SECURITY IN THE INTERNET OF THINGS

It has been with us in some form and under different names for many years

Although it has been with us in some form and under different names for many years, the Internet of Things (IoT) has suddenly become ‘that thing’ everyone is talking about. The ability to connect, communicate with and remotely manage countless networked, automated devices over the internet is becoming ubiquitous, from the factory floor to a hospital operating theatre and even the basement at home.

The transition from closed networks to corporate IT networks and the public internet is accelerating at an alarming rate, and security concerns are rightly emerging. As we become increasingly dependent on smart, interconnected devices in every aspect of our lives, how do we protect potentially billions of them from intrusions and interference that could compromise personal privacy or threaten public safety?

SEARCHING FOR A PANACEA

As anyone involved with IoT knows, security is paramount

to ensuring reliable operation between connected IoT devices.

There is less consensus on the best way to implement IoT security at device, network and system levels. Firewalls and network protocols can manage high-level traffic over the internet, but how do we protect endpoint devices at their foundations, when their missions are usually as specific and well defined as they are limited, and what resources are available to achieve this?

Given IoT's novelty and today's pace of innovation, there seem to be widespread expectations that a completely new, revolutionary security solution will emerge specifically tailored to IoT — as though we could somehow compress 25 years of security evolution to fit the timeframe in which next-generation devices will become available on the market.

Unfortunately, there is no ‘panacea’ that can effectively mitigate every possible cyber threat. The good news, however, is that IT security controls, thoroughly proven and developed over the past 25 years, can be equally effective for IoT and adapted to the unique characteristics of embedded devices that will increasingly form part of future networks.

THE EVOLUTION OF NETWORK SECURITY

Data protection has been an issue since the first computers were connected. With the commercial emergence of the internet, security concerns expanded to cover personal privacy, financial transactions and the threat of cybercrime. In IoT, security is inseparable from data protection. Whether accidental or malicious, interference with a pacemaker, a car's controls or a nuclear reactor threatens human life.

Security controls have evolved alongside networks, from the first packet-filtering firewalls in the late 1980s to increasingly sophisticated protocols, firewall software, security prevention systems, event management and more. These controls aimed to keep malicious activity outside corporate networks and detect attempts to gain access. If malware breached a firewall, signature-based antivirus techniques and blacklists came into play to identify and resolve the problem.

Later, as the malware universe expanded and more advanced techniques emerged to evade detection, whitelists began replacing blacklists. Similarly, as more devices joined corporate networks, various access-control systems were developed to authenticate both devices and the users behind them, authorising particular users and devices for specific actions.

More recently, software authenticity and intellectual property protection led to various licence verification and certification techniques. Finally, data confidentiality has always been, and remains, a primary concern. Network controls such as VPNs, or physical-medium encryption such as 802.11i (WPA2) and 802.1AE (MACsec), were developed to ensure secure data traffic.

NEW THREATS, LIMITATIONS AND CHALLENGES

Applying these same approaches to IoT requires significant re-engineering to address device limitations. Blacklists, for example, require too much disk space to be practical for IoT applications. Embedded devices are designed for low power consumption and a small form factor, and often have limited connectivity. They generally have only the processing capacity and memory needed for their tasks. They are often ‘headless’: no human operates them to provide authentication credentials or decide whether an application should be trusted. They must make their own judgements and decisions about accepting commands or executing tasks.

The infinite variety of IoT applications presents an equally broad range of security challenges.