Cyber attacks, White (Thales): «From smart TVs to robot vacuum cleaners, today any connected device can become a target»

After the cyber attacks on supermarket refrigerators that recently occurred in Europe, everything has changed on the security front.

«Today any connected device can become a target», explains Christophe Bianco, Vice President of Cyber ​​Services at Thales, who met a group of journalists in a call, including Il Sole 24 Ore.

«Thales works a lot on the protection of systems such as connected cars, energy monitoring devices and other products in which security is particularly important due to the possible consequences on people's lives. But many older IoT devices in our homes can be attacked with relative ease. Just find a vulnerability in a popular product: a connected camera, a robot vacuum cleaner or a smart TV. It wouldn't surprise me to see similar cases in the coming weeks."

The Nordic countries and electric heat pumps

Starting, for example, with electric heat pumps, very widespread in Northern countries, also thanks to public incentives. The risk is transversal.

"Certainly. Anything connected could be. We don't know for sure who is behind this campaign; There are hypotheses of geopolitical motivations. But a significant portion of cybercriminals act opportunistically. Perhaps they hadn't even thought before that using a connected refrigerator could produce a similar impact. Now, however, they have seen that it is possible and relatively simple. It wouldn't surprise me if other criminals, for fun or to get small sums of money, started looking for vulnerabilities in similar products."

«If heat pumps are widespread in a region - adds Bianco -, those who want to gain media visibility or cause a strong impact could look for a vulnerability in those systems. Once found, the choice is between reporting it responsibly as a security researcher or exploiting it to make money. It is this opportunistic crime that worries us today."

The sectors most at risk

It is a question of understanding whether, at present, there are sectors that are more at risk than others.

«Today refrigerators are at the center of media attention, but another topic could soon replace them - he observes -. As for vulnerable sectors, I would say: all. Why did we see supermarkets hit and not, for example, oil pipelines or energy infrastructure? In industrial and critical fields, cybersecurity is often already considered essential for the continuity of services and the safety of citizens. We also recently saw an attack against OT devices in a water system in the United States. Water networks can also be targeted. No sector is immune. I am especially concerned about organizations that have not yet recognized connected devices as a critical component of their infrastructure. Transportation, electricity, gas and energy, as well as other industries heavily dependent on physical equipment, are already aware of the need to secure OT environments. In these areas we have been working for some time to strengthen security. The problem - continues Bianco - is more pronounced in activities where IT, IoT and OT have not historically been considered central elements. Raising awareness will inevitably lead to new investments. I am thinking of small and large businesses with low margins, working on large volumes: I am not surprised that supermarkets have been targeted. Healthcare also worries us, due to the high number of connected devices. Every time you connect something to a network, you create a potential entry point for a malicious actor."

The priority

What to do? According to the manager of Thales' cyber security services, "managing obsolescence is essential.

In industry - he explains - there are often very old devices that have never been updated because they originally operated on networks isolated from the Internet. Today we connect systems designed to operate autonomously to environments where they can be accessed by malicious actors. Technologies and tools exist to isolate these networks, but risk must be included in security assessments. I am particularly concerned about small and medium-sized businesses, which often lack the resources for a dedicated team. These companies will be more dependent on regulations and safety guarantees offered by manufacturers. The message we want to spread is that top management must understand the risk they introduce into their organisation."

And he concludes: «In the case of refrigerators the consequences are visible. For a small or medium-sized business with limited liquidity, such an incident could even result in bankruptcy."