Cyber Security Needs to Evolve

Over the past years, the European Commission has adopted a number of measures to ward off cyber incidents. For example, the directive on security of network and information systems (NIS directive), adopted by the European Parliament in July 2016, was the first piece of EU-wide legislation on cybersecurity. It established European standards intended to prevent cyber incidents and to improve the exchange of information about them.

The NIS directive was an important first step. However, authorities and businesses will have to take additional measures in order to continue operating securely.

Cyber Security is Complex

Authorities increasingly require organizations to be ‘cyber secure’, especially in market segments where cyber incidents have drastic consequences for public order and safety. But cybersecurity is a particularly complex organizational problem, which requires technical and process-oriented testing and certification programs.

Testing cybersecurity requires clear guidelines and standards and the cybersecurity landscape is evolving fast. Next to the new directive, there’s a general management guideline for information security (ISO 27001) and there are technical standards for the integration of industrial systems with communication networks (IEC 62443).

However, developments are currently happening at a dizzying pace. Hackers are, by definition, always one step ahead of the authorities and the business world. The amount of data and data traffic is expected to quadruple in the next ten years, and not just through the internet.

Thanks to the Internet of Things, we can expect a massive transition in which the control of equipment, vehicles, machines, and installations happens increasingly directly via the cloud. Cybersecurity will soon be more vital than ever.

It’s Not Just About Cybercrime

It should be mentioned that it’s not just a matter of protection against cybercrime. The present discussions about cybersecurity are driven by incidents in which the deliberate violation of systems can lead to damage and serious accidents. The concept of cybersecurity covers much more.

The vast numbers of networks and the quantity of data traffic mean that people can enter other systems unintentionally and/or interference between different systems and networks can occur, with problematic consequences.

Furthermore, the functional safety of systems and equipment plays an important role. Are sensors, components, and software systems reliable and secure enough? Will they react differently in networks and environments where there’s a lot of different data traffic?

Cybersecurity has to be examined on three levels: at the level of individual components, complete systems, and processes. It goes beyond the IT department’s traditional field of activity, which ensures that hackers are kept out of systems and that data is stored securely.”

Traceability and Forensics are Important

Finally, it’s worth pointing out the importance of traceability and forensics, especially as more and more equipment and machines are controlled from the cloud. It’s not just about prevention; it also covers the further optimization of security and reconstructing incidents in order to avoid repetition.

Currently, simple log files are created, however; soon a type of black box will be required for every important device or system. Through the black box, you will know who has penetrated the system and exactly what has happened. In an ideal situation, a black box in, for example, an autonomous car will issue a warning immediately when somebody tries to affect the car’s controls.”

DEKRA Certification B.V. is an independent third-party testing, inspection, and certification body and is in no way affiliated with, nor contracted by nor otherwise linked to any of IoT For All’s sponsors nor their products.