Ready to learn Internet of Things? Browse courses like Cyber Security for the IoT developed by industry thought leaders and Experfy in Harvard Innovation Lab.
IoT security breaches are expected to reach an all-time high, according to ChainLink’s annual predictions. It’s important to differentiate between indirect attacks, using IoT devices to conduct cyberattacks against another target, and direct attacks, where the end goal is to compromise and access the IoT device itself.
A high-profile example of an indirect attack was last year’s DDoS attack against Dyn that exploited security weaknesses in tens of millions of IoT devices to overwhelm Dyn’s DNS servers, making dozens of major internet sites like Amazon, Twitter, and Netflix unavailable.
Unfortunately, the market rewards time-to-market and lower prices over robust security for many classes of IoT devices, especially low-end devices that are commonly (and often unknowingly) hijacked to create a cyber-attack, such as IP cameras, home automation systems, home gateways, connected printers, baby monitors, and so forth. Some high-profile cases may garner negative media attention, but usually with little impact on the consumer’s ultimate decision to buy.
With direct attacks, the goal is access to the IoT device – and by extension the sensors, machines, and environment that the device is connected to. As such, this type has the potential to be even more disruptive and destructive. Criminals, terrorists, and malicious foreign governments may use connected devices to cause havoc or harm, such as hacking into a home security system to rob or kidnap someone or holding a city hostage by taking control of its traffic light or power system. In theory, this should create more motivation to secure these devices; however, too often a lack of resources or attention is given, even for high-value targets, making cyberattacks still very common.
The IoT Security Imperative asserts that manufacturers and deployers of IoT devices and systems (especially potential targets for direct attacks) have a moral obligation to vigorously and comprehensively address security. The following principles can serve as guideposts to enable stronger IoT security.
- Use a multi-layered approach —A central tenet is to have multiple layers of security, so if one layer is compromised, the intruder confronts additional layers. In an end-to-end IoT system, each component should be designed to assume that the communication channel and other components have been compromised. Further within each component, there should be multiple layers of security to the extent that resources allow it. A multi-layered approach also includes physical security on devices and for facilities.
- Design in security from the start —Rather than a ‘bolt-on’ afterthought approach, security should be designed into every component and process from the start using secure by design principles, such as hardening, using secure defaults, and failing securely. Security should be built into the entire product lifecycle, including security reviews during concept, design, development, testing, deployment, maintenance, and EOL.
- Security for legacy and limited resource devices —Many environments do not have the luxury of start-from-scratch greenfield designs. This is true both on the device side (equipment in existing factories, buildings, ships, aircraft, etc.), as well as existing enterprise software systems. Also, some devices don’t have the memory or processing power to implement encryption, let alone multi-layered security. These devices can be isolated using secure gateways and readers that support segmenting the network, quarantining compromised devices or segments, wiping and reloading, and isolating insecure devices and networks, potentially using a ‘virtual private LAN’ overlay.
Security tends to be an incident-driven priority, meaning it doesn’t get much attention until after a major incident. It takes good ‘marketing skills’ (i.e. selling internally) to get the executive team to invest in it before the fact. And a certain kind of person who can find satisfaction in being the unsung hero who prevented the disaster from happening in the first place.
Additional resources
There are some good existing resources on securing different components of an IoT system. For cloud-based components, the Cloud Security Alliance offers Security Guidance for Critical Areas of Focus in Cloud Computing. For devices, in addition to the IoT Security Compliance Framework (from ISF), the Trusted Computing Group has their Architect’s Guide: IoT Security and Guidance for Securing IoT Using TCG Technology Reference Document. For more, also see IoT Security Foundation’s Vulnerability Disclosure Best Practice Guidelines.