RESEARCH

IoT and IIoT
Security Survey
What More Connected Devices Mean for Industrial Security
MARCH 2021

FOUNDATIONAL CONTROLS FORSECURITY, COMPLIANCE & IT OPERATIONS

Research Goal
The primary research goal was to understand current approaches,challenges, and opinions about security of connected devices in enterpriseenvironments including ICS, IIoT, and consumer IoT.

Methodology
Independent sources of security professionals were invited to participate
in an online survey. A variety of questions were asked on topics related toIoT. Responses were captured between March 3 and March 10, 2021.

Participants
A total of 312 qualified individuals completed the survey. All had direct
responsibility for the security of IoT devices at a company in the UnitedStates or Europe with at least 100 employees.

2COMPANIES REPRESENTED
Company Size

Industry Split

23%

33%

32%

68%
44%

100–1,000 employees

Target industries (see next chart)

1,000–5,000 employees

Other industries

More than 5,000 employees

Industries—Target and Other
Manufacturing 				
14%Energy6%
Food & Agriculture
4%
Pharmaceutical3%
Chemicals
3%
Water/Wastewater 1%
Nuclear 1%Oil & Gas 1%
Dams 0%Technology 						17%Financial Services & Insurance 			
10%Services 			10%
Telecommunications 			 9%Healthcare 		
7%
Government
4%
Retail4%
Education
2%
Other
6%

051031520

INDIVIDUALS REPRESENTEDRegion

Job Level

26%

25%

35%

65%
49%
United States

Individual contributor

EuropeTeam manager
Executive

Defining IoT
In this study, IoT (Internet of Thing) devices
referred to any device that is able to connect
to the internet, including:

Responsibility for IoT Devices
79%80» Consumer devices such as smart watches,
digital health monitors and connected homeproducts (refrigerator, speakers, smartlocks, etc.)

7060
504052%41%» Corporate IoT systems (smart buildings,logistics trackers, etc.)

30» Industrial control systems (ICS) such as
factory automation, power generation andmachinery

20
100ICS

CorporateIoT

In this study, IoT does not include traditional
connected devices such as laptops, servers,routers, or mobile phones.

Consumer
devices

All participants read and agreed to thisdefinition.

4

99% OF SECURITY PROFESSIONALS REPORT CHALLENGES WITHTHE SECURITY OF THEIR IoT AND IIoT DEVICES
What challenges does your company face with the security of IoT and IIoTdevices? Choose all that apply.
Discovering and remediating vulnerabilities		

Tracking inventory of IoT devices on the network		

60%

Validating compliance with security policies			58%

Establishing secure configurations			

56%

Detecting changes on these devices

66%			 55%

Gathering forensic data after an incident

37%

Other

1%

We don’t face any issues with IoT security

1%0102030

4050

95% ARE CONCERNED ABOUT THE SECURITY RISKS ASSOCIATED
WITH THEIR CONNECTED DEVICES
How concerned is your company about the security risk of IoT and IIoTdevices?
5%

95%

21%
42%

39%

Very concerned
Somewhat concerned

53%

Not concerned

55607080

MORE THAN THREE QUARTERS SAID THAT IOT AND IIOT DEVICES DO
NOT EASILY FIT INTO THEIR EXISTING SECURITY APPROACH
Which of the following statements best represents your personal security
philosophy?

22%
IoT and IIoT devices easily fit into our existing approach to security
IoT and IIoT devices require a different approach to security
78%

88% REQUIRED (OR STILL REQUIRE) ADDITIONAL HELP FOR IoT
AND IIoT SECURITY NEEDS
In your opinion, is your team adequately resourced for the security needs ofIoT and IIoT devices across your company?

