“Enterprises don’t tend to look at fridges in the same light as servers, smartphones, and other traditionally connected devices,” he noted. “If anything, most IT shops have a limited view of what constitutes a connected device in the first place. That means many organizations are running connected devices, such as appliances, floor cleaners and once-dumb but now increasingly smart machines, with dangerously outdated firmware because they never identified them as connected in the first place.”
Unexpected threat to IT
As well, said Frank Dickson, principal analyst at Dickson Research, there are also corporate legal issues that may undercut cybersecurity’s need for quick action.
“CERT-FR’s own alert shows why that takes time. Before cutting a controller off the internet, it tells operators to check the insurance terms in their contract with the refrigeration provider. That one line says a lot,” he said, adding that many of these controllers are installed, monitored, and guaranteed by a contractor who depends on the data feed. The store may have neither the ability nor the authority to shut them down.
