This work is licensed under Creative Commons
Attribution-NonCommercial 4.0 International (CC BY-NC
4.0). To review a copy of this license, visit https://
creativecommons/licenses/by-nc/4.0/
The views expressed are those of certain participants in
the discussion, and do not necessarily reflect the views of
all participants or of the World Economic Forum.
REF 160418
Contents
3 Executive Summary
4 Background
5 Requirements and Opportunities for the Network
7 Protocol Objective and Key Drivers for Impact
9 IIoT Safety and Security Protocol
A.Line of Business IIoT Device Safeguards
B.Internal Governance and Risk Management
C.Record-Keeping and Metrics
12 Implementation of Protocol
13 Appendices
Awork of Experts
B.Incident Exposures and Insurance Types
C.Relevant Definitions
D.Responsibility Assignment Matrix
E.Indicative Chart of IIoT Resources
Protocols are defined as informal norm-setting frameworks that are
accompanied over time by (1) detailed specifications, (2) operational processes,
(3)implementation guidelines, (4) verification instruments, (5) maintenance
procedures, and/or (6) conflict/dispute resolution mechanisms.
The implementation and success of this Protocol will require the active
participation of key stakeholders across the IIoT ecosystem.
3Industrial Internet of Things
Executive Summary
The World Economic Forum has convened a network of experts to support the growth of a secure
and reliable industrial internet of things (IIoT). These experts (the Network) are drawn from the
business strategy, critical infrastructure, insurance, manufacturing, policy, security research and the
technology communities. The Network recognizes that the vulnerable state of safety and security
within this exponentially growing sector is untenable and has identifed a number of challenges in the
development of an optimally secure IIoT. It has focused on actionable solutions to those challenges.
The Network has developed a protocol framework through which actors can be aligned on the
shared responsibility that ensures the security of IIoT products, practices and infrastructure. The IIoT
ecosystem is not controlled by any particular stakeholder, neither is there a single discernible category
of actors encharged with primary responsibility for its governance. When the risk of harm is so widely
spread, public safety and preventive security can only be meaningfully addressed with a collective
commitment to the mutual obligations of confronting the challenges of a complex interconnected
environment.
The IIoT Safety and Security Protocol (the Protocol) generates an understanding of how insurance,
which plays an integral part in the incentive structures of cybersecurity norm-setting and governance,
can facilitate the improvement of IIoT security design, implementation and maintenance practices. The
framework is intended to strengthen security IIoT services using active hardening processes that can
be validated through proven penetration, confguration and compliance techniques.
4Industrial Internet of Things
programmability, latency levels, reliability, resilience,
automation and serviceability.
As IIoT transforms previously isolated systems to a
connected network that is intertwined with our day-to-day
lives and businesses, it creates new critical dependencies
on the robust functionality of that infrastructure. IIoT brings
the familiar and ever-increasing digital risks associated
with cybersecurity into physical spaces, creating a vast
array of new vulnerabilities including threats to public
safety, physical harm and catastrophic systemic attacks on
commonly shared public infrastructure. Known IoT security
vulnerabilities are widespread, spanning from low-end
consumer devices to large-scale industrial systems. The
attack surface for bad actors willing to exploit the digitally
networked environment now penetrates not only the home
with the popularity of consumer devices but also spreads
across the transport and other municipal systems of our
smart cities and permeates the increasingly connected
manufacturing foor in core production processes. The
potential impact of an attack on critical infrastructure would
be far-reaching, extending deeper into more and more vital
aspects of our economy, health, safety, public services and
national security. Security, therefore, looms as the critical
challenge for the products, systems and services that are
dependent on IIoT, if not the viability of IIoT itself.
The time when decisions about cybersecurity risk exposure
can be postponed has already passed. The Mirai botnet
virus, which targeted “zombie” legacy IoT devices which
were not being updated regularly, enabled the mounting
of massive distributed denial of service (DDoS) attacks
using an army of IoT devices to take down internet
access across multiple ISPs and websites. The potential
risk of harm, which now extends beyond information
interruption to cyber-physical critical infrastructure, has
already demonstrated the exponential impact on mass
populations in multiple cyberattacks over the past several
years in Ukraine. In the summer of 2017, a cyberattack that
started on Ukrainian government and business computer
systems, utilizing ransomware for owners to regain
access to their computers, cascaded on to impact energy
companies, gas stations, railroads, the airport and other
critical infrastructure. Previously, in late December 2015, a
multipronged attack on the Ukrainian electrical utility control
system brought down the power grid in three provinces in
Ukraine, resulting in power outages that lasted up to six
hours and affected 225,00 customers.
The exposure to liability for the private sector for the
insecurity of IoT devices is also now evident, as suggested
by the lawsuit fled by the Federal Trade Commission (FTC)
against D-Link Corporation for the misleading advertising
of its security and the company’s failure to address security
faws. Government agencies, IoT companies, and security-
focused interest groups – including the Network – are all
working to identify the full breadth of IoT security challenges
and defne frameworks and principles to address them.
Background
The internet of things (IoT) presents new opportunities for
societal transformation through technology, especially for
enterprises that harness the promise of IoT to improve
business processes and for governments that look to IoT
to improve infrastructure and the provision of vital services.
Indeed, IoT has been heralded as the harbinger of the
Fourth Industrial Revolution (a digital revolution characterized
by the fusion of technologies, blurring the lines between the
physical, digital and biological spheres), with the potential to
impact industries at a scale equal to prior advancements in
steam, electrical, nuclear and computing power.
The impressive growth of connected devices and IoT
operates within a continuously evolving cyber-physical
environment, with innovators and entrepreneurs pushing
the boundaries of IoT’s potential. This dynamic rate of
change, however, also emboldens malicious actors to
develop new and increasingly sophisticated mechanisms to
exploit vulnerabilities that are both unique to IoT systems,
or are imported with the vulnerable components, devices,
or systems that are used as part of IoT services. The sheer
scale and inextricable interconnectedness of IoT further
compound the safety and security risks into actual physical
threats, exposing the potential for catastrophic harm.
The industrial internet represents one of the most promising
and transformative applications of IoT. The Industri