{"id":8629,"date":"2020-06-22T09:26:40","date_gmt":"2020-06-22T09:26:40","guid":{"rendered":"https:\/\/www.experfy.com\/blog\/?p=8629"},"modified":"2023-12-04T14:54:18","modified_gmt":"2023-12-04T14:54:18","slug":"security-of-iot-devices-ways-to-protect-yourself-part-1","status":"publish","type":"post","link":"https:\/\/www.experfy.com\/blog\/iot\/security-of-iot-devices-ways-to-protect-yourself-part-1\/","title":{"rendered":"Security of IoT Devices: Ways to Protect Yourself. Part 1"},"content":{"rendered":"\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

The issue of Internet of Things device security is one of the main growing pains that inevitably follow the industry which is expanding at a rapid pace. As <\/strong><\/em>Statista<\/em><\/strong><\/a> indicates, by 2025 there will be 75 bln connected devices that we will have to protect against virtual and physical attacks.<\/strong><\/em><\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\n\n

One of the main security indicators of IoT devices is the ability to personalize a device without additional effort and expense (connect it to the network and enter access keys). In addition, code integrity and the ability to withstand attacks are important. Problems arise both on the part of users and manufacturers. For example, not all device owners replace factory passwords with more complex ones. Manufacturers, in the pursuit of quick money and the desire to quickly bring the device to the market, do not always properly test their product codes.<\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"\"\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

More on Internet of Things weak spots was covered in our previous article<\/a>. As we noted there, the main issue with the Internet of Things is that there are no uniform security standards, which is an inevitable consequence of the broad variety of devices on the market. Sometimes you have to save on something in order to be competitive in comparison with others. And, as you may guess, the functionality often falls victim in this struggle, since you have to fill the available IoT memory with as much as possible sacrificing some lesser evil.<\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t

\n

How to Secure IoT Devices<\/strong><\/h2>\n\n<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/div>\n\t\t\t\t\t<\/div>\n\t\t<\/section>\n\t\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t\t
\n\t\t\t
\n\t\t\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\n

Botnets are a common tool which hackers use in carrying out their attacks. One of the most vivid occurrences took place in 2016 when as a result of a DDoS attack the Mirai botnet<\/a> brought down most popular American websites. The malware cracked combinations of default logins and passwords and hacked thousands of IoT devices. What is more, intruders uploaded the source code on the Internet, which increased the risk of it being used by other hackers. Below is a typical architecture of a DDoS attack.<\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"\"\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

These and similar attacks can bring physical harm to people (e. g. if hackers have got access to explosive and fire-hazardous equipment) or cause delays or downtime at production sites (which in turn leads to sufficient losses). In addition, by hacking one smart device, malicious users can get access to the entire network, including entrance locks and bank accounts.<\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"\"\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"\"\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\n

Some of these solutions were covered in our previous article<\/a>. Let\u2019s focus on certification this time.<\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t

Can certification be the best way to<\/strong> secure IoT devices?<\/strong><\/h2>\n<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

The issue associated with the security of IoT devices can be partially resolved by certification. Passing tests and obtaining appropriate certificates will provide clients with some protection against attacks by cybercriminals. The main condition for such a procedure is that it is available to all manufacturers and does not turn into a pure formality.<\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t\"\"\t\t\t\t\t\t\t\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\n

Online Trust Alliance (OTA) came up with an idea of \u200b\u200bhow to secure your IoT devices. The company compiled a list of requirements for manufacturers and service providers \u2014 IoT Trust Framework<\/a>. This list should ensure the safety and viability of IoT products. Based on it, you can design certification programs for devices, as well as assess existing risks.<\/p>\n\n\n\n

A certain number of IoT certificates, which were developed by private companies, are already in use. For example, Verizon \u2013 ICSA Labs<\/a> created its own program that inspects the security of IoT devices.<\/p>\n\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

The solution developed by UL Cybersecurity Assurance<\/a> (CAP) tests not only product safety, but entire systems as well. A CAP certificate confirms that software updates for a device will not reduce security or increase the risk of attacks.<\/p>\n\n\n\n

In 2018, the German software developer SAP<\/a> introduced its IoT device certification program in the CIS. Within its framework, devices are tested and receive a respective quality mark, which confirms that the devices are safe and can be used in IoT projects.<\/p>\n\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

The European Commissioner for Digital Economics and Society, Thibaut Kleiner, believes<\/a> that measures to protect the IoT from cyberattacks should be taken at the state level, in particular, to make certification mandatory for all devices of the Internet of Things. Such a procedure should apply not only to devices, but to networks and cloud storages as well.<\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t

What can you do to secure your IoT devices?<\/strong><\/h2>\n<\/h2>\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t
\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t

If you want to secure your Internet of Things infrastructure, you\u2019ll have to possess a carefully crafted security strategy. According to this strategy, it is necessary to protect data in the cloud, to ensure data integrity during data transfer over a public network and to thoroughly prepare devices for further use. Each next level provides better security guarantees throughout the entire infrastructure.<\/p>\n\n\n\n

This carefully thought-out security strategy can be developed and implemented with the active participation of various parties involved in the design, development and deployment of IoT devices and infrastructure. Let\u2019s consider what each of them can do to ensure the success of your IoT project.<\/p>\n\t\t\t\t\t\t\t\t<\/div>\n\t\t\t\t<\/div>\n\t\t\t\t

\n\t\t\t\t
\n\t\t\t\t\t\t\t\t\t\n