Like all hardware, applications and services in the communications and IT world, the Internet of things (IoT) must be secure. Think about all those billions of devices connected in 10 year. Now think about all the rich, personal data collected on those devices, flying over networks, stored on virtualized servers, and accessed by various end-users of the data. We need to consider the security implications of IoT devices and the systems surrounding them. I postulate that the risks are greatest where sensor data are combined with customer information are stored in large volumes on enterprise servers (see Figure 1).

Figure 1: Security risk level for a simple Internet-of-things architecture
[Source: Analysys Mason, 2012]


Suffice it to say there are security risks all along the IoT value chain from the device-side to the back-end applications and then to the presentment of the data to end-users. And it’s important for security experts to have involvement in the careful IoT planning, deployment and operational processes (if you are interested in learning more about how to implement security aspects for different IoT projects, please read the expert’s post in this blog).

But I believe the real risks exist where large volumes of data – sensor data coupled with personal information or asset information – are aggregated and analyzed on cloud-based or on-premises servers. These collection and storage points are treasure troves for would-be hackers. That being said, those implementing IoT projects for enterprises can readily conduct security audits and attempt to mitigate these security risks – the same types of security risks that exist in almost all IT and application deployments.

While there are security risks associated with the OS and applications on the IoT devices and on the end-user side, those risks generally involve a single device or end-user profile. The risks to the individual device or individual are generally more limited in these cases as potential data compromised would likely be limited in size and scope.

There are also security risks associated with core networks – carrier networks – and ancillary OSS/BSS systems associated with the provisioning and management of IoT and M2M solutions. No doubt there are security risks associated with the transfer of data along these networks and network elements, however, carriers in general build extremely high levels of security into their networks and ancillary systems. Even in cases where the ancillary systems are hosted off-premises by a third-party service provider, there are high levels of carrier-grade security built into the architectures.

Also interesting to consider are the security requirements for various IoT applications and different requirements by geography. For example, the security requirements for connected car data might be quite different than security requirements for public safety or government sector solutions. In addition, security requirements dictated by regulatory and legal codes in various geographies could differ significantly. These differing requirements certainly add complexities to multi-national IoT implementations.

Share your thoughts about IoT security. Where do you believe the greatest risks exist? What do you think are appropriate steps for enterprises to take in mitigating those risks?

Thanks and stay tuned for next month’s posting of my series here on Bosch’s IoT blog.

About The Author

Steve Hilton

Steve Hilton is the founder and Managing Director of MachNation, an insight services firm covering the future of the Internet of things (IoT). Prior to founding MachNation, Steve has worked as lead analyst for Analysys Mason's Enterprise research program until December 2013. He has also held senior positions at Yankee Group, Lucent Technologies, TDS and Cambridge Strategic Management Group (CSMG). Steve’s primary areas of specialization, which focus on large and small enterprises, include IoT, fixed and mobile communications services, M2M, cloud services, and sales channels. He has 20 years' experience in technology and communications marketing, with an IoT specialization for 7 years. Steve holds a degree in economics from the University of Chicago and a Master's degree in marketing from Northwestern University’s Kellogg School of Management. Steve is a guest author for the Bosch ConnectedWorld Blog.

12 Responses

  1. Stefan Ferber

    Steve,
    thanks a lot for your interesting post on a key issue on IoT: Security. People, companies, and government organizations have to trust the IoT applications in order to open up and to get connected. Do you think that today’s security infrastructure and software is sufficient to deliver?

    In the IoT context we often discuss the topic of securities – as there is not a static or a single security concept that handels all the variation you mention in your article (e.g. different regulations, different applications). Do you see a security concept that would allow to automate the instantiations of securities?

    Reply
  2. Steve Hilton

    Hi Stefan,

    Thanks for your Comment on this security article.

    I like your concept of “securities” which captures the idea that there are multiple pieces of the security puzzle to solve when addressing IoT deployments. I like it.

    Like all things in the security (or securities) world, there are no absolutes. We try to craft solutions that minimize the potential of a security lapse at every potential “risk point” along the data path. All installations of IoT (and all IT, for that matter) has to make trade-offs between risks/potential costs of a security breach and the upfront monetary costs associated with minimizing the chance of a breach happening. Most IoT solutions won’t require public sector (e.g., Department of Defense) levels of security, however, some will.

    Reply
  3. Steve Hilton

    Stefan,

    Your second question asks if there are ways to automate the instantiations of securities. Do you mean something like a security audit which is a fairly labor intensive activity, but I believe quite appropriate in the IoT sector?

    Thanks,
    Steve H.

    Reply
  4. Brendan Lewis

    It has been said that with IPv6 even your refrigerator will have an IP address, groceries will have RFID chips, and, when you’re low on milk or eggs it will either alert you or place an order at the grocery store. This level of connectivity can make our lives easier but it’s not without risks, as both Steve and Stephan point out.

    As an example, the US Chamber of Commerce was attacked by Chinese hackers who had access to their entire network for over six months.
    http://online.wsj.com/article/SB10001424052970204058404577110541568535300.html
    It was later published that the thermostat may have been the weak link in their network providing a way for the hackers to break into an otherwise secured network. It was communicating with a Chinese IP and a printer was printing pages in Chinese.

