1. Industrial Internet of Things (IoT)
Cybersecurity strategies transforming the industrial landscape 1

2. 2

3. Table of contents IoT market 4 IoT framework 5 IoT definition 8
IoT drivers 9
IoT vulnerabilities 10
IoT cybersecurity strategies 12
Contact us 14 3

4. IoT market
It is said that the Internet of Things (IoT) is a game changer, on par with the advent of the internet. Whether or not the comparison is valid, only time will tell.
It is safe to say that IoT is a paradigm shift in how we look at devices, network communications and the value of data. The focus on IoT technology is the focus on data and access to that data. In networks today, data is typically stored locally and shared upon
request. IoT will allow virtual access to data enabling data analysis and analytics where for the first time the real benefits of data collection can be derived. With these new IoT devices and open access to data will come cybersecurity challenges that will also need to be addressed.
The functionality of the IoT device or “Things” will depend ultimately upon use or market segment. Consumer IoT devices such as Google Glasses, smart thermostats and smart refrigerators will differ greatly from Industrial IoT devices such as sensors, monitors and measuring devices. What may be surprising is that industry will be the top adopter of IoT technology1, given that the Consumer IoT market is made up in part by smart phones and smart tablets. The Industrial IoT market will also be global with every region expanding across industry segments. A recent survey of global market growth predictions from through 2021 found the following2:
North American IoT market will increase to $599b
with a CAGR of 13.1%
European IoT market will be the highest with $629b with a CAGR of 11.9%
APAC IoT market CAGR will be 14.4% with smart factory deployments in China and India leading the way
When comparing Consumer to Industrial IoT adoption rate, another survey looked at revenue across IoT segments and found3 that the Industrial
IoT market is over twice as large today, and is expected to grow over four times by 2021.
2021
2017
$480b
$150b
Consumer Industrial IoT revenue IoT revenue
$275b
$100b
Regardless of market segment (Consumer or Industrial), there is little doubt that IoT is here to stay.
1 Growth of IoT, BI Intelligence, July 18, 2016.
2 Industrial Internet of Things (IoT), Research and Market, March 9, 2017.
3 IoT Market Analysis by Component and Segment, Grand View Research, April 2016. 4

5. IoT framework Consumer IoT Industrial IoT 5
As mentioned, the IoT market is made of two major sectors, the Consumer and the Industrial. It is important to understand the differences between Consumer IoT and Industrial IoT as well as what makes up IoT and how it is defined. The table below outlines the numerous differences.
Consumer IoT
Industrial IoT
What
Revolution
“Things”
Ad hoc connectivity
Important – not critical
User defined
Evolution
Data
Structured connectivity
Mission critical
System defined
Today
Consumer-driven
IP-centric
Processor driven
Multi-purpose
Robust; high bandwidths, larger processing, and memory
Moderate focus on cybersecurity
Industry driven
Proprietary protocols
Embedded
Specific use: PLC, SCADA
Non-robust; Low bandwidths, limited processing, and memory – limits scans
Low focus on cybersecurity
Role
Everyday consumer-level devices connected to one another and made smarter and slightly
self-aware. Smart products (refrigerators, phones, apps)
Equipment and systems in industries and businesses where failures can be disastrous. Smart devices (robotics, meters, IP)
Attributes
Market opportunity: greenfield
Life cycle: whims, style, market
Integration: vertical
Availability: 2-3 9’s
Internet access: Persistent
Response to failure: retry, replace
Physical connectivity: broadband, wireless
Market opportunity: brownfield
Life cycle: to obsolesces
Integration: APIs
Availability: 4-5 9’s
Internet access: Independent
Response to failure: fail in place
Physical connectivity: legacy, purpose built
Key differences between Consumer and Industrial IoT will be driven by end user application and the environment of that application. Just like the differences between the IT environment and the OT environment, the Consumer IoT market will be more dynamic and quicker to adopt to products, whereas the Industrial IoT market will look for more reliability, security and longevity in IoT devices. 5

