Funtap - stock.adobe.com
Securing the future of IoT
If organizations don't get IoT security right, the potential for hackers to control sensitive personal, commercial or national information could have devastating consequences.
IoT is booming with 75 billion devices predicted to be connected to the internet globally by 2025, according to a Statista report. But such devices have the potential to present as much risk as opportunity if they aren't secure, and entire national infrastructures could be compromised with devastating results.
In fact, reports of IoT security failures abound: video doorbells streaming unencrypted data, smart plugs allowing remote execution of arbitrary code, smart home devices storing unencrypted home Wi-Fi network passwords, industrial control systems allowing attackers to remotely control machinery and the list goes on.
Governments across the world are aware of potential risks and are taking action to mitigate conflict. For example, the Australian government introduced a draft voluntary code of practice for security in the IoT industry earlier this year. The code of practice contains 13 draft principles, including ensuring software integrity, implementing a vulnerability disclosure policy and minimizing exposed attack surfaces. It is aimed at protecting data and ensuring resilience in the industry.
What does it take to ensure communication security for IoT?
Zero trust
The traditional approach to network security has been to strictly control access, but to implicitly assume that the interior of the network is a safe place. Time and time again, this has proved to be a bad assumption. In contrast, the zero-trust approach replaces blind trust with verification and strong cryptographic guarantees. The goal is to maintain security, integrity and privacy even in the event that the underlying infrastructure is compromised. Zero trust affords no special status to the network and treats it the same as if it were the public internet.
Confidentiality
A basic requirement of communications systems, whether they be for personal or industrial applications, is that third parties must not be able to determine any data sent over the network. All data should be encrypted from the point it is generated to wherever it is transmitted. End-to-end encryption should be performed using strong, well-vetted and standardized cryptographic primitives with unique key material. The zero-trust principle is set up so that even if an eavesdropper has access to the network pipeline, end-to-end encryption ensures confidentiality. Systems should make it easy for users to use encryption and enable it by default.
Integrity
In addition to ensuring confidentiality, it is vital that an attacker cannot successfully tamper with or forge messages. Such attempts should be detectable by the network. There should also be no ability to replay a recorded message and have it successfully authenticated. Strong cryptographic approaches, such as hash-based message authentication can provide these protections and should be used to ensure data integrity.
Privacy
When it comes to maintaining privacy, it's important that third parties are not given the opportunity to determine the identity associated with over-the-air transmissions or be given the ability to know whether messages are sent from one device or multiple devices. In fact, there should be no discernable association between messages and devices, preventing what are sometimes referred to as metadata attacks. While the use of strong cryptographic principles is relatively well-adopted for encryption and data integrity, many systems still send unencrypted identifying data. Cryptographic approaches can equally provide privacy. By taking these precautions, organizations will also prevent targeted forgery attempts, which can thwart hackers' efforts to attack a particular device or user.
Scalability
With the potential to connect billions of devices, the IoT must be scalable to not only ensure its future success, but also to ensure its security. Low-cost or low-power devices are no excuse for ineffectual security or privacy. The IoT industry simply must cater to exponential growth while supporting lower-power and low-cost implementation. Forward security measures need to be implemented so that upgrades and improvements can be deployed, and to provide ways to address the inevitable security issues for devices already in the field.
If the industry doesn't get IoT security right, the potential for hackers to have control of incredibly sensitive personal, commercial or national information could have devastating consequences. The risks and consequences are massive, and it's critical that the industry gets behind initiatives like the draft code of practice. We have the tools to provide a secure and private internet of things, we just need the collective will to universally deploy.
About the author
Alex Grant is the CEO and co-founder of Myriota, an Australia-based business revolutionizing the IoT by offering low-cost and long-battery-life global connectivity.
