9-Step Strategy to Secure Your IoT and OT with Zero Trust

In an increasingly interconnected digital landscape, the concept of Zero Trust has emerged as a major shift in cybersecurity. Originally developed by Forrester Research, Zero Trust challenges the traditional perimeter-based security model by assuming that threats can originate from within and outside the network. This approach advocates for continuous verification and validation of every user and device attempting to connect to resources, regardless of their location or network environment.

Zero Trust Principles and Applications Beyond Traditional IT Networks

At its core, Zero Trust revolves around the principle of “never trust, always verify.” This means that organizations should not automatically trust any user or device, even if they are inside the corporate network perimeter. Instead, access decisions should be based on multiple factors such as user identity, device health, location, and behavior.

Zero Trust principles extend beyond traditional IT networks to encompass all endpoints, users, and data regardless of their location—be it on-premises, in the cloud, or in hybrid environments. This holistic approach ensures consistent security enforcement and reduces the attack surface by segmenting and controlling access to resources based on business needs and security policies.

Relevance and Challenges of Applying Zero Trust to IoT and OT Environments

IoT and OT environments present unique challenges that traditional security models often struggle to address. IoT devices, ranging from sensors and actuators to smart appliances and industrial control systems, typically operate with limited processing power and security features. They are designed to function autonomously and communicate over various protocols, which can complicate security management.

Operational Technology (OT) systems, on the other hand, manage critical infrastructure such as power plants, manufacturing lines, and transportation systems. These systems are often characterized by legacy equipment, proprietary protocols, and long lifecycles, making them vulnerable to cyber threats if not adequately secured.

Applying Zero Trust principles to IoT and OT environments requires adapting these principles to accommodate the unique characteristics and constraints of these systems. Challenges include ensuring compatibility with diverse device types and protocols, managing scalability in large-scale deployments, and integrating with existing operational workflows without disrupting critical processes.

Mapping Zero Trust Principles to IoT and OT

How Zero Trust Principles Apply to IoT and OT Devices

Zero Trust principles such as least privilege, micro-segmentation, continuous authentication, and encryption play a crucial role in securing IoT and OT devices:

Least Privilege: Devices and users are granted only the minimum permissions necessary to perform their tasks, reducing the potential impact of a compromised device.
Micro-Segmentation: Network segmentation is implemented to isolate IoT and OT devices into distinct zones based on security policies. This limits lateral movement of threats and contains potential breaches.
Continuous Authentication: Rather than relying solely on static credentials, continuous authentication ensures that ongoing verification of device identity and behavior is performed throughout the device’s lifecycle.
Encryption: Data transmitted between IoT and OT devices and backend systems is encrypted to protect against eavesdropping and data tampering.

Differences and Similarities Compared to Traditional IT Networks

While Zero Trust principles apply universally, their implementation in IoT and OT environments differs significantly from traditional IT networks:

Device Diversity: IoT environments encompass a wide array of devices with varying capabilities, communication protocols, and security postures. OT systems often involve legacy equipment that lacks built-in security mechanisms, requiring additional measures to secure communications and access.
Operational Constraints: IoT and OT devices are often deployed in harsh environments or remote locations where maintenance and updates can be challenging. Unlike traditional IT networks where endpoint management is centralized, IoT and OT devices may require specialized tools and techniques for secure deployment and maintenance.
Risk Management: The interconnected nature of IoT and OT environments amplifies the potential impact of security breaches. Compromised devices can disrupt operations, compromise safety, and result in significant financial and reputational damage. Therefore, risk management strategies must account for these unique risks and vulnerabilities.

Identifying IoT and OT Security Challenges

Specific Security Challenges Faced by IoT and OT Environments

IoT and OT environments present a range of security challenges that stem from their inherent characteristics and operational requirements:

Legacy Devices: Many IoT and OT systems operate on legacy devices that were not designed with security in mind. These devices may lack basic security features such as encryption, secure boot mechanisms, or regular firmware updates, making them susceptible to exploitation by attackers.
Diverse Protocols: IoT devices communicate using diverse protocols, often proprietary or industry-specific, which complicates standardization and interoperability. Securing these communications requires protocols that may not support modern security standards or encryption methods.
Lack of Standardization: The absence of universal security standards and best practices across IoT and OT industries complicates security efforts. Each sector—whether it’s healthcare, manufacturing, or utilities—may have its own set of regulations and security requirements, leading to fragmented security implementations.

