What is internet of things?
The Internet of things describes the network of physical objects—“things” or objects—that are embedded with sensors, software, and other technologies for the purpose of connecting and exchanging data with other devices and systems over the Internet
The Internet of Things, or IoT, refers to the billions of physical devices around the world that are now connected to the internet, all collecting and sharing data. Thanks to the arrival of super-cheap computer chips and the ubiquity of wireless networks, it’s possible to turn anything, from something as small as a pil to something as big as an aeroplane into a part of the IoT. Connecting up all these different objects and adding sensors to them adds a level of digital intelligence to devices that would be otherwise dumb, enabling them to communicate real-time data without involving a human being. The Internet of Things is making the fabric of the world around us more smarter and more responsive, merging the digital and physical universes.
What are IoT devices?
IoT devices are the nonstandard computing devices that connect wirelessly to a network and have the ability to transmit data, such as the many devices on the internet of things (iot)
IoT involves extending internet connectivity beyond standard devices, such as desktops, laptops, smartphones and tablets, to any range of traditionally “dumb” or non-internet-enabled physical devices and everyday objects. Embedded with technology, these devices can communicate and interact over the internet. They can also be remotely monitored and controlled.
What is an example of an IoT device?
Connected devices are part of an ecosystem in which every device talks to other related devices in an environment to automate home and industry tasks. They can communicate usable sensor data to users, businesses and other intended parties. The devices can be categorized into three main groups: consumer, enterprise and industrial.
Consumer connected devices include smart TVs, smart speakers, toys, wearables and smart appliances.
In a smart home for example, devices are designed to sense and respond to a person’s presence. When a person arrives home, their car communicates with the garage to open the door. Once inside, the thermostat is already adjusted to their preferred temperature, and the lighting is set to a lower intensity and color, as their smart watch data indicates it has been a stressful day. Other smart home devices include sprinklers that adjust the amount of water given to the lawn based on the weather forecast and robotic vacuum cleaners that learn which areas of the home must be cleaned most often.
Enterprise IoT devices are edge devices designed to be used by a business. There are a huge variety of enterprise IoT devices available. These devices vary in capability but tend to be geared toward maintaining a facility or improving operational efficiency. Some options include smart locks, smart thermostats, smart lighting and smart security. Consumer versions of these technologies exist as well.
In the enterprise, smart devices can help with meetings. Smart sensors located in a conference room can help an employee locate and schedule an available room for a meeting, ensuring the proper room type, size and features are available. When meeting attendees enter the room, the temperature will adjust according to the occupancy, the lights will dim as the appropriate PowerPoint loads on the screen and the speaker begins his or her presentation.
Industrial Iot devices are designed to be used in factories or other industrial environments. Most IIoT devices are sensors used to monitor an assembly line or other manufacturing process. Data from various types of sensors is transmitted to monitoring applications that ensure key processes are running optimally. These same sensors can also prevent unexpected downtime by predicting when parts will need to be replaced.
If a problem occurs, the system might be able to send a notification to a service technician informing them what is wrong and what parts they will need to fix the problem. This can save the technician from coming on site to diagnose the problem and then having to travel to a warehouse to get the part needed to fix the problem.
How do IoT devices work?
IoT devices vary in terms of functionality, but IoT devices have some similarities in how they work. First, IoT devices are physical objects designed to interact with the real world in some way. The device might be a sensor on an assembly line or an intelligent security camera. In either case, the device is sensing what’s happening in the physical world.
The device itself includes an integrated CPU, network adapter and firmware, which is usually built on an open source platform. In most cases, IoT devices connect to a Dynamic Host Configuration Protocol server and acquire an IP address that the device can use to function on the network. Some IoT devices are directly accessible over the public internet, but most are designed to operate exclusively on private networks.
Although not an absolute requirement, many IoT devices are configured and managed through a software application. Some devices, however, have integrated web servers, thus eliminating the need for an external application.
Once an IoT device has been configured and begins to operate, most of its traffic is outbound. A security camera, for example, streams video data. Likewise, an industrial sensor streams sensor data. Some IoT devices such as smart lights, however, do accept inputs.