6. IoT framework OT environment: technology enablers ICS BMS IoT 6
EY has developed a framework to help better understand IoT. To start, we must first look at the environment for the application. There are two key environments — the Corporate IT
and Operational OT. Both OT and IT are environments. The OT environment is defined by its application in industries such as oil and gas, power and utilities, building management systems (BMS) and high tech manufacturing. The devices that make up the industrial control system (ICS) solution define the technology. When we look at IoT as a technology for industry then IoT is a technology enabler for the OT environment just as ICS and BMS are today. The framework would start here with the technology enablers.
OT environment: technology enablers
ICS
BMS
IoT
Industrial control systems (ICS) provide process controls
Building management systems (BMS) provide smart building communications
Internet of Things (IoT) robust data communications
Definition of ICS
Control systems and instrumentation used in industrial production, including supervisory control and data acquisition (SCADA) systems, distributed control systems (DCS), and other smaller control system configurations such as programmable logic controllers (PLC) often found in the industrial sectors, manufacturing and critical infrastructures and often using vendor specific proprietary protocols.
Definition of BMS
Process control systems installed in buildings that control and monitor the building’s mechanical and electrical equipment such as ventilation, lighting, power systems, fire systems, security systems and HVAC. BMS consists of software
and hardware; the software program, usually configured in a hierarchical manner, can be proprietary using vendor-specific protocols.
Definition of IoT
The internetworking of physical devices, buildings, vehicles and other smart devices that are embedded with electronics, software, sensors, controls and network connectivity allowing
these objects to collect and exchange data and providing advanced connectivity of devices, systems and services taking M2M communication to the next level — machine learning.
Operational technology (OT) is an environment made up of specific hardware and software that measures, monitors and manages control of physical devices, processes and events within a system. These OT systems commonly employ technologies such as ICS, BMS and IoT to provide process controls and safety.
Typical OT environments today are based on either ICS technology (industry and manufacturing) or BMS (commercial properties). We can now add IoT to the OT environment enablers. Unlike ICS or BMS, IoT technology can be deployed horizontally across industrial segments. IoT applications can be found at oil refineries, pharma manufacturers, and smart buildings today. But to be able to cut across any industrial segment implies that there is more to it than just deploying an Industrial IoT device. 6

7. IoT framework Things Connectivity Infrastructure 7
When most people hear IoT, they typically think device. However, that is only partially true. Look at mobile cellular communications. Most people view mobile technology as the phone or the device while being completely unaware of the wireless infrastructure, base
stations, switching and radio towers that are required to complete a call. Industrial IoT is no different. We look at the IoT framework as being built on three pillars: things (devices), the connectivity (networks) and the infrastructure (cloud). This chart defines and outlines how the three pillars need to work seamlessly together for deployment of IoT technology into an industrial network.
IoT framework
Things
Connectivity
Infrastructure
Things are the smart devices, products or sensors
Connectivity provides communication for the Things
Infrastructure enables people and businesses to connect to processes and systems, data, and the cloud
Definition of a thing
Any device enabled with an internet protocol that can exchange and communicate data
Definition of connectivity
Any interconnection that provides communication with the internet
Definition of infrastructure
Digital infrastructure or endpoints where data is used, processed or stored
Data origination
Data interconnect
Data endpoint
For any successful industrial deployment of IoT it is important to understand how the IoT device works but also how it will communicate across the network and how ultimately it will gain access to the cloud. Each of these transition points and their associated security challenges must be understood to secure IoT rollout. 7

8. .The Industrial Internet of Things (IoT) is:
IoT definition
With an EY IoT framework concept in place, it is worth tying the concept to a definition, the foundation of which is based on the interaction of the device collected data and the network response. The definition below is partially based on Gartner, Inc. from their glossary.
.The Industrial Internet of Things (IoT) is:
The network of industrial physical objects that contain embedded technology to communicate and sense or interact with their internal states or communicate to the external environment. Performing interactions between the requesting entity and the device that provides the service. These IoT systems enable interactive process through cloud-based resources.
It is important to note the distinction between what is and what isn’t an IoT device.
For example, a Wi-Fi-enabled thermostat that is accessible from a mobile device or computer that provides easy accessibility is not a true IoT device. Consider a Wi-Fi-enabled thermostat that gets feedback from data tied to local weather forecast as well as motion detectors to sense occupancy to adjust the thermostat automatically. This is a better example of a true IoT device. 8

