Cyberattacks, Bianco (Thales): ‘From smart TVs to robot vacuum cleaners, any connected device can be a target these days’

Following the cyber attacks on supermarket refrigerators that took place recently in Europe, everything has changed on the security front. “Today, any connected device can become a target,” explains Christophe Bianco, Vice President of Cyber Services at Thales, who spoke to a group of journalists during a conference call, including Il Sole 24 Ore. “Thales works extensively on protecting systems such as connected cars, energy monitoring devices and other products where security is particularly important due to the potential consequences for people’s lives. But many older IoT devices in our homes can be attacked with relative ease. All it takes is to identify a vulnerability in a widely used product: a connected camera, a robot vacuum cleaner or a smart TV. I wouldn’t be surprised to see similar cases in the coming weeks.”

To begin with, to give an example, electric heat pumps, which are very common in northern countries, partly thanks to government incentives. The risk is widespread. ‘Certainly. Anything that’s connected could be vulnerable. We don’t know for certain who is behind this campaign; there are theories about geopolitical motives. But a significant proportion of cybercriminals act opportunistically. Perhaps they hadn’t even considered before that exploiting a connected fridge could have such an impact. Now, however, they have seen that it is possible and relatively straightforward. I wouldn’t be surprised if other criminals, for fun or to make a little money, started looking for vulnerabilities in similar products.” “If heat pumps are very widespread in a particular region,” adds Bianco, “anyone wanting to gain media attention or cause a major impact might look for a vulnerability in those systems. Once found, the choice is between reporting it responsibly as a security researcher or exploiting it to make money. It is this opportunistic criminality that concerns us today.”

The question is whether, as things stand, some sectors are at greater risk than others. ‘Today, fridges are the focus of media attention, but soon another issue could take their place,’ he observes. ‘As for vulnerable sectors, I would say: all of them. Why have we seen supermarkets targeted and not, for example, oil pipelines or energy infrastructure? In industrial and critical sectors, cybersecurity is often already regarded as essential for service continuity and public safety. We have also recently seen an attack on OT devices in a water system in the United States. Even water networks can be targeted. No sector is immune. I am particularly concerned about organisations that have not yet recognised connected devices as a critical component of their infrastructure. Transport, electricity, gas and energy, as well as other sectors heavily reliant on physical equipment, are already aware of the need to protect OT environments. We have been working for some time to strengthen security in these areas. The problem – Bianco continues – is more pronounced in sectors where IT, IoT and OT have not historically been regarded as central elements. This growing awareness will inevitably lead to new investments. I’m thinking of small and large businesses with tight margins that handle high volumes: it comes as no surprise to me that supermarkets have been targeted. The healthcare sector is also a cause for concern, given the high number of connected devices. Every time something is connected to a network, it creates a potential point of entry for a malicious actor.”

What can be done? According to the head of cyber security services at Thales, ‘managing obsolescence is crucial. ‘In industry,’ he explains, ‘there are often very old devices that have never been updated because they originally operated on networks isolated from the internet. Today, we connect systems designed to operate autonomously to environments where they can be accessed by malicious actors. Technologies and tools exist to isolate these networks, but the risk must be factored into security assessments. I am particularly concerned about small and medium-sized enterprises, which often lack the resources for a dedicated team. These companies will rely more heavily on regulations and the security guarantees offered by manufacturers. ‘The message we want to get across is that senior management must understand the risk they are introducing into their organisation.’ He concludes: ‘In the case of fridges, the consequences are plain to see. For a small or medium-sized enterprise with limited cash flow, a similar incident could even lead to bankruptcy.’