IoT/ICS Hacking
IoT security in 2024 isn’t just a nice-to-have; it’s an absolute necessity to protect individuals, organisations, and society as a whole.
As our reliance on smart technology continues to grow, investing in robust IoT/OT security becomes more and more essential in preserving the digital innovations we’ve come to depend on.
Organisations need to ensure their security consultants are capable of understanding the specific challenges around securing industrial environments – to be able to both take advantage of the opportunities, and to mitigate the threats.
The Cyber Scheme are committed to developing a talent pool of individuals able to cross into this field using the skills they already bring to their job, whether they’re from a software or hardware engineering background, or are skilled at web-based security testing methods. The skills we instil can be applied to existing roles, creating well-rounded testers capable of understanding, and acting on, vulnerabilities found within these specialised environments.
Whether you’re a tester or engineer looking to upskill in specific technologies, or an organisation keen to capitalise on the growing need for IoT Security Specialists, the new IoT/ICS hacking course from The Cyber Scheme will teach a range of practical and consultative skills which can be used in multiple scenarios. Read on to find out more.
The Internet of Things – in simple terms
IoT is a broad term for interconnected devices that interact with the physical world. The ‘things’ in IoT are devices that can interact with the physical world, either by using sensors to gather data, or actuators such as switches to make physical changes. Fitness trackers, smart appliances and cameras are all examples of ‘things’ which can connect to the internet, and communicate with it and with each other.
IoT Security encompasses measures designed to protect these internet-connected devices and the networks they inhabit from malicious attack.
What’s OT/ICS and what’s the difference?
Operational technology (OT) refers to the hardware and software used to identify, monitor, and control physical devices, processes, and events within an industrial setting, for example a factory, or a utilities company. Also increasingly referred to as IIoT (industrial internet of things), OT helps manage facilities and infrastructure. OT security safeguards the industrial control systems (ICS) controlling physical industrial processes.
Our training course doesn’t differentiate between the skills and knowledge required to work on IoT or OT/ICS security; it covers both.
Where does The Cyber Scheme fit in?
We have many years’ experience of assessing and training technical candidates in real-world situations that mimic actual testing environments as closely as possible.
We have translated this experience into our IoT/OT course; it has been created by subject matter experts with experience in both traditional hacking techniques and those employed specifically in IoT/OT environments. We use real hardware, and real techniques; we believe it would be impossible to self-learn these techniques and skills due to the wide areas of expertise covered, and we include supervised practicals mentored by course leaders.
IoT/ICS is a key and critical marketplace - you need to be in this space to thrive as an offensive security expert in 2024.
It’s a simple fact that traditional penetration testing techniques don’t work in IoT and OT environments.
Testing and Design Reviews of complex, but fragile and dated plant brings up additional challenges not found in app-based IT Security Testing. This course allows testers and engineers to add to their existing capabilities, ensuring they have the practical and consultative skills necessary to protect physical infrastructure.
By mimicking real world situations and including multiple practical sessions, our course addresses the reality of undertaking a security assessment prior to undertaking any technical hacking and its potential consequences.
- How have the engineers connected existing devices?
- How fragile is the equipment and how easy will it be to break – and what are the repercussions of that?
- How robust is any error handling and what are the implications of breaking a command?
- What should the post-test report consist of, and what advice can be given?
These consultative skills can be used across multiple scenarios, giving our candidates the best chance of success in their careers, regardless of the environment they are working in.
Manufacturers need to be sure that products produced by third party vendors are as secure as they need to be – both physically and against cyber attack. Only an independent assessment will assess and monitor vulnerabilities – offering this as part of an organisation’s offensive security portfolio will create opportunities as this market evolves.
Let's not make a technical topic more complicated than we need to...