    Pacemakers, Insulin pumps and pain pumps are now embedded with communications devices for monitoring. A security researcher demonstrated that he could send a command that would actually kill someone by delivering all 300 doses on insulin contained in the pump:
    http://www.theregister.co.uk/2011/10/27/fatal_insulin_pump_attack/
    Pacemakers have similar vulnerabilities: http://www.theregister.co.uk/2008/03/12/heart_monitor_hacking/
    These devices rely on near field radios, not the internet. Once they have IP addresses and wifi, someone from another continent could conceivably kill a patient who’s life depends on that very device.

    Imagine that data is then aggregated in a large data base and you suddenly have more to worry about than someone turning off your fridge or reading your email.

    Preventing devices at your house or business from communicating with the outside world can be accomplished by utilizing a multi-layered approach. Not allowing devices access to the outside world is one method but would reduce the functionality being built in such as alerting your doctor if you have a medical episode/emergency.

    Security must be built into the products by the manufacturers, as consumers don’t have the security background nor understanding to limit communication of these devices to only appropriate sites or services. Current security solutions such as firewalls offering that level of control and filtering are not attractively priced for many small businesses and especially consumers. Consumer grade firewalls are set to allow all communications outbound by default.

    A better solution still is to use an IDS/IPS devices (Intrusion Detection and Prevention). They sit at the edge of your network and look for attacks, intrusion attempts and otherwise suspicious traffic and attempt to block it. They are however an order of magnitude more expensive and don’t protect your laptop or pacemaker when you are at a coffee shop.
    Vulnerability scanning can help to identify some of the weaknesses or security flaws of your internet connected devices but again, the software/service is complicated, expensive and difficult to utilize without the proper understanding of what the results may mean.

    Without the proper security baked into the product in the first place, anything you can do to secure it later is reactive. And even if you’ve done everything right, you’re still relying on a company somewhere that has aggregated the data to do everything right on their end.
    http://money.cnn.com/2012/03/30/technology/credit-card-data-breach/index.htm

    The good guys have to do everything right. The bad guys only have to find one hole or weakness to let them in.

    To top it all off, you can’t rely on the manufacturer either. “A top Department of Homeland Security (DHS) official has admitted on the record that electronics sold in the U.S. are being preloaded with spyware, malware, and security-compromising components by unknown foreign parties.
    http://www.fastcompany.com/1765855/dhs-imported-consumer-tech-contains-hidden-hacker-attack-tools

    I don’t know what the solution is but these are many of the issues people need to consider when debating the merits of IoT.

    Reply
  5. Steve Hilton

    @ Brendan,

    Thanks for the great comment. The security implications of IPv6 devices and the proliferation of connectivity is a serious issue. You’ve raised some really good points and pointed to some good articles raising serious security considerations.

    Do you think there is a way to effectively put security controls in place for these solutions? Do you think there’s a big difference between IoT devices connected over WiFi (and fixed broadband service) versus those with an embedded GSM/GPRS module in them? Or not really?

    Thanks again,
    Steve H.

    Reply
  6. Stefan Ferber

    Reply to Steve question: “Your second question asks if there are ways to automate the instantiations of securities. Do you mean something like a security audit which is a fairly labor intensive activity, but I believe quite appropriate in the IoT sector?”
    No, that is a misunderstanding.
    Today, we have one security solution for one application: e.g. to connect a charging station via internet to our eMobility cloud service. A security camera for a critical government building probably requires a different security set-up. That’s why I call it “securities”. But if we have multiple applications running on the same internet of things platform it will be difficult to have multipe security concepts deployed and running.

    Reply
  7. FOP

    Great post. I love it. I hope to see more. Thanks for sharing with us.

    Reply
  8. Michael Setton

    Great post.This is a hot topic and will become increasingly relevant. Since Bosch is quite active in the healthcare domain it will be interesting to see how this is addressed over the next few months. For our mobile health applications, we looked at various systems, but they did address mostly messaging and were often far too costly to deploy or suited just for one country. We finally settled on YobiDrive (http://blog.yobidrive.com/securing-the-internet-of-things/), which enables us to design mobile centric solutions which are both interoperable and future proof. Whether used in chronic disease management, hospitals or real time monitoring during emergency transport, security and trust are always among the top requirements for mHealth platforms. Even in a growingly fragmented and diverse mobile environment, once healthcare providers have agreed on PKI certificates revocation checking, one of the last barriers to adoption will have been addressed ; patients at the center of the healthcare system, will then be able to use the m-Health Internet of Things on a daily basis.

    Reply
  9. Steve Hilton

    @ Michael, Thanks for the posting. What led you to choose YobiDrive? Was is something particular to the solution? Something in the partnership model? Something in the payment model? Great to hear about innovative mHealth platform solutions. thanks again

    Reply
  10. Denise

    One of the problems that we have today is cyber security. We do almost everything on the internet and it’s important that we keep our personal information safe and secured.

    Reply
  11. click4support Computer Technical Support

    Cyber-attacks had become a common problem nowadays for various computer users with ever increasing advancements in the technological field. It is important to keep safe and secured from these attacks to safeguard our online privacy..

    Reply

Leave a Reply

Your email address will not be published.