Securing smart devices in OT environments

Issue 8 2021 Information Security, Security Services & Risk Management, Industrial (Industry)


Joe Robertson.

The Industrial Internet of Things (IIoT) is all about connecting people, processes and assets. Traditionally, devices in OT (operational technology) environments have been isolated or connected directly to an industrial control system. IIoT gives these devices a link to the Internet. Now that these devices have been 'brought to life’, users can interact with them in realtime, draw data from them and analyse that data via statistical or predictive analysis. The value from that intelligence is priceless and the opportunities are endless.

Benefits include improved operational efficiency because IIoT devices can reduce troubleshooting time from days to minutes, reduced maintenance costs via preventive maintenance using sensors that can detect when equipment will soon break down, optimised procurement planning and scheduling, improved safety and enhanced customer experience.

In addition, advances in IIoT technology coupled with the rise of 5G will allow organisations to strengthen all of these benefits. So, what are the different ways that critical industries are using 'smart' stuff/devices?

Oil and gas

IIoT devices can be found across the oil and gas industry value chain, from upstream exploration and production to refining and downstream distribution. And in demanding environments such as offshore platforms, small IIoT networks can be used for rig or cargo-ship monitoring, reducing the billions of dollars lost each year to non-productive time (NPT). In the midstream sector, advanced sensors are being implemented to surveil various parameters of the pipeline to detect potential leaks or breaches.

Manufacturing

Using the IIoT approach of digital twins, manufacturers can virtually replicate a product or process, enabling them to analyse the efficiency of a system, make predictions and forecasts and help them create a better version of their products. In production lines, sensors, cameras and data analytics can determine, through predictive maintenance, when a piece of machinery will fail and can help managers plan maintenance and service schedules before a problem occurs. Smart devices can optimise shared costs in the value chain by tracking and tracing inventory in realtime, providing visibility and projections to supply-chain managers of available materials, the arrival of new materials and works in progress.

Power and utilities

The power and utilities sector embraces IIoT for smart water and gas management and smart grids. In smart water management, optimising water usage is key. Sensors can track parameters such as water pressure, temperature, quality and consumption, enabling utility companies to analyse the data as well as use it for billing purposes. Consumers can monitor their water consumption, decreasing water waste.

With smart grid, smart meters can monitor electricity consumption and transmission in realtime, which allows for more efficient, demand-based electricity generation and distribution. They can also alert electricity companies of power outages, allowing them to react at speed and restore services quickly. Finally, smart meters are a critical element of the decentralised power model by facilitating the growth of energy sources, such as solar panels and wind turbines, furthering efficiencies in production and distribution.

Transportation and logistics

The transportation and logistics sector is becoming smarter and safer thanks in part to IIoT with applications such as public transport management, fleet management and track and trace. In public transport management, IIoT solutions include passenger information and display systems, integrated ticketing systems, live vehicle tracking and more. With fleet management, IIoT devices are embedded in the vehicles to monitor their condition and driver behaviour, which informs of idle times and driving style. Track and trace uses IIoT sensors to track goods and manage them properly, ensuring that goods are in the right vehicle and on the way to the right destination.

Smart cities

Smart cities display some of the most exciting applications of IIoT from smart lighting to smart traffic to smart waste and smart parking, all ensuring that cities are cleaner, safer, more organised and economical for their residents. By managing, monitoring and automating connected streetlights - processes like brightness levels and consumption - cities can decrease costs and improve sustainability.

IIoT-enabled traffic monitoring can help manage traffic flows efficiently to decrease congestion and improve road safety. With smart waste solutions, sensors are installed in containers, enabling waste collectors to track waste levels, optimising schedules and routes. Finally, smart parking lots can interact with smart vehicles to provide up-to-date information on open space availability.

With various industries increasingly relying on IIoT smart stuff to monitor, track and manage various assets and predict, prevent and control a number of incidents, a vital question arises: Are smart devices implicitly safe to use and trust?

Smart doesn’t imply secure in OT environments

In fact, being smart just makes you more attractive to hackers. With each new smart device introduced into the network, the risk increases because each device is a potential new entry point for attack. Adding to this equation is 5G, which, although more secure than its predecessors, makes for a whole new playground for hackers. Additional security will still be needed.

Making smart devices in OT environments secure

When securing any system that includes smart devices, there are three important factors to consider:

1. Visibility: Having a comprehensive view of the system and its components to understand which devices are connected to the network and whether they are operating normally. Knowing what is connected to the network is basic cyber-hygiene, because you can’t protect what you can’t see.

