Avoiding the internet of insecure industrial things

Security incidents such as targeted distributed denial of service (DDoS) attacks on power grids and hacking of factory industrial control systems (ICS) are on the increase. This paper unpacks where emerging security risks lie for the industrial internet of things, drawing on both technical and regulatory perspectives. Legal changes are being ushered by the European Union (EU) Network and Information Security (NIS) Directive 2016 and the General Data Protection Regulation 2016 (GDPR) (both to be enforced from May 2018). We use the case study of the emergent smart energy supply chain to frame, scope out and consolidate the breadth of security concerns at play, and the regulatory responses. We argue the industrial IoT brings four security concerns to the fore, namely: appreciating the shift from offline to online infrastructure; managing temporal dimensions of security; addressing the implementation gap for best practice; and engaging with infrastructural complexity. Our goal is to surface risks and foster dialogue to avoid the emergence of an Internet of Insecure Industrial Things.     

Mock terrorists decisions’ concerning use of the internet for target selection: a red-team approach

In this study we sought to identify which locations appear more, or less, attractive to a terrorist in planning an attack and to investigate what attributes of those locations influence preferences. A sample of undergraduate university students (N?=?147) were given the role of terrorists, and provided with five potential attack locations, including a pedestrian mall, a shopping center, a train station, a university and an airport. After using the Internet to learn about the target locations, participants placed the locations in rank-order from most to least preferred as targets and indicated why they had selected those targets. Results showed both a clear rank-order of target preferences: locations perceived as being more crowded were more preferred, while locations with a greater security presence were less preferred. Results also demonstrated a moderate positive correlation between the amount of online information viewed for a specific location and the preference for that location as a terrorist target, where participants who viewed more online content for a particular location were more likely to also prefer that location as a terrorist target. Findings from this study can potentially be used to reduce the likelihood of a terrorist attack occurring on specific locations, by altering the publicly available information on that location regarding the security and how crowded that location is.