Why Cloud Security is essential for the success of Internet of Things
The integration of Internet of Things (IoT) into daily lives is a hot topic for the consumer market with smart home appliances, smart phones and wearables all communicating with each other to create one network of connected systems. In a similar fashion the the business-to-business (B2B) application of IoT technology presents a huge potential to change the way companies operate and create products. Not limited to large organizations IoT can be found in many sectors, including government (smart parking, lighting and watering, environmental monitoring, traffic management), manufacturing (supply chain optimization, robotics, RFID and logistics. industrial control systems), healthcare (bedside monitoring, telemedicine, implantable devices), amongst others. With the fast adoption however, comes serious challenges to an organization’s network, and a great deal of them are related to security and privacy.
While there is no question about the potential of the emerging IoT technology, one should not ignore the challenges early adopters face today. Many IoT systems are poorly designed and implemented, oftentimes with diverse technologies and protocols that make them more complex than traditional enterprise systems. As with any emerging technology, lack of standards, best practices and well-established business processes result in a wide variety and often conflicting approaches to security and reliability of these systems. Another challenge is the fact that these devices are limited in capacity, which makes application of ‘tried and tested’ security measures harder, or sometimes impossible. Ubiquitous mobility of devices makes tracking and asset management harder and mass quantities make routine update and maintenance operations a challenge. Cloud based operations add another layer of difficulty as they make perimeter security less effective.
Integration of IoT creates a new, and arguably more dangerous breed of threats and attack vectors. Control systems, power grids, vehicles, nuclear power plants and even human body can be accessed and manipulated to cause serious damage if IoT is not designed and implemented in a secure way. Widespread adoption of IoT also raises privacy concerns, as it is sometimes possible to deduce the identity of a person by aggregating data from different sources, even though personal information has not explicitly been exposed. Widespread use of IoT by healthcare providers, municipalities, and public services will also significantly enlarge the attack surface that can be taken advantage of if not protected.
Maintaining confidentiality, integrity and availability of data in the entire IoT ecosystem requires a layered security approach as the limited capabilities of the devices and the still developing standards will make it almost impossible to guarantee that devices will not be used to infiltrate into the cloud, and consequently the enterprise computing resources. An end-to-end security architecture and implementation should prevent any one node to constitute a single point of failure, therefore compromising the entire system. As most devices are not physically protected, and they lack the computing power and physical strength to be tamper proof, the cloud security architecture should assume that some of the devices will eventually be compromised and their failure is well contained with a defense-in-depth approach.
The central cloud management system should not only have a very tight control over all devices in the system, but it also should ensure that the devices are authenticated and authorized via cryptographic methods. Even though some devices won’t have enough resources to run industry-standard X.509 certificates, alternative structures exist for authentication transactions on memory-constrained devices (such as 1609.3 certificates). Where possible, the devices should use hardware-based credentials, which are harder to break than software-based credentials. When the security of data-at-rest and the data-in-transit are ensured on the device, the security established in the cloud is the last line of defense protecting against attacks. In many cases, the devices should not be doing anything other than sending back (sensor) data and receiving commands to act on. The cloud security policies should ensure that all traffic from and to the devices are monitored and highly controlled. As more powerful devices, such as smartphones, are increasingly becoming part of the IoT network, it is not unlikely for hijacked devices to be used as botnets to launch attacks to other systems.
Deploying DNS firewalls and traditional IP management strategies can help identify and weed out compromised devices, helping prevent denial-of-service attacks by making sure that IoT architecture does not allow any communication from the devices unless there is a business reason to accept them. Additionally, active monitoring of device-originated traffic is also a very effective way of determining potentially compromised systems. As with any security architecture, a holistic approach to IoT security requires the constituents of the whole system to be designed carefully without allowing any particular node to constitute a weak link. Planning for cloud security will play the essential role for defending IoT systems against security compromises, allowing IoT to reach its true potential while protecting networks in tandem.
