IoT Security: Smart Measures for Smart Devices

In 2015, hackers were able to tap into and kill the transmission of a 2014 Jeep Cherokee as it drove down a highway in St. Louis. The Internet of Things (IoT) allows many features and advantages. Its incorporation into sophisticated designs can achieve remarkable outcomes. However, IoT security presents a concern for the entire design team and all the stakeholders with whom they interact.

More and more engineering designs will incorporate IoT, however, the devices that are part of the design process may be the source of the risk. Katie Curtin, lead product marketing manager for Security Solutions at AT&T, cites AT&T’s Cybersecurity Insights report What Every CEO Needs to Know About Cybersecurity. The report forecasts that 50 billion devices will connect to networks by 2020.

Vulnerability Scans of IoT Devices Increase

“The issue is that hackers are seeing this too,” says Curtin. “Over the past two years, our Security Operations Center has logged a 458% increase in vulnerability scans of IoT devices.”

The increase may be due in part to devices within the network not always having proper security measures set forth early. “We found that only 10% of organizations are confident that the devices on their network are secure,” she says. “This underscores the importance of working to provide security in every device because of a breach’s financial and reputation cost. Finding ways to help secure these new devices and the associated data is vital to managing security threats going forward. Since every new device creates a new entry point into the network—it is more important than ever to help make these endpoints highly secure.”

Given the history of high-profile breaches, security is top of mind for consumers and needs to be a top priority for the companies building connected products. “In order for connected products—and the IoT overall—to succeed, security must be a key consideration in the design phase and built in from the get-go,” says Calum Barnes, senior manager, IoT Products & Strategy, Xively by LogMeIn in Boston. “On average, companies building connected products spend almost 20% of their design effort on data and device security.”

Incorporating security, however, is not so easy.

Jeff Shiner, director of IoT Solutions, Micron Technology, says that when implementing IoT into design, security is one of the most difficult burdens for engineers to tackle. “This is primarily due to the fact that critical security elements on clients or nodes aren’t currently native to these platforms and in most cases can be very costly to implement due to both the software and hardware elements required. In addition to the complexity of redesign, the approach can be fairly fragmented between different software and hardware vendors,” he says.

“This, in turn, can translate into a long investigation cycle followed by a costly design cycle based on each organizations specific security needs,” Shiner continues.

IoT Security Implementation Strategy

Responsibilities within the design team will vary among entities. However, the roles of everyone, with respect to IoT security, must be clarified.

Barnes says that chief architects and security engineers are typically responsible for the end state of the security of the product. However, he emphasizes that to be successful, companies need to make security part of the overall product development process and have every developer take responsibility for building and delivering a secure solution. He cites Microsoft’s popular Security Development Lifecycle method for constant evaluation of security posture during development as a great way to do this.

“With the awareness created by automotive, retail, industrial and medical breaches, organizations today are taking a more holistic view of how to properly implement security in a way that balances cost vs. risk,” adds Shiner. “It typically starts at the CISO (chief information security officer) level and then trickles down into initiatives driven by individual engineering teams. More and more we are seeing the evolution of security task forces or even formalized groups within these corporations to align software and hardware efforts to achieve the highest level implementation strategy.”

There may not be one ideal time for IoT security concerns to be addressed. Smart designers will be vigilant early and flexible throughout the design cycle to ensure that any incorporation of IoT is swiftly addressed and met with proper security measures.

“It is crucial that security is addressed at every stage of design and development of an IoT system,” says Barnes. “Product design engineers need to be constantly aware of security considerations when working with their engineers. However, it is even more important that product designers are aware of the security implications of third-party software being used in the system.”

Joel Scambray, a principal IT security evangelist at Cigital, says security should be implemented “early and often.”

He adds that it behooves engineers to consider security at the earliest phases of development, particularly in the design phase. There are already recognized practices around secure design, including processes like threat modeling that can help engineering teams clarify their designs to mitigate relevant risks, instead of just throwing in catch-all security controls.

“Another good resource for secure design is the IEEE Center for Secure Design, which has gathered some prominent organizations to collect data about and promote secure design principles,” Scambray adds. “Beyond the design phase, it’s important to integrate security into all the other key ‘touch points’ along the development lifecycle. Some of the most recognized touch points include secure code review and static analysis after code completion milestones, and penetration testing during the QA phase, and ideally again before release to production.”

Be Prepared

Kurt Kokko, chief technology officer of Signal Sense, an IT security firm located in Seattle, cautions that you should not wait to instill security into your IoT designs. He says that engineering teams should be thinking of security throughout the design process but must be aware that breaches can happen at any time—including now.

“Fortunately, machine learning and neural networks are extremely good at monitoring IoT environments full of small, predictable, controller-based devices—just learning behavioral norms and noting deviations, all day, every day,” says Kokko. “A network-centric approach to security that’s powered by machine learning is very well-suited to keeping IoT devices from becoming a jumping-off pad for malicious behavior.”

Barns points out that physical security is one of the hardest problems to solve in IoT. Product designers must use a measured approach and ensure there is just the right amount of security. If someone can break open their product and compromise just their own device, that’s an acceptable level of risk for many OEMs (original equipment manufacturers). “If somebody can crack open a device and compromise every device, that’s a major problem,” he says. “It’s all about setting what levels of risk you can accept as a business, and sticking to that no matter what.”

If IoT security is properly accommodated and addressed, it opens up new avenues for designs of today and tomorrow. The data and information that IoT endpoints allow will change the impact that decision makers will have in utilizing such data.

According to Shiner, when analyzing your cybersecurity exposure, the most effective way to protect against a breach is to leverage hardware roots of trust. Use such roots as your base anchor within endpoints.

“If done correctly, this can make a system nearly impenetrable,” says Shiner. “The most common belief among security professionals is that even their best security will be hacked. With this belief, the approach is different than just picking a solution. The solution in this case is multiple layers of security. As cybercrime evolves and new technology emerges to aide in these efforts, multiple hardware roots of trust provide the true in-depth defense needed to make the cost of the attack the deterrent.”

More Info

• AT&T
• Cigital
• Micron Technology
• Signal Sense
• Xively