Top three things to expect with IoT security in 2018
January’s Hide ‘N Seek IoT botnet has reminded us all of the sophistication of attacks that will continue to appear and hamper our collective network management.
These shifting IoT security threats of today will mirror the efficacy and complexity of PC and workstation threats of a decade ago. Having fought this fight before, expectations and game plans of attack and defense (respectively) can at least be estimated and planned for from a reasonably successful template.
In 2018, we can expect IoT deployment of multifactor authentication backed with hardware, even more sophisticated attacks against IoT networks and, for the short term, confusion over standards and certifications.
A trend toward security incident recovery through hardware
With the prevalence of weak passwords and access control on IoT devices leading to a growing number of attacks, there will be a shift toward designing systems to include incident recovery as a core IoT security requirement.
Product designers will begin asking the question, “When this device does get attacked, how do we ensure it can be disabled to prevent further damage and then recovered?” Expect the emergence of design requirements that mandate implementation of key rotation mechanisms at the time of manufacture. Still, during the event horizon of an attack, the existence of purely software key rotation mechanisms can still lead to device identity to be spoofed until after the attack is mitigated.
Designers and engineers should consider adopting multifactor authentication in their device design and making use of a hardware secure module or other hardware-secure security element as an additional factor in their identity and access management implementations.
Existing vulnerabilities will allow single event damage with maximum payload
Hide ‘N Seek and other attacks have shown us that exploits are becoming complex enough to attack a wide variety of device types in varied deployment types, no longer aimed at a specific product, stack or environment.
As a result, a single attack can adapt to maximize its payload and spread faster than device-specific or stack-specific patches and upgrades can be applied comprehensively.
We can expect at least one major attack that causes damage of astronomical, never-before-seen proportions. This attack will affect several architectures and singlehandedly cause damage greater than multiple major prior attacks combined.
How can we prepare? 2018 will be a good time to revisit open ports and services running on devices, and to consider adopting cloud- or controller-based configuration interfaces rather than running administrative services directly on devices.
Confusion over security standards to continue
Several efforts have birthed various certification and self-assessment initiatives; however, with the exception of specific industries, like payments and healthcare, don’t expect to see patterns in adoptions emerge until either regulation or a critical mass of buy-in is reached, both of which take time.
As such, new efforts for security accreditation and standardization won’t have a widespread positive impact by the end of 2018. What can we do in the mean time? Continue to back the certifications and standards that make the most sense for your applications — the more thoughtful voices we have, the sooner that critical mass of adoption and regulation will happen.
Saving IoT
Because of the success in mitigating malware on PCs, workstations and phones, the devices the world employs are, quite frankly, assumed to be secure. Blind trust is often attributed to the devices and the data they serve — even life-saving devices. We’re in a battle to succeed and make the internet of things a secure place, whether or not anyone notices.
All IoT Agenda network contributors are responsible for the content and accuracy of their posts. Opinions are of the writers and do not necessarily convey the thoughts of IoT Agenda.