9%

12%

88%
Yes, our existing team is more than capable with existing skillsets

27%

Yes, but we’ve required additional help (training, hiring, consultants, etc.)
No, but we have a plan to get there
52%

No, we don’t and we’re not sure what we need to do6

88% FOLLOW SOME KIND OF SECURITY STANDARD OR FRAMEWORKWhat security standards or frameworks does your company follow? Choose
all that apply.
PCI		

50%

NIST			50%CIS			MITRE

19%ENISA

10%NERC CIP

8%

Other

3%

We don’t follow specific securitystandards or frameworks

37%

Other

12%
01020304050

Most common: ISOAlso HIPAA; HITRUST; CSA; native Dutch

AND MOST OF THOSE THAT FOLLOW SECURITY STANDARDS ARE AUDITED FOR THEM
Is your company audited for compliance with these security standards?
28%

No
72%

Yes

By Company Size (# of employees)
17%

29%

34%
66%

100–1,000 Employees

71%

1,000–5,000 Employees

783%

More than 5,000 Employees

INDUSTRIAL PROFESSIONALS ACROSS TARGET INDUSTRIES* BELIEVE
THEY WOULD BENEFIT FROM EXPANDED ICS SECURITY STANDARDS
What types of devices do you think would benefit most from expanded security
standards? Choose the one answer that most closely applies.
Target industries*
11%
23%

Consumer IoT devices
Corporate IoT systems
Industrial control systems (ICS)

37%
30%

There is no difference

Other industries
12%
Consumer IoT devices
33%
17%

Corporate IoT systems
Industrial control systems (ICS)
There is no difference

39%*Manufacturing, energy, farm & agriculture, oil & gas, pharmaceutical, chemical, nuclear, and water/wastewater

897% OF ALL RESPONDENTS HAVE CONCERNS ABOUT SUPPLY CHAIN SECURITY
What concerns do you have about security risks within your supply chain?
Choose all that apply.
Limited visibility into changes in the security ofvendors in the supply chain				Unable to fully monitor connected items entering ourcontrolled environments		

Process for evaluating new vendors is bureaucratic
and ineffective		

68%

All respondents

61%

Target industries

59%
53%

39%
35%

34%

37%

50

60

34%		 40%

Partners have too much access to our systems
Other

1%
2%

We don’t have any concerns about risk in our supplychain

3%
4%
01020

Other3040“Vendor is compromised but not aware they’ve beenbreached, à la SolarWinds.”

97080

87% AGREE THAT EXISTING IOT SECURITY GUIDELINES PUT THEIR SUPPLY CHAIN SECURITY AT RISK
Please indicate your agreement with each of the following statements.

2%

11%

29%

Strongly Agree
Agree somewhat

I worry about security risk to our supply chain basedon existing IIoT security guidelines

Disagree somewhat
Strongly disagree

58%

8%
18%

30%

The government needs to step up and deliverconsistent security guidelines for connected devices

44%

8%

17%

21%
It feels like our business leaders want us to connect
everything to the internet
53%

1059% REPORT THAT BUDGET FOR MANAGING SUPPLY CHAIN
SECURITY INCREASED IN THE PAST YEAR
In the past year, how has your security team’s budget for managing thesecurity of your company’s supply chain changed?
1%
3% 8%

59%
Increased dramatically
Increased somewhat

36%
No change
51%

Decreased somewhatDecreased dramatically

99% REPORT THAT THEIR SECURITY TEAMS DO REFUSE REQUESTSTO CONNECT DEVICES; 43% SAY THEY OFTEN DO
How often does your security team refuse a request from an employee toconnect a device to your corporate network?
1%
7%

17%

Never
Rarely36%

Occasionally39%

Frequently
Constantly

11

Tripwire is the trusted leader for establishing a strong cybersecurity foundation. We protect the world’s
leading organizations against the most damaging cyberattacks, keeping pace with rapidly changing techcomplexities to defend against ever-evolving threats for more than 20 years. On-site and in the cloud, ourdiverse portfolio of solutions find, monitor and mitigate risks to organizations’ digital infrastructure—allwithout disrupting day-to-day operations or productivity. Think of us as the invisible line that keeps
systems safe. Learn more at tripwire.com
The State of Security: News, trends and insights at tripwire.com/blog
Connect with us on LinkedIn, Twitter and Facebook©2021 Tripwire, Inc. Tripwire, Log Center/LogCenter, IP360, Tripwire Axon and others are trademarks or registered trademarks of Tripwire, Inc. All other product and company
names are property of their respective owners. All rights reserved.
BRDRCDS1a2103