2. Prevention: IIoT devices often have limited connectivity needs and segmentation should be used to restrict access. Application-aware firewalls can ensure that only authorised protocols and applications are allowed. Intrusion prevention can detect and block attempts to scan for vulnerabilities or security holes and prevent any attempt to exploit those vulnerabilities. For the IIoT infrastructure and ecosystem, since most communication is via REST APIs, detecting and stopping any attempts to gain access or exploit these APIs must be a high priority.

3. Recognising when a smart device has been compromised: Following a successful intrusion, there is a reconnaissance period during which the attacker will try to gather as much information as possible about the environment, identify high-value assets and determine how best to monetise the breach. This means that there is a short window of opportunity to detect the breach, identify the compromised devices and remove them from the network to contain and block the attack.

Solutions such as anti-botnet, compromise detection and user and entity behaviour analysis are designed to detect a cyberattack as soon as it happens. Adding security orchestration, automation and response (SOAR) technology can take this information and perform automated investigation and response to identify, isolate, or remove compromised devices before any damage is done.




Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

The line between locking residents out and restricting their access
News & Events Security Services & Risk Management Residential Estate (Industry)
A June 2026 High Court judgment has clarified one of the most contested issues in modern estate governance: when an HOA's digital access restrictions amount to unlawful self-help or spoliation, and when they do not.

Read more...
Compressing cyberattack timelines and targeting ungoverned AI identities
Information Security News & Events
Sophos AI Security 2026 report finds attackers are moving beyond experimentation and operationalising AI for attacks using identity as the primary initial access vector, rather than inventing new attack types.

Read more...
Modernise field communications with Push-to-Talk over Cellular
Products & Solutions Security Services & Risk Management
Sentiv is bringing Hytera’s Push-to-Talk over Cellular (PTToC) portfolio to organisations that need a more structured and controlled way to coordinate field teams, without extending a full private radio model to every team, site, or function.

Read more...
Zero-touch automation certificate life cycle management loop
Products & Solutions Information Security Security Services & Risk Management
ManageEngine completes the certificate life cycle management loop with CA-agnostic, zero-touch automation. New post-deployment automation in Key Manager Plus removes the last manual step in certificate renewal as lifespans gradually shrink to 47 days

Read more...
Fire safety in South Africa
Technoswitch Fire Detection & Suppression Technews Publishing SMART Security Solutions Fire & Safety Security Services & Risk Management Editor's Choice
Fire safety is sometimes ignored, sometimes relegated to whatever is cheapest, and sometimes treated with the seriousness it deserves, given that it focuses on protecting life and assets. SMART Security Solutions asked Brett Birch, MD of Technoswitch, for some insights into the realities of fire safety in South Africa.

Read more...
Sophos launches AI-native cybersecurity defence system
News & Events Information Security Security Services & Risk Management
Built for a threat landscape reshaped by AI, Sophos Fusion unites security operations, endpoint, network security, identity, email, and cloud into one defence system that prevents, detects, investigates, and responds at AI speed.

Read more...
Stop supplier fraud at the moment of payment
News & Events Security Services & Risk Management
Cape Town-built platform bridges the gap between onboarding and transaction by securing identity inside the live channels where companies exchange invoices and banking details.

Read more...
Ungoverned AI agents and deepfakes pose critical threats
Information Security Security Services & Risk Management
Global study reveals 64% of South African organisations already deploy autonomous AI agents with little to no governance, while 63% of employees admit they are unlikely to be able to spot attacks such as deepfakes

Read more...
A risk-based approach to fire safety
Fire & Safety Security Services & Risk Management Industrial (Industry) Agriculture (Industry)
A report by fire engineering consultancy ASP Fire is challenging blanket assumptions around combustible-core sandwich panels, arguing instead for a rational, risk-based approach that balances fire safety requirements with commercial realities in sectors such as agriculture, manufacturing and industrial processing.

Read more...
Preventing and suppressing lithium fires
SMART Security Solutions Technews Publishing Editor's Choice Fire & Safety Security Services & Risk Management Smart Home Automation
SMART Security Solutions asked Clyde Becker, director of Pyro Brand, for some insight into the mechanics of lithium-ion battery fire risks, especially thermal runaway, and to define a comprehensive, layered approach to fire detection and suppression.

Read more...










While every effort has been made to ensure the accuracy of the information contained herein, the publisher and its agents cannot be held responsible for any errors contained, or any loss incurred as a result. Articles published do not necessarily reflect the views of the publishers. The editor reserves the right to alter or cut copy. Articles submitted are deemed to have been cleared for publication. Advertisements and company contact details are published as provided by the advertiser. Technews Publishing (Pty) Ltd cannot be held responsible for the accuracy or veracity of supplied material.




© Technews Publishing (Pty) Ltd. | All Rights Reserved.