Impact on Security Posture and Risk Management

These challenges collectively impact the overall security posture and risk management strategies in IoT and OT environments:

Increased Attack Surface: The proliferation of connected devices expands the attack surface, providing adversaries with more entry points to exploit vulnerabilities and gain unauthorized access.
Operational Disruption: Security incidents in IoT and OT environments can lead to operational disruptions, downtime, and potential safety hazards. For example, a compromised industrial control system could result in equipment malfunctions or production shutdowns with significant financial repercussions.
Regulatory Compliance: Compliance with regulatory frameworks such as GDPR, HIPAA, or industry-specific standards adds another layer of complexity. IoT and OT systems must adhere to data protection regulations and privacy laws while maintaining operational efficiency and security.

Addressing these challenges requires a proactive approach to security that integrates Zero Trust principles tailored to the unique needs of IoT and OT environments. By understanding these challenges and applying appropriate security measures, organizations can mitigate risks, enhance resilience, and safeguard critical infrastructure against evolving cyber threats.

Step 1: Inventory and Classification of Devices

Conducting a comprehensive inventory of IoT (Internet of Things) and OT (Operational Technology) devices is a foundational step in implementing effective security measures. Here’s a guide on how organizations can approach this process:

Discovery Phase: Begin by identifying all devices connected to the network, including IoT sensors, actuators, controllers, and OT systems such as SCADA (Supervisory Control and Data Acquisition). Utilize network scanning tools and device discovery techniques to ensure all devices are accounted for.
Asset Inventory: Create a centralized asset inventory database that records essential information about each device, such as manufacturer, model, firmware version, serial number, IP address, and location. This database serves as a single source of truth for managing device lifecycle and security updates.
Categorization by Criticality: Classify devices based on their criticality to operations. Determine which devices are essential for core functions, which ones are secondary, and which can be considered non-critical or auxiliary. This classification helps prioritize security measures and resource allocation.
Functional Classification: Categorize devices based on their functionalities and roles within the network. For instance, differentiate between sensors that collect environmental data and actuators that execute commands based on sensor inputs. Understanding device functions facilitates targeted security policies and access controls.
Risk Profiling: Assess the inherent risks associated with each device, considering factors such as data sensitivity, potential impact of compromise, and regulatory compliance requirements. Assign risk scores or ratings to devices to prioritize security efforts effectively.

Importance of Classifying Devices Based on Criticality, Functionality, and Risk Profile

Device classification serves several critical purposes in IoT and OT security:

Risk Prioritization: By categorizing devices based on their criticality and risk profile, organizations can allocate resources more effectively. High-risk devices require stricter security controls and monitoring, whereas lower-risk devices may receive baseline protection measures.
Access Control: Classification informs access control policies, ensuring that sensitive devices and data are protected against unauthorized access. It enables the implementation of least privilege principles, where access rights are granted based on the specific roles and responsibilities of users and devices.
Incident Response: In the event of a security incident, device classification facilitates rapid response and containment efforts. Security teams can prioritize incidents affecting critical devices and apply remediation measures accordingly, minimizing operational disruptions and potential damages.
Compliance Requirements: Regulatory compliance mandates often require organizations to demonstrate adequate protection measures for critical systems and sensitive data. Device classification supports compliance efforts by ensuring that security controls align with regulatory expectations and industry standards.

By diligently inventorying and classifying IoT and OT devices, organizations lay a solid foundation for implementing a robust Zero Trust security framework that effectively mitigates risks and safeguards critical assets.

Step 2: Establishing a Zero Trust Architecture

Components of a Zero Trust Architecture Tailored for IoT and OT Environments

Establishing a Zero Trust architecture for IoT and OT environments involves integrating security measures that continuously verify and secure devices, users, and data transactions. Here’s an outline of essential components:

Micro-Segmentation: Segment the network into smaller, isolated zones to contain potential threats and limit lateral movement. In IoT and OT environments, micro-segmentation is crucial for isolating critical systems from less secure devices and ensuring that communication occurs only between authorized segments.
Identity-Based Access Controls: Implement strong authentication mechanisms that verify the identity of users and devices before granting access to resources. This includes multifactor authentication (MFA), certificate-based authentication, and biometric verification tailored to the unique requirements of IoT and OT devices.
Encryption: Encrypt data both at rest and in transit to protect sensitive information from unauthorized access and interception. Use strong encryption protocols such as AES (Advanced Encryption Standard) for securing communications between IoT devices, OT systems, and backend infrastructure.