9. IoT drivers 9 1 2 3 Expanding Lower Increasing productivity
So why the rapid adoption of IoT by industry? There are typically three answers cited consistently for the adoption of IoT:
1 2 3
Lower
Increasing productivity
Expanding
to new markets
utilization of IoT data to augment existing offerings or create new services and solutions
operating cost
cheaper IoT device technology
use of data analytics to improve yields, output and uptime
However, there is a shorter answer to “Why the rapid adoption of IoT by industry” – that is data. At the core of IoT, in general, is access to data, which is the first pillar of the framework. Cisco summed it up recently when they stated that “Connected devices are creating 277 times more data than people are creating.”4 Another good question is why is all this data so important? From the plant manager to the process engineers, access to real-time data and analytics would not just help them do their jobs better, it would help them identify problems earlier, improve process problems and help identify maintenance issues earlier, driving overall increased efficiences and yields. Traditionally, much of the
process data was either captured and stored locally on PLC (programmable logic controller) or SCADA (supervisory control and data acquisition) devices or HMI (human machine interfaces). Access to this data was cumbersome, and analytics was time-consuming and slow. What industry wanted was real-time access to all process data and a way to have that data analyzed, and the analytics fed back in a near real-time fashion. This demand for data analytics is a key driver for IoT. To collect data from the devices and have it aggregated, and then transported for analysis requires connectivity of the network, which is the second pillar of the framework.
Benefits of lloT
A survey5 of why industry was adopting IoT and the associated value shows how much value is put on data.
Improving operational efficiency
47%
Improving productivity
31 %
Creating new business opportunities
29%
Reducing downtime
28%
Maximizing asset utilization
27%
Ability to sell products as a service
18%
Reducing asset life cycle
All of these stated benefits rely on data analysis and analytics which will take place on applications that are running in the cloud infrastructure, the third pillar of the framework.
Enhancing worker safety 14 %
Enhancing product innovation Better understanding of customer demand
13 %
9 %
4 Connect devices are creating 277 times more data than people are, Cisco, May 22, 2017.
5 The Internet of Things and the new industrial revolution, Morgan Stanley, June 2016. 9

10. IoT vulnerabilities
To date, most IoT deployments are focusing on data collection for predictive analytics to help drive operational efficiencies such as predicting maintenance issues based on sensor data collected or process limits trending out tolerance based on data analysis.
Few are looking to take full benefit of data analysis due to security. Non-critical data such as vibration sensor data sent to the cloud for predictive analysis is one thing. Sending proprietary process information up to the cloud is quite another. Data integrity and cybersecurity still give many a reason to pause.
IDC expects that by 2019, at least 40% of IoT-created data will be stored, processed, analyzed and acted upon close to or at the edge of the network. On top of the benefits, IoT has cybersecurity consequences.
Most industrial IoT deployments will be overlays onto existing OT infrastructure or “brownfield.” For IoT to access the data, it will rely on opening access to transfer information across an existing mature network that has been traditionally isolated from internet access. The data payload may very well be greater than the legacy network can support. In addition, new edge device traffic will aggregate the data for communications with the internet. The final stage is the security of the cloud link and the data sent.
Fortunately, these issues have not gone completely unnoticed. A survey6 conducted on the barriers to adoption for IoT and security was number 1 with 64% of the responses.
IoT barriers for adoption
Security
64%
Interoperability
51%
Cannot prove ROI
44%
Cost
31%
Hardware integration
27 %
Network connectivity
22%
Maintenance
16 %
Data storage and analysis
14 %
Other
6 Redefining the connected conversation, James Brehm & Assoc, Feb 3, 2016 10

11. As industrial deployments continue to move more and more to IoT, it is time to re-evaluate the role data plays and look at data as an asset. Data as an asset then quantifies it like any device in a network; data too must be accounted for. In today’s IoT networks security of data is about integrity, which is the same as IT environments that focus on confidentiality and OT environments which focus on availability. If there is a compromise of the IoT network, data integrity can then be questioned.
“As Industrial companies pursue IoT, it’s important to understand the new threats that can impact critical operations. Greater connectivity with operational technology (OT) exposes operational teams to the types of attacks that IT teams are used to seeing, but with even higher stakes,” said Robert Westervelt, security research manager at IDC.
Despite the current pessimism surrounding IoT, security7 deployments will continue as early adopters are quick to realize the benefits of IoT. Current demand for IoT does not mean cybersecurity is not an issue. The table below outlines the survey findings8 specifically of Industrial IoT users. All agree that IoT will continue to grow and that cybersecurity risk of using IoT will continue to grow as well.
The concern for cyber attack is no longer focused on loss of data, but on safety, availability and data integrity
90% of industries expect IoT deployment to increase
94% of industries expect IoT to increase risk and vulnerabilities
to their organizations
96% of larger companies and
93% of smaller
companies
expect significant increase in risk caused by use
of IoT
96% expect to see an increase in security attacks on IoT
64% already recognize the need to protect against IoT attacks as they gain popularity with hackers
51% do not feel prepared for security attacks that abuse, exploit, or maliciously
leverage insecure IoT devices
Industrial Internet of Things Security Survey, Tripwire-Dimensional Research, March 2017.
8 Ibid. 11

