This is the last newsletter of the IoTAC project covering the period between June and August 2023. The project has been successfully completed and reached its goals by validating the secure IoTAC platform in 4 different service environments.

According to the mid-year update to the 2023 SonicWall Cyber Threat Report, in the first six months of 2023, IoT malware globally was up by 37%, resulting in a total of 77.9 million attacks, compared to 57 million attacks in the first six months of 2022.

This time, the number of attacks decreased in North America by 3%, but Asia and Latin America saw three-digit growths, 170%, and 164% respectively. Regarding the countries with the highest increase and decrease, the number of IoT attacks in India was up by a staggering 311% but was down by 30% in Germany.

When it comes to industry-specific figures, the good news is that government and education both saw a decline of 73%, finance and healthcare a 60% drop, and it was only the retail sector where the number of attacks was up by 13%.

You can access the mid-year update to the 2023 SonicWall Cyber Threat Report at https://www.sonicwall.com/2023-mid-year-cyber-threat-report/.

The Biden-Harris administration published the National Cybersecurity Strategy Implementation Plan (NCSIP), the roadmap to realize how the United States allocates roles, responsibilities, and resources in cyberspace.

Objective 3.2 deals with the development of secure IoT devices.

This objective includes two initiatives:

• The Administration will continue to improve IoT cybersecurity through Federal research and development (R&D), procurement, and risk management efforts, as directed in the IoT Cybersecurity Improvement Act of 2020.
• The National Security Council will identify the broad contours of a U.S. Government Internet of Things (IoT) security labeling program and an agency to lead it.

The complete NCSIP can be downloaded here.

The Identity Defined Security Alliance commissioned a survey of large US organizations on their stance toward security and identity.

With the increase in the number of identities, more businesses are suffering identity-related incidents, and are realizing that securing these identities has become a critical priority. 44% of the 529 respondents said that it is a top 3 priority for them. The main factors driving this growth are: the growing adoption of cloud applications, the rise of remote working, more mobile device usage, and more third-party relationships. Still, the leadership teams of only 49% of the surveyed organizations do understand identity and security risks and invest in protection before an incident happens.

You can find a lot more information in the Identity Defined Security Alliance “2023 Trends in Securing Digital Identities” Whitepaper that you can download here!

„The 2023 IoT Security Landscape Report” by Bitdefender and NETGEAR is based on threat intelligence sampled in 2022 by 2.6 million smart homes around the world, which are protected by NETGEAR Armor powered by Bitdefender. The report summarizes the vulnerabilities and attack scenarios from about 120 million smart home IoT devices generating 3.6 billion security events.

In the US, households have an average of 46 devices connected to the Internet, while in Europe, this number is 25 devices. These home networks see an average of 8 attacks against devices every 24 hours!

Smart TVs are the most vulnerable devices, with 52% of IoT vulnerabilities identified by Bitdefender affecting them. Smart plugs, which monitor energy usage, are the second most vulnerable device, accounting for 13% of identified IoT vulnerabilities.

Most of the attacks relied on already known common vulnerabilities and exposures, but it takes time to deliver fixes for the devices already deployed in smart homes, and this gives cybercriminals a window of opportunity.

Denial of Service remains the number one attack type with over 84% of all incidents recorded.

The full Bitdefender – NETGEAR report can be downloaded at https://www.bitdefender.com/files/News/CaseStudies/study/429/2023-IoT-Security-Landscape-Report.pdf.

The CYRENE project organizes a virtual workshop, focusing on Cybersecurity and Supply Chain Security Standardization, on the 16th of June 2023, from 10:00 AM to 5:00 PM (CET).

The workshop will feature SDOs – ISO, ENISA, NIST, CEN CENELEC, and ETSI – and seven H2020 cybersecurity and supply chain security projects – CYRENE, BIECO, MEDINA, SIFIS HOME, SANCUS, ASSURED, and IoTAC.

The IoTAC results in standardization and certification to strengthen the security of the IoT will be presented by our colleagues Marija Jankovic from our partner CERTH, and Sascha Hackel, from our partner Fraunhofer FOKUS.

You can find the agenda and register at https://www.cyrene.eu/cyrene-standardisation-event/!

This is the 8^th edition of the IoTAC Newsletter. These publications already have a long history as we are approaching the end of the project. In this edition, we cover the months of March, April, and May 2023 and give an overview of our activities and progress.

IoT Analytics’ “State of IoT—Spring 2023” report shows that the number of connected IoT devices grew by 18% in 2022 to 14.3 billion and this number is expected to grow by 18% to 16.7 billion in 2023.

The market is primarily driven by industrial IoT projects and Industry 4.0 initiatives.

The report discusses in detail the current developments in the IoT market, like the predominantly positive outlook for the second half of 2023; the consolidation of the IoT platforms market, as several major companies discontinue their offerings, leaving Microsoft Azure IoT and AWS IoT to cater for the generic IoT platform market; and the struggle of IoT start-ups for funding.

You can read the report summary at https://iot-analytics.com/number-connected-iot-devices.

Sectrio published its OT and IoT Threat Environment Landscape Analysis Report 2023.

The report has been prepared from threat intelligence gathered by Sectrio’s honeypot network in over 80 cities across the world, including over 8000 physical and virtual devices covering over 4000 device architectures. Over 18 million attacks a day are registered across this network, which are then marked according to a threat rank index, developed by Sectrio.

Cyberattacks globally grew by 188% in 2022, and over 95% of all businesses were exposed to cyberattacks of one form or other, from Business Email Compromise to data theft and loss of assets and capital investments. The number of phishing emails intercepted by Sectrio’s threat research team has gone up by 779 percent in 2022. The threat surface area expanded, as with the unchecked addition of untested devices with questionable supply chain origins and lack of security audits and testing, it was only a matter of time before these devices and networks turned into an opening for malware and hackers to exploit.

Attacks on non-traditional sectors such as agricultural farms and renewable energy projects have grown at unprecedented rates. Such attacks are designed to increase the rate of inflation in select countries by increasing energy and food prices.

AI-powered cyberattacks are evolving at a frightening pace and the report reveals many aspects of how hackers use AI to improve cyberattacks.  Still in its early days but in the next few years, hackers will deploy AI to identify potential targets for cyberattacks, as well as use a wide array of datasets and tools. From an execution standpoint, by the end of 2023, we will see the entire lifecycle of an attack being managed entirely through AI-based tools. Right now AI is being used by hackers in a few areas of the overall lifecycle of an attack and this will change soon.

You can download the very detailed report with plenty of graphs and insights at https://sectrio.com/iot-security-reports/2023-ot-iot-threat-landscape-report/.

Cybersecurity agencies of the US, UK, Canada, Australia and New Zealand have joined forces and published their Cybersecurity Best Practices for Smart Cities guide. It provides recommendations to balance efficiency and innovation with cybersecurity, privacy protections, and national security.

Smart cities have the potential to offer communities cost savings and the potential to make everyday life safer and more resilient for citizens, but these benefits must be balanced with the risks.

These risks include an expanded and interconnected attack surface, risks from the supply chain, and vulnerabilities that can be introduced by automating infrastructure operations.