Role of Micro-Segmentation, Identity-Based Access Controls, and Encryption

Micro-Segmentation: Reduces the attack surface by limiting communication pathways between devices and enforcing strict access policies based on segmentation. It enhances network visibility and control, allowing organizations to enforce granular security policies tailored to specific IoT and OT device groups.
Identity-Based Access Controls: Ensure that only authorized users and devices with verified identities can access resources based on predefined policies. Continuous authentication mechanisms adapt access privileges dynamically based on real-time device behavior and security posture assessments.
Encryption: Safeguards data integrity and confidentiality by scrambling information into ciphertext that can only be decrypted by authorized recipients. This protects sensitive data transmitted between IoT devices and OT systems, preventing eavesdropping and data tampering.

Establishing a Zero Trust architecture tailored for IoT and OT environments requires careful planning and integration of these components to ensure comprehensive protection against evolving cyber threats and unauthorized access attempts.

Step 3: Implementing Identity and Access Management (IAM)

Best Practices for Implementing IAM Solutions in IoT and OT Contexts

Implementing Identity and Access Management (IAM) solutions is crucial in IoT and OT environments to ensure secure and authorized access to resources. Here are key best practices to consider:

Centralized Identity Repository: Establish a centralized identity repository that stores and manages user and device identities across the organization. This repository should integrate with existing directories (e.g., Active Directory, LDAP) and support federated identity management to streamline authentication processes.
Role-Based Access Control (RBAC): Implement RBAC policies that define permissions based on users’ roles and responsibilities within the organization. Assign specific access privileges to users and devices based on their functional requirements, ensuring that only authorized actions can be performed.
Multifactor Authentication (MFA): Enforce MFA for all users and devices accessing critical resources. Require multiple authentication factors (e.g., passwords, biometrics, security tokens) to verify identities and mitigate the risk of credential theft or unauthorized access.
Continuous Authentication: Implement continuous authentication mechanisms that monitor and verify the ongoing trustworthiness of user and device identities. Adaptive access controls dynamically adjust access privileges based on real-time risk assessments and behavioral analytics.
Device Identity Management: Manage and authenticate IoT and OT device identities using unique identifiers (e.g., certificates, cryptographic keys). Ensure that each device is provisioned with a secure identity that can be verified during communication and access attempts.

Emphasis on Continuous Authentication and Adaptive Access Controls

Continuous authentication enhances security in IoT and OT environments by continuously monitoring user and device behaviors. Adaptive access controls dynamically adjust access privileges based on real-time risk assessments and behavioral analytics. This proactive approach reduces the likelihood of unauthorized access and strengthens overall security posture.

Implementing robust IAM solutions tailored for IoT and OT contexts involves integrating these best practices to establish a secure and efficient identity management framework. By centralizing identity management, enforcing strong authentication mechanisms, and implementing continuous monitoring, organizations can mitigate risks associated with unauthorized access and ensure compliance with security policies and regulations.

Step 4: Securing Device Communication

Strategies for Securing Communication Between IoT and OT Devices

Securing communication between IoT and OT devices is essential to protect data integrity, confidentiality, and authenticity. Here are strategies organizations can implement:

Encryption of Data in Transit: Implement end-to-end encryption to protect data transmitted between IoT and OT devices, ensuring that information remains confidential and cannot be intercepted or tampered with during transmission.
Authentication and Authorization: Establish mutual authentication mechanisms that verify the identities of both sending and receiving devices before data exchange. Use cryptographic protocols such as TLS (Transport Layer Security) to authenticate and authorize communication sessions.
Integrity Checking: Implement mechanisms to verify data integrity during transmission to detect and prevent tampering or modification. Use checksums, digital signatures, or hash functions to validate data integrity before it reaches its intended destination.
Secure Protocols and Standards: Use industry-standard communication protocols (e.g., MQTT, CoAP) that support encryption and authentication mechanisms tailored for IoT and OT environments. Ensure that protocols comply with security best practices and standards to mitigate vulnerabilities.

