Treating IoT security as a first-class citizen

As recent security breaches have shown, malicious actors are becoming increasingly clever and sophisticated. They break in through unlocked doors, such as weak or nonexistent passwords on IoT devices like security cameras. As billions of devices are becoming connected (including many that have tremendous impact on business processes or consumer safety), security should become a primary concern. But are we really doing enough to mitigate threats? Are we learning from the painful recent experiences? According to NXC Group, nearly half of companies with an annual revenue above $2 billion estimated that the potential cost of one IoT breach is more than $20 million.

Organizations have historically weighed the cost and time of focusing on security as a deterrent, citing time-to-market delays, design complexity, fragmented ecosystems and more. But as the world moves towards a trillion connected devices over the next 20 years, we as an industry must change our behaviors and agree that security is no longer optional or an afterthought. Users need to know and trust that their IoT devices are born secure, upgradable and managed end to end.

As an industry, we have a social responsibility to build secure devices and maintain a high level of security throughout their lifecycle. We need to make it easy for organizations to securely build, deploy, connect, manage and update devices. This is why Arm has worked with our partners to develop Platform Security Architecture (PSA), the first industry framework for building secure connected devices. PSA provides a common set of ground rules and resources to reduce the cost, time and risk associated with IoT security today, simplifying the security consideration process for device manufacturers, vendors and service providers.

Strong IoT security starts by empowering developers with the tools and system-on-chip (SoC) designs needed to securely develop devices at the very beginning of design, without slowing down time to market. They should incorporate multiple layers of protection, scaling from software to silicon implementations, such as protecting against physical attack threats, which can occur when an attacker has direct contact with the device SoC or is in close proximity to it. Organizations should build technologies into separate partitions that mutually distrust each other in case an attacker breaks into one part of the system.

However, even the highest integrity devices built with the latest security protocols need updating as both devices and attack techniques evolve. Whether a smart meter or smart streetlight has been installed in the field five months or five years ago, it will need to be updated as attackers become more sophisticated and identify new attack vectors over the device lifecycle. When we consider the number of devices deployed could range anywhere from hundreds to millions, over-the-air (OTA) firmware updates become a critical requirement to mitigate new threats. Key considerations when designing in OTA firmware for secure devices include:

• Space requirements for storing the newly received firmware upgrade;
• Properly checking firmware signatures before installing them;
• Ensuring enough bandwidth to support a firmware download; and
• Determining how many firmware updates can be supported before the devices shut down if they are running on batteries.

True end-to-end security requires a comprehensive IoT device management technology for protecting connected devices throughout their lifecycle once they are deployed. This includes securely provisioning the device once it’s turned on in the field, managing the updates over the air and securing the communication between the device and the data store. Secure communications should be encrypted and based on widely deployed and tested security protocols such as transport layer security (TLS) and datagram transport layer security (DTLS).

Security is undoubtedly complex and expensive. The industry works relentlessly to consider and try to protect vast attack surfaces, while hackers need to find just one vulnerability to undo all that hard work. It’s time for us to bring security efforts out of the shadows and make it a first-class citizen in our companies. By working together, we can build a safer future for everyone as we move towards a trillion connected devices being deployed over the next 20 years.

All IoT Agenda network contributors are responsible for the content and accuracy of their posts. Opinions are of the writers and do not necessarily convey the thoughts of IoT Agenda.