Security professionals love to talk about attack surfaces and that phrase has become almost a cliché in the context of 5G and the IoT (Internet of Things). It refers to sources of threats to a particular system and by definition is largely a function of connectivity and access.
If a device or system has no connectivity than security threats such as tampering, theft of data, or denial of service, are confined to hackers who can gain physical access to it. That is one reason why the IoT has attracted attention from hackers and become a growing source of concern as devices that were previously unconnected become remotely accessible, alongside new ones with in-built communications from the outset.
Then as communication links become faster and onboard computational capabilities increase in tandem, the scope for external manipulation increases, so the attack surface is said to have expanded. The increased capabilities of 5G by themselves will help expand that attack surface, but it will be more particularly the newly enabled mobile use cases that will elevate risks.
That is why initial attention over 5G security risks has tended to focus on two of the likely early use cases, that is the Industrial IoT (IIoT) and automotive sectors. Both sectors will increasingly include safety critical processes, such as real time robotic control in manufacturing and autonomous driving.
Telefónica has been among the early movers of the big telcos and technology players, at least in making a lot of noise and striking partnerships with key players in the field. It has certainly been hyperactive during this period of global lockdowns, having reached deals with Siemens in Spain and Cisco in the UK, among others.
In Spain, Telefónica and Siemens are combining their respective IT and OT (Operational Technology) platforms in what they call the Industrie 4.0 sector in the country. We can take it that Telefónica will be providing the lion’s share of the IT as a service provider and Siemens the OT as a manufacturer itself.
Telefónica had already created a dedicated IIoT unit out of its ElevenPaths cybersecurity division, which in turn is part of its unit called Telefónica Tech formed in November 2019 with a mission to transform its own business into one focused on markets identified as being ripe for growth in the 5G era, starting with the IIoT and automotive.
Telefónica’s UK collaboration with Cisco is focused on that second sector, and also includes the Manufacturing Group at the University of Warwick, and the Millbrook Proving Ground, which worked on a 12-week testbed project called BeARCAT (baselining, automation and response for connected and autonomous vehicles).
New surfaces can be formed through intersection of existing planes and that metaphor certainly holds for security, where anticipated threats emerge when domains that were previously disconnected are melded together. In the industrial sector this is happening with convergence between IT and OT, which means that each side can be exposed by attacks that compromise the other.
In the past, IT was confined largely to enterprise applications such as financials and resource management involved in running the business, while OT was concerned just with control processes and automation on the factory floor. But a growing number of processes now straddle the two, such as smart metering, power management and predictive analytics, which apply to IT and manufacturing systems. Indeed, this coming together of IT and OT within IIoT defines this Industrie 4.0.
Although different threats are involved in the CAV arena, the underlying theme of previously isolated systems coming together applies. It is a truism that vehicles have increasingly become large computers on wheels but only more recently have they become internet connected. Potential for intrusion will be driven further by the interactions between multiple sensory, surveillance and navigation systems involved in autonomous driving, with 5G facilitating the wider area communications.
The obvious question that arises in both the IIoT and CAV arenas is what proven threats exist and what attacks have actually been successfully executed that compromise safety. Apart from a few celebrated cases such as attacks on Ukraine’s national grid, most of the significant damage has been either in disrupting major web based services and enterprise operations through distributed denial of service (DDoS) attacks, or large-scale theft of consumer data, often through malware that exploits security holes to enter.
Otherwise it has mostly been attacks staged by security professionals rather than hackers or cybercriminals that have penetrated IIoT or CAV systems, so there is then that question of how real the risks are. However, there have been a few successful attacks from the wild, such as the Triton industrial malware discovered compromising the safety systems of a Saudi Arabian oil refinery in 2018. That was possibly the first malware engineered to attack industrial safety systems, showing potential to disable sensors.
Cybersecurity is concerned with more than just outside attacks but also protection against system malfunctions that may arise through bugs or encountering exceptions not anticipated or catered for, which is a particular concern for autonomous driving.
There is also the huge issue of governance and conformance to regulations, which has become more critical following the EU’s controversial GDPR scheme, which came into force in May 2018. Although criticized for being heavy-handed and imposing too great a burden on smaller enterprises especially, GDPR has nonetheless been a blueprint for the rest of the world and conformance has added to the challenges under the cybersecurity umbrella.
It is also true that IIoT systems and CAV will be subject to concerted attacks not just by cyber criminals and lone wolves motivated by prospect of publicity for their exploits, but also state actors, given that they will be seen as part of critical national infrastructure. We should remember all states are actors, not just those considered threats to any given country. For example, the Stuxnet computer worm, whose existence became public knowledge in 2010, is widely believed to have been a cyberweapon developed jointly five years earlier by the US and Israel to attack Iran’s nuclear program. Certainly Stuxnet targets supervisory control and data acquisition (SCADA) systems. It is therefore almost a given that serious breaches of IIoT and CAV systems will occur at some point.
Indeed, a founding principle of cybersecurity is that no defense can ever be inviolable and successful attacks will inevitably occur. Therefore, a significant effort must go into ensuring damage is limited in the event of successful attacks and contained locally as far as possible. In this context, the same monitoring methods, increasingly employing machine learning algorithms to tune in on patterns of unusual activity developed in the first instance to preempt attacks before they have been carried out, should also come into force to identify when defenses have been penetrated.
In the case of CAV, the aim here may be to ensure that the vehicle is safely brought to a halt, or control passed over to a human driver, before any accident has occurred. Similarly in the IIoT processes may have to be halted, although the preference in that case would be to disable any attack during continuous operation.
Apart from the safety angle, many of the risks associated with these 5G use cases are common to all business sectors, including exposure of sensitive data, reputational damage, loss of public confidence and theft of IP, on top of the regulatory angle.
Equally therefore, traditional defensive measures and due diligence are still relevant, including avoiding single points of exposure and ensuring no one person can take a critical action without reference to others. The main new challenge involves being able to address threats that are unknown or have not been encountered before, and that can only be done with the help of cognitive capabilities, machine learning and behavioral analytics.
It also involves more coherent and systematic analysis by security professionals involving simulated attacks, particular for CAV where individual safety critical components can be targeted in isolation. All key systems have been compromised in the laboratory as it were, with collision avoidance systems misused to apply brakes, automated parking to steer into the path of an oncoming vehicle, and cruise control for unauthorized acceleration. These attacks can be blocked by suitable algorithms but were not in place on earlier autonomous systems used for real tests on public roads.
Clearly then cybersecurity is fundamental to successful evolution of both CAV and the IIoT under 5G and Telefónica is keen to place its stake in the ground as a major player.