Addressing Challenges Related to Data Integrity, Confidentiality, and Authenticity

Data Integrity: Ensuring data remains unchanged during transmission is critical for maintaining the reliability and accuracy of information exchanged between IoT and OT devices. Integrity checks and cryptographic mechanisms verify data consistency and detect unauthorized modifications.
Confidentiality: Encrypting data in transit prevents unauthorized access and ensures that sensitive information remains confidential throughout its journey between devices and backend systems.
Authenticity: Authenticating devices and verifying their identities before establishing communication sessions establishes trustworthiness and prevents unauthorized devices from accessing sensitive resources.

Securing communication between IoT and OT devices requires a layered approach that integrates encryption, authentication, integrity checks, and adherence to secure protocols and standards. By implementing these strategies, organizations can mitigate risks associated with data breaches, unauthorized access, and malicious activities targeting communication channels.

Step 5: Monitoring and Behavioral Analytics

Importance of Continuous Monitoring and Behavioral Analytics in Zero Trust Environments

Continuous monitoring and behavioral analytics play a pivotal role in detecting and mitigating threats in IoT and OT environments. Here’s why they are essential:

Real-Time Threat Detection: Continuous monitoring allows organizations to observe network activities in real-time, identifying unusual behaviors or deviations from normal patterns. Behavioral analytics analyze these patterns to detect anomalies that may indicate potential security incidents or threats.
Behavioral Profiling: Create behavioral profiles for IoT and OT devices based on their typical interactions and communication patterns. Analyze deviations from these profiles to detect suspicious activities or unauthorized access attempts, triggering immediate response actions.
Risk-Based Alerts: Implement risk-based alert mechanisms that prioritize alerts based on the severity of detected anomalies or deviations. Ensure that security teams receive timely notifications to investigate and mitigate potential threats before they escalate.
Threat Hunting: Proactively search for indicators of compromise (IoCs) and emerging threats within IoT and OT environments. Use threat intelligence feeds and analytics tools to identify malicious activities or vulnerabilities that could compromise network security.

Tools and Techniques for Detecting Anomalous Behavior and Potential Threats

Network Traffic Analysis: Utilize network monitoring tools and packet analyzers to inspect data packets exchanged between IoT and OT devices. Identify unusual traffic patterns, unauthorized access attempts, or data exfiltration activities that may indicate malicious intent.
Machine Learning and AI: Deploy machine learning algorithms and artificial intelligence (AI) models to analyze vast amounts of telemetry data and identify behavioral anomalies. Train models to recognize normal behavior and detect deviations indicative of security breaches or insider threats.
User and Entity Behavior Analytics (UEBA): Implement UEBA solutions to monitor user and device behaviors across IoT and OT environments. UEBA platforms correlate diverse data sources to detect abnormal activities, unauthorized access, or suspicious user behaviors in real-time.

Continuous monitoring and behavioral analytics empower organizations to maintain visibility into IoT and OT ecosystems, proactively identify security threats, and respond swiftly to mitigate risks. By leveraging advanced tools and techniques, organizations can strengthen their defense posture and safeguard critical assets against evolving cyber threats.

Step 6: Implementing Security Automation

Role of Automation in Maintaining Zero Trust Principles Across Dynamic IoT and OT Environments

Security automation plays a pivotal role in ensuring consistent enforcement of Zero Trust principles in dynamic IoT and OT environments. Here’s how automation contributes to enhanced security:

Policy Enforcement: Automate the enforcement of access control policies, segmentation rules, and encryption standards across IoT and OT networks. Ensure that security configurations remain consistent and adhere to predefined Zero Trust principles without manual intervention.
Threat Response: Implement automated incident response workflows that detect security incidents, assess their severity, and initiate predefined response actions. Automate containment measures, such as isolating compromised devices or blocking suspicious network traffic, to mitigate threats promptly.
Vulnerability Management: Integrate automation tools for vulnerability scanning, patch management, and configuration audits within IoT and OT environments. Automate the identification and remediation of security vulnerabilities to reduce exposure to potential exploits and cyber attacks.
Compliance Monitoring: Automate compliance checks and audits to ensure that IoT and OT systems adhere to regulatory requirements and security standards. Generate compliance reports and maintain audit trails automatically to demonstrate adherence to governance frameworks.

Examples of Automation Tools and Workflows

Security Orchestration, Automation, and Response (SOAR): Use SOAR platforms to streamline incident response workflows, automate threat detection and remediation tasks, and orchestrate security operations across IoT and OT environments.
Configuration Management Tools: Implement configuration management tools (e.g., Puppet, Ansible) to automate the deployment and maintenance of security configurations, software updates, and access control policies across distributed IoT and OT devices.
Behavioral Automation: Employ behavioral automation techniques to dynamically adjust access privileges based on real-time risk assessments and behavioral analytics. Automate the adaptation of security controls to evolving threats and changes in device behavior.

By embracing security automation, organizations can enhance operational efficiency, reduce response times to security incidents, and strengthen overall resilience against cyber threats in IoT and OT environments. Automation enables proactive security measures that align with Zero Trust principles, ensuring continuous protection of critical assets and sensitive data.

Step 7: Ensuring Compliance and Governance

Ensuring compliance and governance is crucial when implementing Zero Trust principles in IoT and OT environments. Here’s how organizations can achieve this:

Regulatory Alignment: Identify relevant regulatory requirements and industry standards that apply to IoT and OT security, such as GDPR, HIPAA, NIST SP 800-53, and IEC 62443. Understand specific compliance mandates related to data protection, privacy, and cybersecurity for critical infrastructure sectors.
Policy Development: Develop comprehensive security policies and procedures that align with regulatory requirements and Zero Trust principles. Define clear guidelines for data protection, access controls, incident response, and risk management tailored to IoT and OT environments.
Continuous Compliance Monitoring: Implement automated tools and processes for continuous compliance monitoring and auditing. Regularly assess IoT and OT systems against established security policies, regulatory frameworks, and industry best practices to identify non-compliance issues proactively.
Audit Trails and Documentation: Maintain detailed audit trails and documentation of security controls, access logs, configuration changes, and incident response activities. Ensure that documentation is readily available for audits, inspections, and regulatory compliance assessments.

Importance of Continuous Compliance Monitoring and Auditing

Risk Mitigation: Continuous compliance monitoring helps mitigate risks associated with regulatory violations, data breaches, and operational disruptions. By identifying compliance gaps early, organizations can implement corrective actions to minimize potential liabilities and penalties.
Operational Efficiency: Automated compliance tools streamline auditing processes, reduce manual efforts, and ensure consistent adherence to regulatory requirements across distributed IoT and OT environments. This improves operational efficiency and resource allocation for security and compliance teams.
Legal and Reputational Protection: Compliance with regulatory mandates enhances legal protection and safeguards organizational reputation. Demonstrating adherence to industry standards and best practices instills trust among stakeholders, customers, and regulatory authorities.

By prioritizing compliance and governance within Zero Trust initiatives, organizations can strengthen their cybersecurity posture, protect sensitive data, and foster a culture of accountability and transparency in IoT and OT security practices.

Step 8: Incident Response and Remediation

Strategies for Incident Response Planning Specific to IoT and OT Security Incidents

Effective incident response planning is essential for mitigating the impact of security breaches and minimizing downtime in IoT and OT environments. Here are strategies to consider:

Incident Response Plan (IRP) Development: Develop a comprehensive IRP that outlines roles, responsibilities, and procedures for detecting, responding to, and recovering from security incidents involving IoT and OT devices. Define incident severity levels and escalation procedures based on predefined criteria.
Rapid Detection and Response: Implement tools and technologies for real-time monitoring, anomaly detection, and threat intelligence analysis in IoT and OT networks. Establish automated alert mechanisms to notify security teams of suspicious activities or potential security breaches.
Containment and Mitigation: Define containment strategies to isolate compromised devices or segments within IoT and OT environments. Implement segmentation controls, access restrictions, and traffic filtering to prevent lateral movement and limit the impact of security incidents.
Forensic Investigation: Conduct forensic investigations to determine the root cause of security incidents, gather evidence, and assess the extent of data compromise or system damage. Preserve digital evidence and maintain chain of custody for legal and regulatory purposes.

