are architectural dynamics involved, and it's not a black and white situation, native protection of these environments is going to be critical.

Related Tags
IoT ImplementationIoT Implementation

This report focuses on IoT implementation and the challenges that IT leaders have faced.

Related Tags
If you had a magic wand - what's the #1 daily business challenge you'd eliminate?

Top Answer: Without a doubt - Technical Debt! It's a ball and chain that creates an ever increasing drag on any organization, stifles innovation, and prevents transformation.

Will the future of IoT impact business relationships?

Top Answer: The immediate reaction to this question is "yes, of course", but, I think when we step back a bit, this question is constantly asked and there are many solution vendors out there who are putting their minds together to come up with a solution that hopefully will align the impact/risk of IoT with the business requirements, thus smoothing out the relationships.  I also think company policies around IoT is just as important, not relying solely on technology to resolve people/process problems/deficiencies.

Related Tags
Where should you start when building a digital business platform?

Top Answer: Talking with the Product Owner, reading thoroughly the product backlog & defining the product priorities to begin creating the architecture as well as the infrastructure needed for this digital business platform.

Related Tags
Disruptive TechnologyDisruptive Technology

This report dives into how 450 IT Executives are thinking about disruptive technologies like AI, ML and IoT.