Oneconsult (Industrial) IoT & OT Security Testing provides a comprehensive security analysis of your networked devices and operating technologies, including Industrial Control Systems (ICS), embedded systems, and wireless technologies such as Bluetooth, NFC, and LoRa-WAN. Detailed analyses provide a comprehensive view of the security posture of your IoT and OT systems. With this insight, you can proactively identify and remediate potential vulnerabilities to minimize the exposure of your systems and data.
(I)IoT devices can have a wide variety of shapes and functions. What they all have in common is an embedded system (i.e. a computer) and at least one communication module at their core. Both the system architectures (usually ARM or x86) and the interfaces (USB, Bluetooth, WiFi, LoRa, GSM/LTE, debug ports, etc.) can be diverse. Some devices also have additional control elements such as touch screens. All of these interfaces must be secured and tested to achieve a system that is secure overall. An IoT device penetration test thoroughly checks these channels and interfaces. It examines the communication with the cloud, as well as the interfaces for hidden or vulnerable functions that could be used to perform unauthorized actions or, in the worst case, allow a complete takeover of the device.
An ICS, SCADA, or DCS penetration test checks the security of devices running on OT networks. This could be a PLC, a status display, or an emergency power supply.
However, penetration testing of such systems cannot be performed with the same methods or intensity as for “normal” networks, because the historically grown components, which were developed almost exclusively based on simple functionality, often make the systems very susceptible to irregularities caused by, for example, a conventional penetration test, which can lead to the failure of entire systems if handled improperly and without care. Based on our experience and expertise in the security analysis of systems in OT environments, Oneconsult works closely with the customer every step of the way to minimize the risk of business disruption.
Coffeemakers, ticket machines, and refrigerators are connected to the Internet. Even dolls and toothbrushes now use cloud services to deliver their full functionality. And in the industrial environment (IIoT), more and more machines and devices are being connected. This makes it even more important to check the security of devices that are directly or indirectly connected to the Internet.
Oneconsult can offer support at all levels: from reviewing concepts, architectures and processes to penetration testing of IoT devices. If fundamental problems are identified at an early stage of development, improvements can be implemented without much additional effort. It is therefore advisable to subject concepts and architectures to a security review. Security vulnerabilities, especially in basic processes such as enrollment, authentication or updates, can only be fixed with great effort after implementation. Oneconsult can also check the configuration of devices or your (cloud) infrastructure. When developing firmware, both the development and deployment processes as well as the actual artifacts such as firmware images and security-relevant areas of the source code can be subjected to a security review. Other components of an IoT solution, such as mobile apps, web applications, or (customer) APIs, should not be forgotten, as they represent the public face of the IoT solution and are therefore as prominent as they are vulnerable.
Operational Technology (OT) systems are often the backbone of critical infrastructures. Examples include transportation systems, power grids, water treatment plants, surveillance and security systems, building automation, and more. These systems often have extremely long lifespans and, especially in existing facilities, are based on technologies that were developed at a time when security requirements for these devices were not an issue. In addition, these systems are increasingly connected to modern (office) networks to drive digitalization. This makes them not only vulnerable, but also more attractive targets for cyberattacks.
Oneconsult can perform the necessary checks on such environments with a comprehensive security assessment. An important aspect of this is always the overall architecture of the environment and the interfaces to IT networks, suppliers, the Internet etc., which can be performed with an architecture and configuration review without any risk to ongoing operations. More in-depth technical testing often involves various bridge and proxy systems used for access between IT and OT, where both the infrastructure and the applications used can be subjected to penetration testing. The process is always closely coordinated with the client to minimize the risk to ongoing operations.
Need to assess another technology for security risks?
Whether it is an RFID locking system, a wireless remote control, or a blockchain-connected production system, we can support you with security analyses and penetration tests.
With our services, you can increase the protection of your (I)IoT and OT infrastructures against the ever-increasing threat of cyberattacks. Oneconsult’s experts will analyze your systems in detail, identify potential vulnerabilities and provide tailored solutions.
Don’t miss anything! Subscribe to our free newsletter.
Availability Monday to Friday 8:00 a.m. – 6:00 p.m (exception: customers with SLA – please call the 24/7 IRR emergency number).
Private individuals please contact your trusted IT service provider or the local police station.
For more information about our DFIR services here:
