Posted on

Mikko Tepponen: CDOs are Catalysts for Change

When asked about his biggest achievements as FLSmidth’s CDO, Mikko Tepponen talks about the following:  

“We saved up to USD150 million annually for a customer by providing them with digital and optimization solutions.” Tepponen also says the data collected from FLSmidth’s sites and equipment is “the basis of many of our digital services and solutions, creating a lot of positive momentum in our digital transformation.” 

The two statements clearly show that successful digital transformation consists of three factors — digital maturity, tech investments and strong leadership. Mikko Tepponen shares why he’s excited to be FLSmidth’s CDO and walks us through the company’s digitalization and sustainability efforts.

 

What is the link between digitalization and sustainability in an organization? 

Digitalization is an enabler for sustainability from several perspectives. First, you must be able to measure sustainability goals. For example, a company with ambitious targets for the reduction of CO2 emissions. Digital tools are important in industrial settings in terms of collecting data and understanding emission levels. 

In industrial settings, the cycle time for replacing equipment or building new capacity in the market is very long. Some of the equipment used is at least 30 years old. In order to work with zero emissions and carbon neutrality, you need to have the technology ready within the next couple of years.  

But at the same time, you can already do so much today from an optimization perspective with digital tools. For example, we take a traditional cement plant and optimize it, finding energy savings of 5% to 10%. These will directly benefit the environment, forming a good business case for customers. At FLSmidth, our future rests on two pillars — sustainability and digitalization. They’re very much intertwined and you can’t have one without the other. 

 

Tell us more about FLSmidth’s MissionZero ambition and its milestones so far.

MissionZero is our central ambition in the cement and mining industries. In the cement industry, it goes back to the following questions: “How can we substitute some of the fuels needed in cement manufacturing?”, “What raw material is it produced from?”, “How do we move away from using limestone and clinker into clay?”  

Mining is quite a water-intensive and energy-consuming process. How can we use less water and lower the energy footprint within the mining industry? As a technology provider, we’re committed to having all the technology ready and available by 2030, so the two industries can become carbon neutral and emission-free.

 

What are the greatest challenges and advantages of being a CDO in a company with a 135-year legacy? 

We’re very much an engineering company and we’ve built a lot of the technologies that are behind current cement and mining processes. In an engineering culture, people are willing to try and push for new technologies and get excited about innovative projects. That is one benefit of working in a company like ours. 

In terms of challenges, I could say it’s the same thing. Every engineer likes to invent and has individual ways of working. This presents an obstacle when driving uniform technology from a process perspective.  

The related systems in the back end are not always easy when you have a mindset that everything can be tweaked to be a little different. As a CDO, you want to build a system of uniformity that can be automated and developed further.  

 

What does this legacy mean to FLSmidth’s digital agenda? 

Because we’ve been around for a long time, we have great and long customer relationships. A lot of digital innovation happens together with our customers. We also have a large installed base that spans several decades. How do you link into that installed base with technology that is decades old? 

As some of it existed before the Internet, it can be upgraded throughout the years. The heritage brings great opportunities because there is plenty of installed base and equipment that can be connected. This can bring a lot of value as we’re a company with a global heritage. We can work anywhere in the world at any time but must keep in mind the history and old systems that are in place.   

 
Find innovative ways to build a strong digital agenda through expert panel discussions and case presentations at Denmark’s Digital Advantage event.
 

How exactly is customer co-creation utilized in FLSmidth’s digital transformation journey? 

We have a standing rule when developing new digital technology. I think it holds true with a lot of our R&D efforts in traditional and digital spaces. We don’t develop anything unless there is a customer involved in that development. It is crucial, even for a technology company like us. 

We call ourselves the best in generating physical equipment and the digital services related to them. Of course, you want to have that end-user input all the time when you’re developing new services. It reduces the time to market,  helping us get the right answers quicker.

If you’re successful, you get the first references immediately. If you have the data to back it up, it’s even better. For example, this solution increases productivity by 2% or improves availability by 5%. This allows us to solve challenges and scale solutions out to the market quicker.  

There is also a lot happening with our most important customers. They’re tackling the same digital transformation challenges as us. They’re thinking about how to operate their plants more effectively. As some mine sites are located in super remote places, our customers are moving towards autonomous operations. What role can we play in helping them with that technology? 

 

What are the biggest challenges when it comes to integrating digital tools across all business functions?   

Many industrial companies such as OEMs and manufacturers of industrial goods have grown through a series of acquisitions, resulting in a mixed landscape of solutions and systems. At the same time, there is the integration of different cultures, processes and ways of working. It becomes a challenge if there is no clear focus on harmonizing your processes.  

At FLSmidth, we had a holding company structure that consisted of product companies and small entities. We’re making progress in standardizing global processes and that has helped us in delivering digital tools. There is still much work to be done as our enterprise architecture is quite diverse. For example, we just announced a major acquisition – which is subject to regulatory approvals – of thyssenkrupp’s Mining business, an entity with more than 3,000 employees and many locations around the world. An enterprise architecture and system landscape need to be as lean as possible to manage the additional complexity of acquisition of this magnitude.  

 

How has the CDO role evolved in the past year in terms of leadership and driving tech investments? 

At FLSmidth, the CDO is expected to be a catalyst for change as well as a technology leader. Digital organizations are used to working in agile ways and CDOs are tasked with introducing a modern and emphatical leadership style. The CDO role is a balancing act of trying to constantly push their organization a little bit more than they’re willing to. When you get a little bit of pushback, then you know you’re at the right level of trying to drive change. CDOs need to make sure that their organization is ready by taking on new ways of working. It’s an exciting time to be a CDO because I think it’s more vital than ever. 

 

*The answers have been edited for length and clarity. 

Posted on

Pandora’s CIO Peter Cabello Holmberg: Building A Hub Of Agility And Digitalization

Pandora took the business world by storm this year as the renowned international jewelry retailer successfully drove digital transformation and innovation in the midst of COVID-19 and launched the much-talked-about Digital Hub.

To find out more about the Digital Hub and Pandora’s agile aspirations, Management Events interviewed Pandora’s CIO, Peter Cabello Holmberg, winner of CIO of the Year 2020, who shared the objectives of the ‘Hub’ and its importance in Pandora’s continued digital strategy.

 
(Photo: Mikael Rieck, from Computerworld)
 

THE DIGITAL HUB

 

The Digital Hub, also known as the Hub, opened its doors in Copenhagen in July 2020. But what exactly is the Digital Hub?

 

The Digital Hub is actually a place. It’s a physical location; a full floor in a building next to our global office, where we have room for some 200 headcounts. We initially called it ‘Global Office 2’, but as we wanted to create some hype around digital and our digital strategies, we decided on ‘Digital Hub’.

Also, we were running out of space in our global office, and we had pockets of digital talents – the IT, marketing, and e-commerce teams – sitting in different places globally. That wasn’t optimal so we wanted to consolidate our digital talents in Copenhagen.

We believe that having our digital talents in the same location would help our delivery speed, and our intention was to have a new layout of office space that could facilitate agile ways of working, where people can move around and sit in teams to exchange knowledge on a daily basis.

In the early phases, we discussed building it in New York or Amsterdam, but we decided to build it next to our global office in Copenhagen because there was a need for proximity with the rest of the senior executives there. We were super lucky that we could get the office space next to our global office.

 

How did the idea of the Hub come about?

 

We’ve been working with our thoughts and aspirations on digitizing across our value teams for a couple of years. And what we realized was that we had to orchestrate ourselves differently to deliver faster on our digital aspirations.

We’ve been relying on waterfall approaches, business cases, and other methods that were very slow for us to get things started and signed off, so we needed a different operating model and a different engine room.

It was that realization – for us to deliver on our digital aspirations, have more transactions on our online channels, and improve digital marketing, omnichannel, and in-store technology – that we felt the need to bring the technology, e-commerce, and marketing teams together and implement new, agile ways of working.

 

Projects like the Digital Hub are huge investments, and getting the stakeholders’ buy-in is always a challenge. How was the project presented for the executive buy-in?

 

I went to the CEO and the executive leadership teams a year and a half or 2 years ago and said that we needed to do an IT transformation. I said that I would save money for the company, build new career duties, and introduce agile working. And I got a sign-off on that.

The CEO bought into it because we – on top of the savings – also presented strong business cases for digitalization and data-driven consumer growth that were very attractive with significant incremental revenue.

 

AGILE WORKING AND CHANGE MANAGEMENT

 

After getting the sign off on introducing agile ways of working, how did you start its implementation?

 

We did a number of introduction sessions before we did anything else. We talked about what agile is, its meaning and principles, and the choice of methodology, and introduced the terminology. We also did a few proofs of concepts, small projects that we would normally put into an agile release train (ART), and applied agile ways of working, like scrum meetings.

Other than that, we had meticulous discussions about Spotify and SAFe, and supporting tools for agile ways of working. We initially made a decision to go with both models, which was a mess for us. Now we’re back to the principle of one model.

We made some decisions along the way that were just wrong. So when we went live, we went in knowing that we had to learn if the decisions and changes worked and asked everyone to give feedback so that we could adjust on areas that didn’t work.

 

Major organizational transformations can be difficult to execute smoothly. How did Pandora handle the change management?

 

This was a massive change management exercise, but we knew we had to shift our ways of working completely.

So we gave people a flavor of how this change would look. We started to talk about what an ART should be like and introduced new and different roles to both the business and organizations. We pieced it step by step, presenting increasingly more elements of agile working.

There was change management happening both bottom-up and top-down, but at some point, we came together and communicated to everyone involved that ‘This is how it’s going to look, and here are the members of the Arts’.

We communicated the incoming change to all parts of the organization with 50 to 70 lightning talks about agile working held for all the employees to participate. More than 1,200 people from the entire business signed up to learn about it.

Even when we went live with our first ART, we continued having lightning talks because more and more people wanted to know about it.”

We try to stay as open and transparent along the way so that everybody knows what was happening. It was a lot of communication on where we were, what was happening next, and what to expect.

 

HIRING AND TALENT MANAGEMENT

 

With all the transformation initiatives, what were the responses from the teams and employees?

 

The interesting thing is, as we implemented the agile ways of working, our churn rate of people in IT, marketing, and e-commerce leaving Pandora has gone down. Even though we did this massive transformation, the turnover rate has decreased.

From what I’ve seen and heard, people are actually quite excited to try agile working. They want to see how it works. Some have already tried it and are super happy with it. And those who have always worked in traditional waterfall approaches are keen to learn about agile ways of working because everyone’s talking about it.

 

With about 200 employees working on a collective digital strategy, how does the Hub ensure that decisions and responsibilities are delegated to the right people and teams?

 

We have a number of ARTs now, and the biggest and most mature one is our consumer ART.

Whatever the team does in this agile release train is tied to our business strategy, so there’s a link from the strategy to how we work with agile portfolio, lead portfolio management, and so on. So we can track from strategy to ARTs to APEX to features to use cases.

Since we have defined the ART with all the members and different roles, there’s full transparency on who’s responsible for what. Everyone knows what their role is in the whole process.

Furthermore, the tool that we use holds the overall description of the business strategy, and breaks down into the related ARTs and components, so that we’re constantly updated on the business timeline and deliveries. Hence, I would know exactly what’s going to be delivered and when. It’s pretty amazing.

 

It’s not news that Pandora has been actively hiring digital talents for the Hub. What talents are being seeked, and what hiring strategies are being used?

 

We’re hiring very different types of profiles into the Digital Hub from all over the world – Columbia, Argentina, the US, and Singapore. We want people who are creative, who have an opinion, who want to push things forward and make a difference. And because we also want to set them free with the business, we want them to be self-operating.

What we did with hiring was create hype around the Digital Hub. We had the CEO talk about the Hub when he was interviewed, and we sent out press releases and reached out to different media. We also talked to universities about what we were doing and trying to achieve and spread the word that we wanted to build a digital powerhouse in Pandora and be number 1 in our industry.

So we set the ambition level quite high, which is part of attracting talents while doing features and events and mobilizing all types of channels to spread the word.

 

What challenges did the Digital Hub encounter in terms of recruiting talents and managing the current workforce?

 

One of our bigger problems was that, when we got a ‘go’ for the Hub, it was the time when COVID-19 hit. So we had to hire these positions using Teams and Zoom since we couldn’t meet the candidates face-to-face.

We also had to go about the hiring processes in a different way because everybody was on lockdown globally, and we couldn’t fly them in and bring them to the Digital Hub. From Day One, they had to start from their home office. We sent PCs and laptops to them, and onboard them from their home and whichever country they were in.

 

Now that the Hub is completed, what initiatives is Pandora taking to ensure a functional communicative and collaborative culture?

 

The Hub initially was driven by the CDO, CIO, and our SVP for data analytics. Now that we have consolidated these functions under a CDTO then the Hub is anchored with the CDTO. We’re trying to create a community so that the Hub is seen as one team with one common purpose.

Now, the Digital Hub has its own dynamics, and there are social events, fireside chats, and town halls where people across different organizations can participate. We put these people together in one location, and what this has actually done is broken down the silos that we were experiencing previously.

We’ve been sitting on different floors, in different buildings, in different countries. Now that we have brought the teams together, they talk to each other every day – they literally sit next to each other – so it has broken down the silos between different functions. We’re much more aligned compared to before, and that is a huge improvement for us.

 

DATA AND DIGITALIZATION

 

In terms of technology and innovation, what challenges did you face with the Hub?

 

We didn’t have many challenges with our technologies and choice of technologies when we started the transformation.

We already had a roadmap on what to do with data. We had our online platform, our salesforce, e-commerce, and cloud. Our biggest challenges are with integrations, master data, and a scattered point of sales landscape. But overall, we are in fairly good shape.

 

What stage is the digital transformation of Pandora at the current moment? What other processes are underway to boost the brand’s digital experience?

 

What we have now is a pretty solid digital strategy that has been shaping up over the last 8 months or so.

We’re going all in on our user data for tips on marketing and personalization. We’re also considering communities for people who are interested in our type of jewelry, and planning to introduce a global loyalty program that will hopefully further drive brand loyalty.

The consumer ART is working with data, and working with the marketing team on digital marketing and personalization. In regards to data-driven consumer growth, we also set the teams free to use data to drive sales. By combining the different data sources that we have, such as our transactions and customer browsing data, the ART teams are free to make decisions on their own to allow faster decision-making.

 

What are the biggest differences between the company’s past and present data utilization?

 

It’s two different worlds before the Hub and after the Hub is live. The incremental revenue that is delivered from our data-driven consumer efforts is just outstanding.

We’ve built the integration between different sources in our stack, applied new technologies, and hired Ph.D.-titled profiles to work with data so that we can learn more about our consumers.

We didn’t have that data focus a year and a half ago. I think we had one person in Pandora working with data, but now we have 60+ people working only on advanced data analytics and the use of data.

 

SUCCESS AND THE FUTURE

 

What do you consider to be the key achievements of the Hub?

 
(Image: Peter Elmholt, from ZDNet)

What’s interesting is that the agile way of working that we implemented has really proven its value when the pandemic hit.

Our stock prices have gone up some 100% during 2020 when COVID-19 hit, and that’s quite amazing. It’s actually all down to our technology readiness and the shifts from physical stores to taking advantage of our online channels and digital initiatives.

We were able to step back and look at our priorities and completely change our focus, and now the rest of the business – HR, finance, and other parts of our commercial organization – want to embrace agile working because they see its value. This is just the start and we want to do even more.

Additionally, we see that we can move much faster now. Because the teams are dedicated to the agile release trains (ARTs), they’ve become very efficient and knowledgeable about their role, purpose, and responsibilities. So we’re able to come up with solutions to business strategies at a faster rate.

 

There are always expected ROIs for major projects. What is the anticipated ROI in 2021 due to the Hub?

 

When we first started, my focus, and marketing’s focus, was on revenue-generating and return on investment. It was clear when we went to our CEO that what we proposed was very attractive and that data-driven consumer growth, meaning advanced data analytics alone, would pay for our Digital Hub. And we still have many other initiatives that we’re driving.

In some cases, in terms of ROI, we’re talking about a factor of 10 of the investment. Also, our stock prices have gone up significantly because we took advantage of our online channels and digital initiatives. I think that alone shows the impact of getting digital right.

 

What are the upcoming plans and strategies for the Digital Hub and Pandora?

 

We are in the middle of finalizing our digital strategy for the next 3 to 5 years. We never had a digital strategy before, but now we have it, and it sets the direction for our technology investments across our value chain – where we want to invest our bodies and resources.

Also, we’re focusing on how we can take agile working and our technology operating model to the next level. Yes, we started out with Agile but we’ve only been live for a year or so. Now, how do we bring this further? What do we need to invest in? What kind of profiles, like what agile coaches or release train engineers, do we need to bring on board to further mature our agile ways of working?

 

What commercial goals does Pandora seek to achieve in 2021? What role does the Hub play in achieving these goals?

 

Our key focus right now, and into the next 3 to 5 years, will be on revenue-generating initiatives. We want to drive even more revenue through our online channels.

Aside from that, we’re also focusing on creating an even more seamless customer journey across our different channels. We want to engage with our consumers in a more meaningful way – be more precise in what and when we communicate so that we become more relevant.

Of course, we do all of these to drive revenue, and the Digital Hub is instrumental for us to proceed with the plans.

Posted on

600Minutes Executive IT: How IT Leaders Develop Agility In Times Of Crisis

The recent 600Minutes Executive IT held by Management Events revealed in-depth insights from over 300 top-level IT executives and solution providers from leading organizations in Sweden. 

In group discussions during the virtual event, CIOs across the industries lent their thoughts and opinions on leading in the virtual landscape and through times of crisis.


 

Virtual Leadership

As known the world over, the coronavirus outbreak has brought unprecedented circumstances to the business world, from urgent business continuity planning to lengthy operational disruptions.

As C-suites sought to keep their business operations running, remote working was widely established throughout organizations. But for many IT leaders, managing and leading a remote workforce is a novel experience, and they are faced with different levels of difficulties.

 

Obstacles and Challenges

There were multiple concerns expressed by the event attendees during the group discussions.

One IT executive mentioned that it’s a challenge to keep track of how employees are doing while another stated that it’s harder to pick up on what’s going on when they, as the leader, are working away from the team. Yet another participant expressed worry on the flow of information not reaching the teams.

But among the many hurdles, face-to-face communication and socialization seem to be the most worrying aspects of remote work. Participants were concerned on how to keep the teams together when they’re no longer physically meeting or interacting with each other.

This is especially the case for new hires, whereby organizations need to ensure proper onboarding of the employees and help in building relationships with the current teams. As an IT leader aptly explained, “Now, we are riding on the current company culture from the physical office, but for new hires, there’s a challenge to transfer the silent knowledge and culture that ‘sits in the walls’.”

Stagnancy is another worrying issue among leading IT directors and C-levels as teams don’t share as many ideas or brainstorm as much as before.

As one IT leader commented, “New ideas get lost as most meetings are within the same function. It’s important to keep in contact with decision makers in other functions in order to develop new ideas.”

Other worries and issues presented during the discussions were:

  • Investing more 1-to-1 time for the same output;
  • Difficulty in following up with their teams and getting concrete actions;
  • Lack of boundaries between work and non-work, resulting in potential burnout;
  • Struggles in starting new projects; and
  • Micromanagement.
 

Positive Outlook and Solutions

Even though there are concerns with coordinating a remote workforce, a number of participants are positive that working offsite, or telecommuting, can bring good results. As one attendee stated, “[Remote work] should not be seen as a cost, but an opportunity.”


 

For instance, a decision maker participating in the group discussions claimed that due to the outbreak and subsequent remote working situation, there’s now a stronger focus on innovation, which can help companies to discover business opportunities that were once neglected.

Others corroborated with his statement, saying that the coronavirus inadvertently led to the organization gaining momentum in digitalization, and they should use the ‘new normal’ as a chance to initiate strategic changes.