HISTORY OF IOT
The broadest definition of IoT encompasses anything and everything that connects to the internet, including your smartphone, tablet, desktop and laptop. However, the term is often used in a slightly narrower sense in that the “things” being referred to are other objects that can talk to each other – smart speakers, plugs, lights, heating systems, fridges, cars, etc. – as we have come to assume that smartphones and computers are already internet connected. Strictly speaking, though, the Internet of Things consists of any device with an on/off switch that connects to the internet – mobile phones and all.
IoT, however, isn’t just about connectivity – it’s about combining the connected devices with automated systems to gather data for the purposes of analyzing that data and taking an action.
Let’s think about this with some IoT examples.
IoT Examples
The smart fridge always seems to come up in IoT conversations, so let’s start there. Say, for example, you’re driving home from work. Your car is connected to your smartphone, which in turn is connected to your smart fridge at home. Your fridge pings a message to your phone letting you know you’re running low on milk. The message comes up on the dashboard of your connected car, which lets you know where the nearest grocery store is, bringing up a map to give you directions. The store’s shelves are also connected, and, lo and behold, your car’s dashboard display pings up the message that your preferred brand is in stock. This is the Internet of Things.
In the workplace IoT examples include inventory-tracking systems that know when you’re running low on supplies and automatically ordering more. Things like smart desks which alert employees when they’ve been sitting too long is another IoT example. So too are smart speakers – such as Alexa for Business – which enable employees to turn on videoconferencing equipment, check calendars, schedule meetings, and find an open conference room with just their voice.
In industries like manufacturing, IoT sensors in machines, equipment, productions lines, warehouses and vehicles can enable, for example, predictive maintenance – where the data gathered from these sensors produces real-time maintenance reports to alert an organization if a machine isn’t working properly or a part needs replacing. With a sophisticated Internet of Things system of this nature, the faulty part can be ordered and a field engineer scheduled to make the necessary repairs before any business disruption is caused.
IoT-enabled tags and sensors are also extremely useful in the supply chain – from the factory to the lorry to the warehouse to the shop floor, the Internet of Things can give organizations a single centralized view of precisely where everything is, how efficiently it’s being produced, how quickly it’s being shipped, and how fast it’s selling. (In fact, this is where the Internet of Things began in earnest – see “History of IoT” below.)
In healthcare, everything from ingestible sensors to connected asthma inhalers and contact lenses are now becoming a reality, alerting patients and healthcare professionals alike from inside the body to the state of ongoing health conditions and how medications are being taken.
WHAT ARE THE SECURITY VULNERABILITIES OF IOT?
IoT Security has been a growing hot topic during 2018, and it is important to understand how to address the top key issues highlighted. Based on OWASP list the top vulnerability issues seem to be the usual suspects! Device Authority’s technology and KeyScaler platform can help mitigate some of these suspects.
Weak, Guessable, or Hardcoded Passwords
Weak, default, and stale passwords are the low-hanging fruit for hackers looking to attack and deploy large-scale botnets, and other malware. Managing device passwords at scale is a daunting responsibility, especially since IoT devices do not typically have human operators to instigate the password change.
Device Authority’s KeyScaler platform provides an Automated Password Management (APM) solution that helps organizations deal with the complexities of setting and managing local account passwords on IoT devices. Centralized policies ensure that the passwords are rotated frequently and securely. Device Authority’s APM solution uses a unique patented technology where only the recipe is used. There is no physical password stored on the device or exchanged over the network, making it the only solution that can withstand any type of password attacks.
Insecure Network Services
When attempting to compromise a connected IoT endpoint, one of the first and simplest attack surfaces is finding weaknesses in the network communication model and network services running on the device. Attackers will aim to exploit a number of vulnerabilities to capture login credentials, communications tokens, or other identifiers that the Service Ecosystem will use to identify the endpoint. It is imperative to secure the endpoint with industry best practices.
Device Authority takes a layered approach where a data-centric privacy model allows for data to be encrypted prior to transport layer network communications. i.e. transport layer security (TLS). Device Authority’s solution mitigates these attacks by implementing industry best practices to enforce confidentiality and integrity of data, preventing any man-in-the-middle attack (MITM) attempting to access the sensitive encrypted data between endpoint and KeyScaler platform. Device authentication data is encrypted at the data-level to the public key and therefore, any captured data would be unreadable without the corresponding private key. In addition, client-side TLS certificate validation mitigates MITM data packet capture.
