The (call it 'x') industrial revolution: Introducing new trends in industrial Cyber Security

December 20, 2023

The future was yesterday

We are not finished with the fourth industrial revolution, or Industry 4.0, and we are already defining and trying to implement new concepts that are growing in the heat of the so-called Industry 5.0 (and 6.0).

The speed at which changes are happening, the advances in technology, the speed at which new terms are introduced to implement new concepts (or not so new...). Everything leads us to trivialize each change, without reasoning in depth about the pros and cons of each one of them.

Clearly, the versioning system is "broken" from a human (not technical) point of view. However, the changes that cause this change of versions and nomenclatures do deserve an analysis. And the analysis cannot be a "new thing, good thing".

In this article we are going to dwell on concepts that we have all heard at some time (a few), contemplating them as implementations aimed at the industrial Cyber Security ecosystem. In other articles we will refer to them as a holistic implementation within "the factory of the future”.

The star of 2023

AI. Artificial Intelligence has clearly been the star of this year. It seems that it can do everything and what it cannot do is because it does not exist in this universe (and any day it surprises us...).

Beyond what it really can and cannot do today, it's obvious that Artificial Intelligence is a paradigm (not just a technology as such) that is here to stay. Not surprisingly, it is a concept that has been around for more than 60 years and all computer engineers have studied it.

Focusing on the world of cyber security, Artificial Intelligence is one more step in the application of rules, inferences, statistics... that have been used for years. One more step, but a very important step. Even with an ANI or Artificial Narrow Intelligence, the improvements are evident. The capacity for information ingestion and data relations, inferences... everything is more complete and faster.

Will it put an end to the work of analysts and cyber security professionals? I don't know. What is certainly sure is that being a very important element today, as AI capabilities advance and settle definitively at an AGI (artificial general intelligence) level, the ability to make autonomous decisions and make "analyst" associations and inferences will be greater.

In short, in addition to working with information such as indicators of compromise or attack (that which is loaded in IPS, IDS...) the AI will work effectively with information related to an attacker's TTPs, his "modus operandi".

This means a differential leap when it comes to finding patterns, anticipating campaigns, associating threats to APT groups, detecting these APTs when they "sleep" in the system, etc. These types of inferences are, until now, the responsibility of human intelligence, and now more help is on the way.

The star of 2022

The metaverse, of course. Although out of focus and seemingly abandoned, the metaverse still has things to offer, though perhaps not what was expected and not now.

But, as a concept, it has advantages if it goes hand in hand with improvements in connectivity (hello, 5G SA) and Edge computing. Perhaps the initial application should not be to establish an open, non-deterministic world where humans can wander.

Surely, proposing much more closed, deterministic environments in which human influence is limited to certain actions is a humbler and more sensible step.

Following this reasoning and relating it to industrial environments (and cybersecurity), deploying a controlled environment where we can begin to virtualize operations and behaviors (which are not the same thing) would be a good step towards the factory in the metaverse.

The basic behaviors are fairly simple to virtualize, because these are machines in certain states. However, the operation is another story. It is not a matter of a machine saying "yes" or "no". It is a matter of the virtualized system taking into account how the real machine behaves at the level of the circuit, logic gate, electrical signal... and also taking into account the wear and tear of the system, the heat given off, the changing conditions of the environment... achieving this would mean the birth of the first real digital twin.

Needless to say, having a virtual system that behaves like a real machine (or a real environment) is differential from a cybersecurity point of view. Being able to deploy such systems to run testbeds, Red Team activities or honeypot-like decoys would be very positive from the point of view of flexibility and availability of such systems.

Unfortunately, this is not a reality. And, as long as it is not, the capture of real threats and the analysis of their behavior in industrial systems must be done on real hardware to guarantee real results and avoid the noise of virtual systems. Hello, Aristeo.

The Brown Dwarf

Brown dwarfs are a type of stars so small that they cannot sustain the nuclear reactions that their larger siblings can. Therefore, they do not emit enough visible radiation for us to see them with the naked eye, but there they are…

Web3 is that star that is not visible to the naked eye but has been with us for a long time. Why? Because its scope is so global that its application is much slower (and quieter) than that of other technologies and concepts. In other words, it is designed to stay with us for a long time.

Regarding industrial Cyber Security, we must bear in mind the following: in an industrial process, the paradigm of security, the CIA (confidentiality, integrity and availability), emphasizes the integrity of information.

This does not mean that the other two aspects are not important, but in an industrial process, "manufacturing" (food, electronic devices, drinking water) on the basis of constant and approved values is fundamental. Failure to do so could result in a health or safety issue.

Benefits of Web3

That being said, let's talk about the benefits of Web3. Web3's ability to use Blockchain as a registry, encrypted, distributed, consensual and verified, allows for improved security, integrity and traceability of process and value information, as well as changes to it all.

Web3 implies more robust industrial processes that are resistant to changes that can affect all of us in a negative way.

In addition, the luxury of deploying humanly unattended systems is something that is not generally possible in the industrial ecosystem, so some of the efficiency and effectiveness gains that such systems bring are lost.

Thanks to Web3, the autonomy of industrial systems is improved, establishing a layer of control over their processes with smart contracts that can be linked to events or conditions (changes in values, for instance) that limit their scope.

Walking the way to the future

This is a brief overview of technologies that are set to make a difference in the field of industrial Cyber Security. However, it should be noted that no technology is free of problems.

The technologies mentioned here have their own challenges, such as the difficulty of transferring the interaction of hardware elements at the circuit and electrical signal level (or the action of the medium in which they are located) to a software world, or the 51% attacks that undermine the reliability of some Web3 features.

Going back to the beginning of the article, the speed at which changes are occurring means that the concept of "obstacle" is now interpreted not as "impediment" but as "challenge". This leads us to contemplate the benefits far beyond these challenges, which moves us forward as a society and as individuals.