Three Dependencies for Secure IoT Adoption - Part 1
Prior to coming to MobileIron, I worked five years for Cisco's Smart Grid Business Unit, which was soon renamed the Connected Energy Business Unit. It was then transformed into the Internet of Things Business Unit that targeted the energy, utility, industry and transportation verticals. Our routers and switches connected electrical smart meters, utility substations, manufacturing factory floors, trains and more.
I was one of the principal architects for the Advanced Metering Infrastructure (AMI) solutions network that is the reference network architecture still used today by large energy companies throughout North America. The biggest reason and motivating factor for leaving Cisco for MobileIron? I believe that Mobility and the Internet of Things will converge soon. The security and management of mobile devices and things are similar, and the technology will evolve and mature to greatly improve our lives at home, at work, and points in between. This three-part blog series will describe a path to securing IoT.
What is this thing?
The "Internet of Things" (IoT) has been around for a decade, but its adoption and implementation has accelerated just within the last several years. Ironically, its scope and definition are still not clear. Some describe IoT as the machine-to-machine (M2M) connection of things with embedded sensors or small computers over a wireless or wired network. The small computers can be programmable logic controllers (PLC) that control the opening and closing of valves, or intelligent electronic devices (IED) that enable or trip electrical circuit breakers. Some include mobile devices like smartphones, wearables, tablets and laptops in that definition. Still others claim that these devices aren't things themselves, but instead are the smart devices that communicate with these things by using a human machine interface (HMI) application. An HMI is the graphical or web-based user interface that controls and monitors other devices and things throughout an industrial plant, electrical distribution substation, nuclear facility, retail store, or the on-board diagnostics, entertainment and navigation systems in our vehicle.
These things are categorized into two broad areas. The first is Critical Infrastructure, which includes energy (generation, transmission, and distribution to our homes and businesses), drinking water (collection and sanitation), other utilities, telecommunications, security services, manufacturing, and transportation. The second is Personal Infrastructure, which encompasses mobile devices, automobiles, home entertainment and automation, and personal medical devices.There will be many more applications as the number of connected devices and things exceeds 25 billion worldwide today, and 50 billion by the end of the decade.
For the business owner, plant foreman, and network administrator, being able to monitor and control these things away from their work or business means having to use a mobile device as the HMI. These mobile devices must always be connected, and its data protected on the device and while it is transmitted over the Internet.
Protect Me And My Privacy, Please!
The Internet of Things would never get off the ground without having mechanisms in place for the protection of our personal information. Connecting billions of things to the Internet presents potential risks that can result in exploitation and harm. Security breaches can occur in the form of unauthorized access and misuse of private data. Cyber attacks where these devices and things can act as launching pads to access other critical systems that have control over our personal safety is a real threat. The stark reality is state sponsored hacking attacks can interrupt our satellite communications system, take control of our electrical grid, pollute our drinking water, derail our commuter train, or take over the OnStar system in our vehicle to remotely control the throttle and braking systems. So, how do we ensure our privacy and ultimately our well-being?
Companies must employ a secure Software Development Life Cycle (SDLC) process that defines the product requirements, its design and implementation, execution of threat modeling exercises, security testing and verification, and maintenance, including the patching of system software and firmware. Security must be built into the design and development of the device or thing before it is produced.
Additionally, implement a defense-in-depth strategy by creating network segmentation that will protect control devices and things under several layers of firewalls and intrusion detection and prevention systems (IDPS). Enforce complex password policies or multi-factor authentication. Employ context-aware security and malware detection, along with strong access control methods. Limit the collection and storage of private data. Data should be protected using the next generation Suite B Cryptographic suites that are discussed further in the next blog.
Perform regular internal penetration tests on the product, its secure boot process, the host virtual machine, (guest) operating system, and the connected network security infrastructure. This should be augmented by contracting a reputable third-party service that independently tests these same components using today’s powerful ethical hacking tools. This should be completed annually.
Stay tuned for Part 2 of this blog series, where we'll provide recommendations for cryptographic algorithms.