For the purpose of The Cyber Scheme’s new training course, we don’t actually differentiate between the skills and knowledge required to work on either IoT or OT security. There is confusion around the terminology used – IoT/OT/IIoT/ICS – when in fact the hardware knowledge and hacking skills required to be proficient as a consultant in this field share many commonalities. Rather than add to this confusing landscape, The Cyber Scheme have taken our usual no-nonsense approach; why not create a course that addresses the need to assess multiple scenarios, regardless of whether the environment is consumer or industry focussed.
Our aim is to develop practitioners who will, after a four-day course, be able to confidently secure an environment by detecting its vulnerabilities and, importantly, be able to recommend effective mediations to make the environment secure. We focus on commonalities, not differences, found in both consumer devices and in operational technology. We strongly believe the skill sets we teach provide a practical and meaningful crossover between IoT and OT/IIoT technologies.
Industry 4.0 - digital transformation and its effect on manufacturing
Manufacturers are increasingly integrating new technologies, including cloud computing, AI and machine learning, into their production facilities and throughout their operations. Industry 4.0 is the realisation and acceptance of the way companies manufacture, improve and distribute their products. The innovation inherent in Industry 4.0 will lead to many positives; increased automation, predictive maintenance, self-learning of improvements and new efficiencies which will revolutionise heavy industry. But we need to be aware of the risks and be able to mitigate them in order to stay safe. Some are calling this the ‘fourth industrial revolution’ for the impact it will have on society.
With minimal investment, a smartphone can be connected to the cloud to monitor manufacturing processes from virtually anywhere; imagine the consequences if this connection is manipulated by threat actors. Machine learning algorithms can help manufacturers detect errors immediately, but they can also send the wrong signals and commands, with extreme consequences. It’s not an exaggeration to declare that innovations around smart technology within manufacturing will have a transformative and exponential effect on the growth of IoT/OT security over the coming years; our industry needs to be prepared.
What are the risks if we don’t prepare for change?
With these advances in technology, small battery-powered devices can now connect to and communicate with the internet simply and effectively, and can gather data on a much larger and quicker scale than anything available even a few years ago. These advances create huge opportunities for business growth and innovation – but they can also invite threat. If the information gathered is stored in an insecure way and can therefore be manipulated, this can invite malicious activity which can have long-reaching consequences not only for the company attacked, but also the safety and security of society. It’s important to reflect that, even in the digital world we live in, most devices and apps have not been built with security in mind – perhaps they’ve been developed by an engineer with technical capability and innovation as a priority, or perhaps maintaining the lowest possible price point and ensuring speed to market have been more compelling business cases than sufficient security testing during development. In addition, due to the sheer amount of connectivity that occurs now daily between multiple devices and multiple components, the potential attack surface is much bigger within an OT environment than within a standard IT environment. A hacker can gain access through multiple vectors – cellular connections, Wi-Fi, Bluetooth connectivity and physical infiltration of multiple apps and components – so this must be considered when teaching IoT/OT testers to detect vulnerabilities.
One of the biggest challenges we face as a country as we seek to improve the security of IoT/OT is the level of sophistication we face in our opponents – whether from nation state threat actors, or from very well-funded organised crime groups. In addition to physical manipulation, threat actors are increasingly installing ransomware or encrypting and locking systems for financial gain. The repercussions of malicious activity affecting IoT devices can be life-threatening, and it’s imperative that the cyber security industry expands provision of cyber services to include industrial and manufacturing scenarios. The business case for creating practitioners who can address the needs of industrial and manufacturing clients is clear. If you are looking for specific examples of what can go wrong if security isn’t sufficient, try Googling ‘Triton Malware’; it makes for a sobering read.
The Cyber Scheme’s new IoT/OT Hacking Course teaches the skills to securely test and assess connected systems and devices in consumer, industrial, and critical infrastructure environments. We strongly believe practitioners – whether from a testing or engineering background – should be taught the skills to assess and exploit Industrial Control Systems in order to keep UKPLC safe.
Our course has been developed for consultancies who recognise the growth potential in offering IoT/OT testing services as part of their portfolio, and for engineering companies who see the potential and threat of Industry 4.0 and its implications for their trade.
Skip to content