Importance of Rapid Detection, Containment, and Recovery

Minimized Downtime: Rapid detection and containment minimize operational disruptions and downtime caused by security incidents in IoT and OT environments. Proactive response measures reduce the duration and scope of potential damage to critical systems and services.
Compliance Requirements: Incident response planning ensures compliance with regulatory requirements for incident reporting, data breach notifications, and forensic investigations. Timely and accurate reporting helps mitigate legal liabilities and regulatory penalties.
Continuous Improvement: Conduct post-incident reviews and lessons learned sessions to improve incident response processes and enhance organizational resilience. Update incident response plans based on emerging threats, vulnerabilities, and lessons learned from past incidents.

By adopting proactive incident response strategies tailored for IoT and OT security, organizations can effectively mitigate risks, protect operational continuity, and uphold trust among stakeholders in the face of evolving cyber threats.

Step 9: Evaluating and Evolving Zero Trust Strategy

Strategies for Evaluating the Effectiveness of Zero Trust Implementations in IoT and OT Environments

Continuous evaluation and evolution of Zero Trust strategies are essential to adapt to emerging threats and ensure ongoing security resilience in IoT and OT environments. Here’s how organizations can approach this:

Performance Metrics and KPIs: Define key performance indicators (KPIs) and metrics to measure the effectiveness of Zero Trust implementations. Track metrics such as incident detection and response times, compliance adherence, security posture improvements, and operational efficiency gains.
Security Assessments and Audits: Conduct regular security assessments and audits to evaluate the strength of Zero Trust controls, identify vulnerabilities, and assess the overall security posture of IoT and OT environments. Use penetration testing, vulnerability scanning, and risk assessments to validate security controls.
Threat Intelligence Integration: Integrate threat intelligence feeds and security analytics to monitor emerging threats and assess their potential impact on IoT and OT security. Leverage threat intelligence to adjust security policies, update access controls, and prioritize security investments.
Adaptive Security Measures: Implement adaptive security measures that dynamically adjust to evolving threats and changes in IoT and OT environments. Use automation, machine learning, and behavioral analytics to enhance threat detection capabilities and adapt security controls based on real-time risk assessments.

Guidance on Adapting and Evolving Zero Trust Strategies

Continuous Improvement: Foster a culture of continuous improvement and innovation in Zero Trust strategies. Encourage collaboration between security teams, IT operations, and business stakeholders to align security initiatives with organizational goals and strategic priorities.
Scalability and Flexibility: Ensure that Zero Trust architectures and security controls can scale to accommodate growth in IoT and OT deployments. Maintain flexibility to adapt security policies and controls based on changes in business requirements, technology advancements, and regulatory landscapes.
Feedback Loop: Establish a feedback loop for gathering insights from security incidents, operational challenges, and stakeholder feedback. Use lessons learned from past experiences to refine Zero Trust strategies, optimize security workflows, and enhance incident response capabilities.

By continually evaluating and evolving Zero Trust strategies, organizations can strengthen their resilience against cyber threats, mitigate risks associated with IoT and OT environments, and maintain a proactive security posture aligned with industry best practices and regulatory requirements.

Conclusion

Zero Trust architecture offers a major shift in cybersecurity, specifically for IoT and OT environments, providing organizations with enhanced visibility, granular access controls, and proactive threat detection capabilities tailored for IoT and OT environments.

Key advantages include:

Enhanced Security Posture: By implementing Zero Trust principles, organizations can mitigate risks associated with unauthorized access, data breaches, and insider threats in dynamic and interconnected IoT and OT ecosystems.
Compliance Adherence: Zero Trust frameworks facilitate compliance with regulatory requirements and industry standards by enforcing strict access controls, data protection measures, and audit trails across distributed IoT and OT deployments.
Operational Efficiency: Automation, continuous monitoring, and adaptive security measures streamline security operations, reduce manual efforts, and improve resource allocation for managing IoT and OT security challenges.

As organizations continue to embrace digital transformation and adopt IoT and OT technologies, the adoption of Zero Trust principles will be crucial to safeguarding critical assets, preserving data integrity, and maintaining trust in digital ecosystems. Future advancements in AI-driven security analytics, blockchain-based identity management, and quantum-resistant encryption will further enhance the effectiveness and resilience of Zero Trust architectures.

Enterprises need to embrace Zero Trust architectures as a holistic approach to securing IoT and OT environments. By prioritizing continuous evaluation, adaptive security measures, and regulatory compliance, organizations can build robust defense strategies against evolving cyber threats while enabling innovation and scalability in their IoT/OT and digital transformation initiatives.