Security in the Age of IoT?

Probably, no one will risk and steal information about the mileage of a neighbour‘s car or a number of components produced in a competitor's factory. However, the target of attack is not necessarily the user of the device but the company whose data leaked.

Connected devices in IoT bring limitations, security challenges, but also different approaches to their solution. The development of new technologies brings new risks and requirements for security and protection of personal data. Original equipment manufacturers (hereinafter referred to as OEMs) are extending existing systems by innovative technologies. Mostly, for example, by sensors, computing and storage devices for large data applications and streamingedge analytics for cloud.

Businessmen increasingly rely on intelligently connected devices in all aspects of their business. Switching from private networks to enterprise-wide networks over the public Internet reveals the security risks that were not previously observed.

It is expected that the worldwide adoption of IoT and cloud technologies will reach more than 20 billion devices by 2020. More online devices mean more devices that need protection.

Legacy industrial devices and devices based on brownfields, which are critical to country infrastructure, are becoming an easy target for attacks. We are talking about electrical networks, communications infrastructure, and so on. The amount, diversity and age of these devices will greatly simplify the possibilities for potential attacks.

How is it then possible to ensure that the connected devices remain safe in the complex IoT ecological system?

OEMs, solution providers, system integrators, and end-users need to create a comprehensive multi-layer strategy that provides end-to-end protection for their deployed IoT devices. Traditional solutions that use network firewalls and protocols only provide protection against the high level of Internet traffic.

The first layer of the IoT security strategy begins with the protection of the hardware and software of the connected device itself.

One of the most often overlooked layers of IoT is device security LIFECYCLE. Security needs to focus on:

•  the initial design by the device manufacturer,
• the operational environment handled by the end user or a system integrator,
• the final decommissioning.

Hardware-based, anti-malware technologies have emerged to address security problems shared by multiple parties. TRUSTED or SECUREBOOT requires devices to verify firmware and software packages at boot time through cryptography. When a connected device is powered on, the authenticity and integrity of the software on the device is verified using encrypted digital signatures.
These digital signatures are attached to the software image and confirmed by the device to ensure only authorized software signed by the designated device entities will be loaded to run on the machine.
Embedded devices should have secure certificate storage, which is programmed during manufacturing to establish the root of trust.

Once a foundation of trust is established, the connected device still needs protection from various run-time threats and malicious parties. Many IoT device manufacturers have begun to use APPLICATION WHITELISTING on their new connected products to ensure machines are not compromised at the application level. Device manufacturers have used whitelisting techniques instead of blacklisting to preserve the real-time operation of legacy devices that are unable to run traditional antivirus applications. For centrally managed environments, application whitelisting stops the execution of malware and other unauthorized software by only allowing indexed applications the chance to run on the device. Conventional antivirus software and other PC security technologies block known bad activity while permitting all other.
On the other hand, whitelisting application considers all data to be incorrect until it is verified in a controlling data process and therefore blocks it.

Proper ACCESS CONTROL is based on the principle of least privilege, which dictates that only the minimal amount of access required to perform a function should be authorized to curtail the impact of any breach of security. Device-based access control mechanisms are analogous to network-based access control systems. If any component is compromised, access control ensures that the intruder has as limited access to other parts of the system as possible.

OEMs should select devices that allow them to configure multiple users and assign them granular permissions to access various functions of the device.

NETWORK SECURITY should be set in such a way that the device authenticates itself before receiving or transmitting data. Embedded devices must often support multiple ways of having their network credentials stored in their secure storage. The network administrator should pre-provision them in a central location before deployment.

The embedded and industrial IoT devices have unique protocols that are different from traditional IT protocols. Firewalls or deep packet inspection capabilities are needed to control traffic that is destined to terminate the device. For example, industrial devices used in manufacturing have their own set of protocols governing how devices communicate with each other and with the various control systems. If malware managed to breach a firewall, antivirus techniques based on signature matching and blacklisting would identify and remedy the problem.

DATA PRIVACY and confidentiality remains the primary concern. Security measures such as virtual private networks (VPN) or physical media encryption, such as 802.11i (WPA2) or 802.1AE (MACsec), have been developed to ensure the security of data in motion.

After the device is deployed in the field and securely provisioned onto the network, continual firmware patches and software updates must be loaded onto it.

Complex device security framework should include:

ENCRYPTION – It is important to encrypt the data both, at rest and on the way between the transmitting and receiving devices, i.e. data in motion. Data encryption technologies such as Secure Socket Layer (SSL) and Transport Layer Security (TLS) and X.509 PKI for data encryption throughout the network. PKIs are certificates that use device authentication while preserving their integrity.

AUTHENTICATION – Works through password, two-factor authentication, biometric data, or two-factor authentication. To secure standard and enterprise Wi-Fi it can be, for example PSK, Wi-Fi Protected Access 2 (WPA2)-Enterprise and ExtensibleAuthenticationProtocol (EAP).

VERIFICATION - SecureBoot, (cryptographically verifies firmware and software packages at boot time) and SecureFirmware -Over-The-Air (FOTA) update ensures that only authorized firmware gets programmed secure credential storage that protects critical key and password information on the device.

OEMs that closely cooperate with their suppliers are able to bring new insights into the needs and solutions of problem areas. One of them is also our supplier Lantronix. Building blocks, modules, gateways, and IT network appliances provide various integrated technologies to help OEMs build secure connected devices, as well as solutions for solution providers, system integrators, and end users to implement end-to-end IoT security for their applications with complete device lifecycle security.

REFERENCES: 
Gartner, Securing the Internet of Things ,
Forbes, Transforming Economic Growth with The Industrial Internet of Things
Wikipedia, Industrie 4.0

Source: Lantronix.com