Organisations continue to struggle with device management data and fragmented architectures while facing pressure from business and regulators. As the technology landscape changes, the integration of Internet of Things (IoT) devices with Operational Technology (OT) presents both exciting opportunities and significant security challenges. In a recent episode of the Security Strategist podcast, host Christopher Steffen, alongside Dr Juergen Kraemer, Chief Product Officer of Cumulocity, examines the complexities of securing IoT environments and the importance of resilient analytics and accountability.

Understanding the IoT-OT Disconnect

As time passes, the historical divide between IT and OT persists. As highlighted by Dr Kraemer, the operational technology sector has traditionally prioritised physical safety and availability over data confidentiality. This disconnect has created a significant gap in security policies, leaving IoT devices vulnerable to exploitation. The conversation emphasises that as organisations connect these previously isolated systems to IT networks, they inadvertently expose themselves to new risks, demanding a reevaluation of security strategies.

Addressing Security Challenges

Dr Kraemer points out that securing data access is critical, especially for organisations that deploy IoT devices across multiple sites. For instance, managing security for an elevator company with installations worldwide presents unique challenges. Organisations must navigate various networks and ensure compliance with new legislative requirements, such as the Cyber Resilience Act and NIS2 directive. These regulations demand a structured approach to security that many legacy OT environments struggle to meet.

The Importance of Unified Data Management

As IoT solutions proliferate, organisations often find themselves managing a patchwork of legacy systems and newer platforms. Dr Kraemer advocates for a hybrid approach, suggesting businesses create a unified data plane that integrates new and old systems. This strategy allows organisations to maintain operational continuity while gradually transitioning to modern platforms, ultimately leading to enhanced innovation and efficiency.

Buy and Build Strategy

A significant takeaway from the podcast is the concept of “buy and build.” Instead of choosing between purchasing a platform or developing one in-house, organisations should leverage established platforms like Cumulocity while also building innovative applications tailored to their specific needs. This dual approach allows businesses to focus on high-value projects without getting bogged down by the complexities of underlying infrastructure.

The dialogue sheds light on the pressing need for organisations to adapt their cybersecurity strategies to accommodate the complexities of IoT and OT environments. By understanding the historical disconnect, addressing security challenges, and adopting a buy and build approach, enterprises can improve their cybersecurity posture and drive innovation in an increasingly interconnected world.

To find out more, visit https://www.cumulocity.com/

Takeaways

• IoT devices are often treated as secondary in security policies.
• The historical divide between IT and OT creates security challenges.
• Organisations struggle with integrating legacy and modern IoT systems.
• A buy-and-build strategy allows for innovation while ensuring security.
• Deployment flexibility is crucial for global IoT operations.
• Data silos hinder effective analytics and AI integration.
• A unified data lake can enhance insights from IoT data.
• Regulatory compliance is a growing concern for IoT security.
• Organisations need to enforce strong security measures across the entire IoT lifecycle.
• IoT should be viewed as a data-driven business opportunity rather than just a connectivity issue.

Chapters

00:00 Introduction to IoT Security Challenges

04:01 The Disconnect Between IT and OT Security

10:00 Challenges in Integrating IoT Platforms

17:09 Buy and Build Strategy for IoT

20:08 Modern Data Pipelines and AI Integration

24:07 Bridge between AIOT and IOT

28:02 Best Practices for IoT in Risk Management