One example given is the use of iPads for the company’s operators for communication and training purposes, which in the past would have taken a very long time. Others mentioned how their organization now works more digitally and has increased efficiency in some areas, and how people are more innovative without so many contradictions.

 

As an IT director said, “Productivity increases during periods where we are forced to be more innovative.”

 

Additionally, it was a general agreement among the IT leaders that working remotely led to more efficient online meetings as staff seems more prepared, with specific agendas and smooth subsequent information flow and discussions.

Even though a number of attendees voiced out the challenges they’re facing in creating a successful digitalized workforce, they also suggested solutions to overcome the hurdles.

Some of the solutions for effective and progressive remote workforce management given by the participants include:

  • Developing policies and reinforcing them;
  • Raising morale through interactive and non-work-related activities, such as music quizzes;
  • Connecting more often with peers, teams and others from the company to gain different perspectives;
  • Having more dialogues with the workforce on handling the crisis and other work issues; and
  • Scheduling fun meetings and engaging sessions, such as a virtual coffee break, to replace physical socializing.

However, given the pros and cons of working remotely, quite a few of the top executives are looking to develop a hybrid solution of working from home and office.

 

Towards A Hybrid Landscape

“Remotely, productivity remains the same, or is even better, But for some cooperation and creative process work, there’s a need for physical meetings.”


“Virtual hiring is possible. However, physical meetup is still needed to hand over computers and phones, and to provide basic training on how to perform the job.”

 

The above statements are just a few comments from IT leaders who believe in having the best of both offsite and onsite worlds, and were discussing how to maximize value and efficacy in a hybrid office landscape.

Aside from providing possible solutions to the difficulties of building team relations and maintaining the innovation and development arenas, the hybrid solution also addresses the issue of trust.

As a participant mentioned, “If you don’t see your teammates and staff every day, more trust is required,” while another explained that, “In the past, it wasn’t part of leadership to ensure that their groups do their jobs from home.”

An IT executive in the discussion suggested a day or two per week working from home with the rest of the days in the office. Such a solution not only provides the flexibility for employees needing time to take care of family and personal business, but also answers the needs for department heads to have their teams for certain face-to-face tasks.

“A flexible workforce can lead to higher productivity,” a participant asserted.

 

Moving Forward

 As a top IT executive observed, “People react differently to the changing environment and working conditions.” However, overall, it seems that employees, and even customers, have adapted to the ‘new normal’ relatively fast, and companies are witnessing faster digital transformation and innovation than before.

Perhaps it’s true what a decision maker from the IT function said during the discussion – “We need more crises to develop further.”

Posted on

Internet of Things: Imperfectly Smart Devices

internet of things

Smart technology or IoT continues to shape both consumer and industrial domains. Achievable through the convergence of multiple technologies, which include machine learning, real-time analytics, commodity sensors, and embedded systems. Companies who miss an opportunity and or fail to innovate alongside IoT face the genuine possibility of being overtaken and fail over time.

 

IoT’s most significant trend in recent years is the explosive increase in connected devices, controllable over the internet. According to Fortune Business Insights, the global IoT market size stood at $250.72 billion in 2019. Projections indicate this number will reach $1.46319 trillion by 2027, exhibiting a Compound Annual Growth Rate (CAGR) of 24.9% during this forecast period. 2020 saw a rise in the following components of the IoT model; Networks and Communication, Sensors, Data Analytics (Cloud), and Applications, with different degrees of impact.

 

IoT brings a lot of benefits and new opportunities to businesses all over the world. Environmental sensors, machine learning capabilities, and artificial intelligence platforms provide various operational services for organizations across different industries. Although there are fundamental characteristics shared by most devices, the wide range of applications for IoT technology also means that the particulars can be entirely dissimilar from one device to the next.