Insecure Ecosystem Interfaces
To address insecure web, backend API, cloud, or mobile interfaces in the ecosystem outside of the IoT device there needs be regular strong mechanism in place to authenticate and authorize the device. Several use cases have been developed to combat the protection of hardware, firmware and the end-to-end data communications. By ensuring strong authentication with the endpoint, each device is proven to have permission to communicate with the IoT Service Provider. Whenever the back-end services communicate with an IoT device, it will be able to differentiate between a valid endpoint and a clone by forcing the endpoint to authenticate itself. If the device cannot do so, KeyScaler can reject the device.
The above assurance is achieved by using patented technology that interrogates the hardware of a device to ensure that KeyScaler is communicating with the same physical device that was originally registered to the system. The technology utilizes inherent device entropy to query the physical properties of a device, incorporating additional synthetic keys which are dynamically generated and unique to each device for each authentication session. Rotating these synthetic key increases key entropy and helps identify any cloned devices.
Lack of Secure Update Mechanism
Unauthorized software and firmware updates are a major threat vector for IoT cyber-attacks. IoT breaches can have physical consequences that result in loss of data and also introduce substantial legal liability and erode brand reputation.
There are three critical security requirements for delivering updates securely to IoT devices:
- Securing access to the updates
- Verifying the source of the updates
- Verifying the integrity of the updates
Device Authority’s Secure Updates and Data Signing solution delivers each of these critical requirements for IoT environments. Access to secure updates is restricted to authorized devices. Updates are also specifically encrypted for target devices and are not exposed as unprotected software or firmware downloads. Lastly, secure updates ensure that both the update source and the integrity of the updates themselves are verified, delivering end-to-end protection for device updates.
Device Authority’s KeyScaler platform manages the signing and/or delivery of software updates to ensure that both the update source and the integrity of the updates themselves are verified, delivering an end-to-end protection for device updates.
Insufficient Privacy Protection
Device Authority’s approach to consumer privacy and personal information starts with providing security right from the beginning. That means providing data security from the endpoint device itself to establish Device Trust. To ensure the device can be trusted, the device must be enabled with Device Authority’s security technology to provide onboarding in terms of secure provisioning, registration and authentication. Following this, Data Trust can be established so the device can be trusted to send sensitive data across the network. Then organizations can establish and manage device identity and integrity by using policy driven end-to-end data security which ensures end to end consumer privacy.
Insecure Data Transfer and Storage
The protection of IoT data is paramount to the integrity of IoT applications. The data feeding IoT applications result in automated actions and controls that can have dangerous physical consequences. It is critical that both the source and the content of data generated by IoT devices are protected and verifiable. However, data must be encrypted from creation to consumption, and requires a higher level of crypto versatility and intelligence than traditional one-way Transport Layer Security (TLS) encryption can provide.
Device Authority’s policy-driven encryption utilizes our patented dynamic key generation, device-derived key technology and crypto-policy agents to provide “drop-in” application-level crypto that is configurable for specific data payloads and transmissions. The drop-in agents support transparent crypto processing of data sent over HTTP, MQTT, and custom protocols such as ThingWorx AlwaysOn™, which means there is no requirement to change existing applications on devices – simply install the agent and set the policy on the platform to begin securing the data.
Dynamic keys ensure that each data payload can be encrypted with one-time-use keys that are not shared over the network or stored on the device. Individual data elements can be encrypted for dynamic audiences, independently from data transport protocol security.
Lack of Device Management
Device Authority’s KeyScaler platform includes an administrative control panel to manage device onboarding, registration, and security policies. The Control Panel is also a window into the functions and configuration of the system and provides a wide range of security and system management functions. Control Panel access is protected by industry standard Time-based One Time Password (TOTP) which can be generated by any application. The platform provides device control management such as Secure Decommissioning, Endpoint Quarantine and Blacklisting. A registered device can easily be placed under quarantine from the control panel, if they are suspicious of being compromised. This will temporarily block all authentications originating from that device, as well as not receive any further security assets or code updates. Once a device is quarantined, it can be reauthorized, blacklisted or deleted.
It is important to understand the new IoT ecosystems being built, and how the IoT devices will be managed not only from initial install but throughout their lifecycle. As IoT services grow, and the number of deployments grow with it, the sheer scale and size of management of these devices cannot be underestimated. It is imperative to build security in right from the start. Device Authority can help organizations with their IoT security strategy and implement a ‘Secure by Design’ approach from the very beginning.
Drop your comment
