Having
endured another restless night, Oscar reaches for the alarm. His mind wanders as he recalls the nightmare
which seems to be top of mind, even as the sun peaks through the windows. Their service company, WeHelpU was in court defending their position
regarding the data breach at the "TrustMe nuclear plant". They,
like many other service providers, WeHelpU jumped on the IoT bandwagon a
couple of years ago. It didn't take long
for Oscar to become overwhelmed, current situation aside, what about the
thousands of our other customers?
A
couple of years ago, in 2018, we established
rules of engagement to prevent us from being in this situation, where
did we fail?
- Air Gap | at first we were very disciplined to only install non-intrusive monitoring. As our skills and knowledge broadened we started making exceptions. Hey, we can save some capital if we just connect to the existing control system?
- Cellular | while very tempting we stood our ground and never connected to the clients network, sensors to the gateway and gateway to the cloud.
- Anonymized | this was the trickiest of all. Fact is we have lots of sensors and actuators which all tie to assets, which belong to sites, sites which belong to clients. Whether structured data sets or metadata tags, they are all vulnerable. The short term recall of data is powerful for scheduled and unscheduled activity and needs to relate to the customer. Long term data is helpful for models and AI, this data should be anonymous.
Our
discipline, or lack thereof, will impact our organizations and our
clients. We simply don't know what we
don't know, be curious but cautious.
-----
Next
post: who's data is it?
Thoughts? feel free to leave replies or direct message
See all
of the "last mile worker" posts here:
http://lastmileworker.com
-----
Comments
Post a Comment