 

Due to the large amount and variety of connected devices, IoT continues to implant itself deeper in our lives and society, making it another prime target for cyber-attacks. According to the IBM X-Force Threat Intelligence Index 2020, Financial services remain the topmost attacked industry, closely followed by the Retail sector. Ransomware and Magecart attacks were the most prominent attacks observed against retail and impacted at least 80 reported e-commerce websites in the summer of 2019 alone. Operational Technology (OT) targeting also increased by 2000% from 2018, with more attacks on Industrial Control Systems (ICS) and OT infrastructure than in the past three years.

Operational-Technology-Attack-Trends-2020-IBM-X-Force-Threat-Intelligence-Index-Report-1

Cyber-attacks are not new to IoT; the most common breaches are spyware, malware, and human errors. The latter is critical due to the increase in phishing tactics through email. Attackers have been impersonating consumer tech brands with tempting links to trick users into clicking malicious links. Consumer Technology giants such as Google & YouTube (60%), Apple (15%), and Amazon (12%), made up the bulk of targeted spoofed domains, where attackers hit due to the monetizable data they hold.

 

An innocuous IoT device should not be run unsecured. Therefore, both users and manufacturers need to accentuate and take cyber defense seriously. Thus, resulting in the real need to systematically understand the threats and attacks on IoT infrastructure to secure IoT devices against attackers. This article attempts to identify threat types, analyze, and describe intruders and attacks facing IoT devices and services.

 

Brute-forcing and Poor Passwords

IoT devices often require passwords for users to access and or control the device. According to Cybernews, the most common passwords worldwide are “123456”, “123456789”, “qwerty”, and the word “password” itself.  Weak passwords place your most sensitive information at risk and are similar to not using any password in the first place.

Weak Passwords

Manufacturers typically provide IoT devices with preset login credentials, making setup easier and consumer-friendly. These preset credentials are often openly available from a single web search and easily broken during brute-force attacks. Thus, IT administrators must replace the preset login credentials with significantly stronger credentials. The recommended way to go about this is to create quality passwords unique to the organization or the device and utilizing password managers.

An additional step would be to enable or implement two-factor authentication (2FA). Doing this instantly increases the security level by creating an additional lock that an attacker is less likely to access.

 

Improper Data Transfer and Management

IoT devices make automated decisions and carry out actions without requiring human-to-human or human-to-computer interaction. Thus, it is vital to the integrity of IoT applications that the source(s), data being fed, and produced are protected and verifiable at both ends. To achieve this, data must be encrypted from creation to consumption. However, this typically requires a higher level of encryption, cryptology, and intelligence than is easily achievable by the conventional one-way Transport Layer Security (TLS) encryption.

 

Furthermore, dynamic keys should be employed that ensure each data payload is encrypted with single-use keys that are not stored on the device itself or shared over the network, particularly over an insecure network.

 

Insecure Network

IoT devices require an active network connection to allow endpoints to communicate with each other over the internet. As a result, one of the initial and simplest attack methods a malicious attacker can deploy is to seek out weaknesses in running network services and the network communication model of connected devices.
training & skills acquisition
Attackers attempt to manipulate several vulnerabilities to obtain login credentials, communication tokens, and other identifiers that the Service Ecosystem uses to identify various endpoints. It is crucial to secure endpoints with industry best practices to protect data integrity, privacy, and Man-In-The-Middle attacks (MITM). One method involves encrypting device authentication data at the data-level paired to the public key. Consequently, any captured data should remain unreadable without the equivalent private key.

 

Unsecure Update Process

Firmware and other software patches are often required to be pushed out to IoT devices to prevent them from being compromised or left in a vulnerable state. Organizations have to upload these updates securely to each endpoint as soon as they are made available. Failure to secure access to the update, verify the sources, and integrity can have physical consequences, resulting in data loss and corrode brand reputation, introducing legal liability.

 

Even if vulnerabilities and loopholes are identified, not all IoT devices can be updated securely, and this may be due to the following reasons.

  • Wrongful or no firmware validation.
  • Updates are delivered in plain text or without encryption.
  • No anti-rollback measures
  • Users are not notified of available updates. This is a fairly common occurrence.

 

Implementing anti-rollback update mechanisms can prevent attackers from downgrading a device to an older software version with a known security vulnerability that the attacker can exploit.

