Harnessing Analog Controls to Secure Industrial IoT Operations

As computing and networking gear in industrial settings becomes increasingly sophisticated, the gap between state‑of‑the‑art and legacy equipment widens, complicating cybersecurity risk assessment. According to the SANS 2019 State of OT/ICS Cybersecurity Survey, roughly half of industrial organizations prioritize enhancing visibility of connected control systems and configurations, while more than a third focus on conducting security assessments or audits of industrial control systems.

The Challenge of Calculating Risk

"Identifying processes and assets that are likely targets for cyber threats is no easy task," says Dan Miklovic, analyst at Analyst Syndicate. "The growing complexity of the environment not only makes risk assessment harder, it also increases the chance of human error." Miklovic notes that operators may unintentionally reboot control systems remotely when they think they are in a test environment.

While internal sabotage—whether deliberate or accidental—must be considered, external adversaries can cause significant industrial security problems. "Motivation drives what is targeted. In cases of industrial espionage, perpetrators may aim to stay hidden, keeping operational risk low but risking long‑term strategic loss," Miklovic explains.

Monetary gain and political or ideological disruption are common motivators. Ransomware blends these motives; attacks such as NotPetya and WannaCry illustrate how ransomware can cripple multinational shipping firms, food‑and‑beverage giants, and other sectors, costing millions in recovery.

Industrial environments often rely on commodity PCs that are vulnerable to standard ransomware. Matt Watchinski, vice president at Cisco Talos, observes, "Attackers rarely develop ransomware specifically for industrial control systems. If they have thousands of Windows boxes they can use, they’ll target the easy option. Yet interfering with the human‑machine interface of an industrial system could also be a lucrative ransomware target."

An Analog Solution to Digital Disruption

Deploying analog controls to govern critical industrial functions is one proven strategy to mitigate disruptions—whether from ransomware or other threats. Analog systems, with their long history, offer simplicity. "Because defects scale with complexity, simpler systems are less likely to fail," says Bill Malik, vice president of infrastructure strategies at Trend Micro.

Historically, analog controls have underpinned disaster recovery. Aleksander Poniewierski, global IoT leader and EY partner, recalls the 1960s‑70s nuclear plants: "These facilities were built with redundancy everywhere and analog bridges between systems. Security by design was paramount, even though the systems were complex to manage. It was the only viable way to address risk in such sensitive ecosystems."

Increasingly, organizations that have suffered ransomware attacks are engineering production systems that can shift from digital to manual mode. Dave Weinstein, chief security officer at Claroty, reports, "Many industrial organizations now recognize the value of preserving operational continuity. They’re asking how to rely more on manual practices and move from digital into manual mode."

As industrial enterprises adopt digital technologies to stay competitive, revisiting proven engineering practices from decades past can provide resilience and trustworthiness.

IoT World – North America’s largest IoT event brings together strategists, technologists, and implementers to explore IoT, AI, 5G, and edge solutions across industry verticals.

Book your ticket now.