The promise, benefits, and value of the Internet of Things (IoT) have been documented extensively, but a number of widely publicized IoT attacks leaves the impression that the IoT is deeply insecure. What is often not mentioned is that many of these attacks originated due to failures in implementing basic protections.
But even where the vendor has taken reasonable precautions, things can go horribly wrong, as can be seen in a – literally – fly-by attack on smart lighting.
Another challenge is that IoT-enabled devices are deployed “where the action is” – the factory floor, oil platforms, public roads, offices, stores, moving vehicles, or in cities running over wireless networks.
That means that they are often physically accessible by employees, contractors, and even the general public. If we compare that to modern cloud data centers, where only authorized personnel can enter, there is a substantial difference. More people with access means the risk of compromise goes up, so we may need to ensure devices themselves are physically protected against tampering.
But these are not insurmountable obstacles. The question is less one of not knowing what to do to protect IoT environments, rather how to implement and apply security measures to keep the solution safe.
Five recommendations for securing the IoT
1. Manage risk
Modern security practices follow a risk-based approach that considers both the ease of an attack and the impact should one happen – giving a strong indicator of how much security you’ll need. The reality is that an IoT solution that monitors, manages, and optimizes operations in a chemical factory requires much tighter security protocols than one that simply turns off the light in a conference room when sensors detect nobody is present. In the former, a successful attack could lead to a catastrophic industrial accident including injury and loss of life. In the latter, the worst that could happen is that an electricity bill is a little higher.
2. Limit device-to-device communication
There is a misconception that the Internet of Things, by definition, means that many devices are connected to many other devices, increasing the risk that a successful attack leads to catastrophic failure or takeover of a substantial portion of your IoT infrastructure. In many cases, devices have a single purpose and only need to send the data they collect to a single location. By limiting the number of IoT devices that talk to each other, we can better secure each one and limit the damage should any breaches occur.
3. Retain control over your IoT infrastructure
The risk is yours – any failure in security is your responsibility and you will be held accountable for the result – so it is important to maintain control. This starts with device selection: Make sure that devices either have the security features you need or, preferably, are “open” so you can analyze and understand how they work, and then add any features you need to fill security gaps. This includes the ability to update devices in an automated and secure way and to control that process yourself.
4. Use encryption from end to end
It’s critical to encrypt communication between devices and data-ingestion points to make sure nobody can listen in, tamper with sensitive data in transit, or recover enough information to spoof or impersonate the device and feed the system manipulated data. Modern encryption techniques work in much the same way as HTTPS does to protect information online. Encryption also needs to be tied to device identity to ensure the data we think comes from a particular device actually does.
5. Leverage existing expertise
Apply proven security technologies, tools, and best practices used in traditional IT landscapes. In many cases, they can be implemented directly: by using digital certificates or equivalent, by restricting what IoT devices can do and communicate with, and by adding protection and monitoring mechanisms. In other cases, such as micro-controllers and low-power networks, we may need to apply new techniques, but we can draw on existing principles and concepts.
IoT adoption is still in early days. Unfortunately, that means that there aren’t many established standards yet, and while the number of devices brought to market is quickly rising, certification schemes and regulations are lagging. As a result, adopters still need to carefully plan and build in security from the start and properly evaluate any IoT equipment brought in house.
As large technology providers recognize the security challenges with new IoT technologies and software solutions, the situation is rapidly improving. At SAP, we’re also committed to both describing the pitfalls and providing clear guidelines to overcome them.