 

Inadequate Privacy Protection

IoT devices, by design, collect and store a significant amount of users’ personal information. Unfortunately, not all manufacturers implement strong privacy or data management and protection policies. Those that do tend to begin by encrypting and implementing various layers of distinct checks and balances, providing data security between endpoints. When these security and privacy protection models are absent, improperly installed, or set up, glaring issues crop up.

 

One such example of improperly set privacy controls by the manufacturer was the TRENDnet Webcam Hack. TRENDnet marketed their SecurView cameras for various uses ranging from home security to baby monitoring and claimed they were secure, the FTC said.
Data Protection=However, they had faulty software that let anyone who obtained a camera’s IP address look through it — and sometimes listen as well. Thus for at least two years (2010 – 2012), the SecurView webcams allowed the transmission of user login credentials in clear, readable text over the internet! It did not just end there. Even their proprietary mobile app for the cameras stored users’ login credentials in clear, readable text, right on their mobile devices allowing anyone who obtained a camera’s IP address to look and sometimes listen through it as well.

 

Insecure Ecosystem Interfaces

The IoT ecosystem comprises all the components that allow consumers, governments, and businesses to network between their IoT devices. Some of these include networks, data storage, remotes, security, dashboards, and data analytics. Interfaces like a backend API that devices use to connect to a larger network ecosystem can also be compromised. A significant security concern to network operators and manufacturers is 5G network technology, which is expected to shoulder the connectivity load of IoT devices.

 

IoT devices, when integrated with centralized management platforms and legacy systems, are at high risk of being compromised by users who unknowingly introduce security vulnerabilities at the application layer. When such interfaces are compromised, it is often due to the previously mentioned reasons and improper traffic filtering.

 

Conclusion

Should an IoT vendor build its device or devices with insecure software libraries or other elements that are from an insecure source, then the device(s) will logically be insecure. Other means include using third-party software and hardware from a compromised supply chain or the insecure customization of Operating System (OS) platforms.

 

Manufacturers must comprehend that as more IoT ecosystems are being built, it is equally imperative to build security in, right from the very start. From sourcing components to firmware writing, initial installs, and throughout a device’s lifecycle. Thus, as more and more IoT connected devices come online, these and other yet undiscovered vulnerabilities need to take center stage.

 

Alongside poor management practices, targeted malware, and weak IoT architecture, IoT devices and technology can also be exploited through hard to detect zero-day vulnerabilities. Attackers continue to modify their malicious code to obfuscate better and spread within networks faster. Some of the better practices that should be applied to IoT technology include not over connecting your systems, not trusting a compromised device, particularly if it was compromised locally, and for vendors, frequently subjecting your code and hardware to third-party penetration testing (Black & White Box variants).

Consumer vs Enterprise IoT Attacks

In the future, a significant feature of IoT devices will be the ability to rapidly modify device configurations through remote tools and deliver innovative applications and capabilities. Additionally, all control updates, and packages, will include increased security and encryption to block attacks while driving more automated deployments.

 

The goal remains to enable a user at a local site with little to no background or understanding of IoT and IoT edge devices to connect a power cord, network cable(s), and walk away. Allowing the device to carry out self-provisioning and authentication automatically. Likewise, should a need to move the device occur, it can self-provision itself to its new location’s conditions and obligations.

 

Posted on

Dany De Budt: Smarter & Simplified Digital Transformation

The virus outbreak has pushed many companies to hasten the digitalization of their processes, especially with their back-office functions.

Facing challenges such as manual processes, paper-reliant procedures and limited operations visibility, C-suites are quickly realizing that their systems are in dire need of a digital overhaul.

Dany De Budt, Country Manager of the Benelux for Basware, shares how digitalization solutions help companies maintain continuous cash flow and business continuity even through the worst of times.

A SNIPPET OF BASWARE

A provider of cloud-based purchase-to-pay and e-invoicing software, Basware has helped to simplify invoicing and streamline procurement processes for clients in over 50 countries.

Offering services such as e-Procurement, AP automation and analytics, Basware’s solutions have been widely recognized by Gartner, IDC, Forrester Research and more.