12. IoT cybersecurity strategies
A common misperception is that newer technology learns from the past so cybersecurity should be improving with each new generation of a product. Unfortunately, this does not hold true. Some may say the converse even holds true. IoT technology does solve the cybersecurity issue and, if anything, it amplifies it. Nowhere is this truer than the industrial OT environment. IoT devices rely on standard IP protocols to communicate and exchange data with the internet. However, most industrial OT environments are using mature technology, with non-standard and proprietary protocols for communications and network architectures are such that they cannot communicate with the internet.
Despite these challenges, we still see people promoting encryption to secure the data and firewalls to secure the networks. These are point solutions that on their own merits will not provide the comprehensive cybersecurity required for these next generation IoT networks. Putting technology solutions before the problem is identified and understood is a typical cybersecurity shortfall. This is why EY has developed an IoT Cybersecurity Strategy that aligns to the challenges of IoT deployments. While IoT may very well be a “game changer,” it can have a definite impact on the security of the industrial network. Planning for an IoT implementation will never be a one-size-fits-all approach. Each plant, facility and property is unique, therefore, cybersecurity must be examined at all phases of deployment, starting with planning. For these reasons the EY IoT Cybersecurity Strategy leverages the current OT Cybersecurity Transformation Life cycle phases: assessment, development, implement and management while adopting the core security tenets of the National Institute of Standards and Technology (NIST) — Prepare, Protect, Detect and Respond.
Prepare e A a g s s a n e M s s
Tracking
Yesterday
Observational
Today
IoT Cyber
Respond
Protect
Optimization
Emerging
Ecosystem
Future state I m p p l e e l o m e e v n D t
Detect 12

13. 13 Tracking Observational Optimization Ecosystem
What makes this strategy unique for IoT is the ability to adjust to the IoT implementation maturity. Given the current newness, availability and concerns of IoT, not every deployment will be at the same implementation level. EY defines implementation maturity levels in
four phases.
Tracking
Observational
Optimization
Ecosystem
Today
Tracking a single device; basic
and fundamental approach; requires a road map that outlines a path to compliance and security integration
Tomorrow Tracking of devices plus web-based information and basic analysis; the evolution of the current systems, migrating to IoT
Emerging
Fleets of devices that monitor and report to the analytic platform(s) for
process optimization; overlaying new IoT technology on the existing system to leverage the gains
of IoT
Future state Fleets of interconnected systems interconnected to suppliers, vendors, and clients to
optimize the complete supply chain; fully utilizing the data collection, analytics, and predictive analysis of the devices that monitor and report to the analytic platform(s) for process optimization
The IoT Cybersecurity strategy in turn provides the baseline for:
Solid repeatable framework to identify risks
Ability to map identified risks to priorities
Emphasizing data security and integrity
Utilizing priorities to determine the appropriate technical security controls
Industrial Internet of Things (IoT) opens a new world of possibilities for data analysis and analytics. It can also open the network to a new world of cyber threats if a proper cybersecurity strategy is not adopted early and executed as part of the overall program.
Cybersecurity is a journey and starting that journey on the right path helps encounter fewer roadblocks. 13

14. Contact us
Are you interested in discussing how to further engage with your clients on this topic? Contact our IoT OT cybersecurity team:
Tom Jackson, CISSP
Senior Manager, IoT/OT Cybersecurity 14

15. 15

16. 16 EY | Assurance | Tax | Transactions | Advisory ey.com About EY
EY is a global leader in assurance, tax, transaction and advisory services. The insights and quality services we deliver help build trust and confidence in the capital markets and in economies the world over. We develop outstanding leaders who team to deliver on our promises to all of our stakeholders. In so doing, we play a critical role in building a better working world for our people, for our clients and for our communities.
EY refers to the global organization, and may refer to one or more, of the member firms of Ernst & Young Global Limited, each of which is a separate legal entity. Ernst & Young Global Limited, a UK company limited by guarantee, does not provide services to clients. For more information about our organization, please visit ey.com.
Ernst & Young LLP is a client-serving member firm of Ernst & Young Global Limited operating in the US.
© 2017 Ernst & Young LLP. All Rights Reserved.
EYG no US
ED None.
This material has been prepared for general informational purposes only and is not intended to be relied upon as accounting, tax or other professional advice. Please refer to your advisors for specific advice.
ey.com 16