Five key elements to ensure security for IoT in the enterprise
To enjoy the fruits of the Internet of Things' labors, security for IoT must be taken seriously. Here are five key steps to getting the job done.
The Internet of Things brings both benefits and potential security vulnerabilities. Here are five key steps enterprises should take to safely add connected devices to their networks and maintain security for IoT.
The Internet of Things is an evolution of networked computing devices that brings with it a variety of security issues. Many of these issues have existed for decades in IT systems, but the large number of IoT devices, their physical distribution, and their relatively limited computation and storage capabilities introduce additional factors that must be addressed to protect the integrity, availability and confidentiality of data and systems.
IoT devices can operate in a variety of interaction modes. They may act as data-collecting sensors sending information to a central service: An environmental sensor sending data on temperature, humidity and wind velocity is an example. This type of communication is primarily directed inward, toward the central service. In other cases, bidirectional communications may be employed. A smart power sensor in a home electrical system may send data about power consumption to a central service. After processing inputs, the central service can send instructions back to the smart sensor to adjust usage, for example temporarily shutting down some devices in the house to reduce electricity consumption. Alternatively, devices may interact with other devices to employ localized, swarm intelligence algorithms to respond to local conditions without interaction with a centralized service. Devices on automobiles, for example, can broadcast information about the vehicle speed, directions and acceleration to other vehicles in the area, which in turn can respond by adjusting their speed to avoid potential collisions.
Five steps: Security for IoT devices in the enterprise
The modes of integration could be compromised without effective security controls on IoT devices. Here are five types of security controls that need to be in place to protect IoT operations:
- IoT devices should be authenticated before being allowed to communicate with other IoT devices on the network or centralized services. This mitigates the risk of a malicious attacker spoofing an IoT device that appears to be a legitimate device on the network. Spoofed devices could be used to collect data from other IoT devices on the network or to transmit malicious data to other devices. This could be done either to corrupt data processing and analysis or to implement a denial-of-service attack on the IoT network.
- Devices must be started securely. It is especially important to verify and authenticate the source of software running on the device. Unsigned software may be compromised, and the device would not be able to detect such tampering unless software is digitally signed by the software vendor.
- Software patching must be done in a way that does not compromise the operation of the device. Software updates should only be accepted by authenticated sources. The patching process should be performed in a way that minimizes the risk of losing data or interfering with operations. For example, a device may be put into an update mode in which all local data is written to a central service, other devices are informed the updating device is going offline, and the update is performed and verified before returning to normal operating mode.
- access controls are fundamental measure for securing IoT and the organization as a whole. Users and roles are typically assigned privileges to perform operations in IT systems. In the case of securing IoT, roles should be designated for querying the state of IoT devices, updating software on devices and changing configuration of devices. As with other IT systems, it is important to employ the principle of least privilege and grant users and roles only the minimal set of privileges needed to perform their business and technical function. This can help limit the damage done in the event a user’s credentials are compromised.
- Design IoT software analytics with an eye on anomaly detection. In many cases, baseline behaviors may be well established, and variation from those baselines can indicate problems. For example, higher-than-expected traffic from a set of IoT devices could indicate the devices have been compromised and are being used in a denial-of-service attack. Consider how to respond to anomalous behavior, perhaps by shutting down problematic devices or removing them from the network.
Security for IoT encompasses many aspects of IT security in general, but the new architectures and design patterns seen with IoT networks present new potential vulnerabilities as well as additional opportunities for securing IoT and improving enterprise security overall.
