CONNECTED AND VULNERABLE

We are bombarded with headlines about the insecurity of online systems. For most people, cybersecurity has effectively been framed as a problem with information technology and data leaks. But that conception is missing another channel of vulnerabilities: hardware attached to industrial systems. Process sensors, actuators, and drives have been considered to be engineering systems, so they have not been addressed from a cybersecurity perspective. But increasingly, information technology and the so-called operational technology of commercial and industrial hardware have merged. Until we invest in securing these physical systems, they will remain inherently insecure. Many hardware systems are shipped with only the most rudimentary security in place. Often, even if sensors are shipped with password protections in place, the default password is easily guessable and users are never prompted to change that default.