Last night GCHQ announced it has teamed-up with Hive to publish new guidelines for IoT security. This is a much-needed initiative because failures in IoT security are now making headlines news every week, driven by a combination of carelessness (or at least underestimation of the problem) and malicious activity.
Security has become a critical factor in managing IoT, on both small-scale and very large systems. DevicePilot monitors the vital signs of IoT devices to provide security management across the whole network, catching threats and vulnerabilities early. Without DevicePilot your IoT security is vulnerable. So let's examine the problem and then how you can use DevicePilot to establish and maintain your IoT security.
Why is IoT security hard?
IoT represents the unfortunate combination of a target which is both attractive to attack and yet hard to defend. IoT devices make attractive targets because:
- Hackers like to spend their time attacking large-volume targets which can be accessed entirely remotely, which by definition includes the 20bn+ connected devices deployed today. Compared with e.g. physical attacks, cyber attacks are entirely "scalable" - if a hacker finds a vulnerability in a single device, there's almost no additional cost to build an automated system to attack that flaw in its millions of sibling devices.
IoT devices are particularly hard to defend because:
- IoT devices are by definition connected over a public network which means that they cannot be protected inside a walled-garden with a firewall, as servers can.
- IoT devices are deployed into the real world, where a hacker can often gain unlimited physical access to them. Want to find out the weakness in a new consumer device? Just buy one and there is no limit to how you can attack it physically (e.g. attaching a debugging cable to read its memory or change its behaviour) or electronically (creating a man-in-the-middle to watch its network traffic). If all devices contains a shared secret (for example a private key used for signing messages to the server) then that key will be compromised.
Security is a process
From the first installation of code in a device at manufacture (and perhaps a root certificate), to the dance that happens to establish a trusted connection when a device first goes live, to all the various events that can happen to a device during its lifetime (including upgrading its code, and replacing a broken device), devices remain secure only if processes are followed correctly. There are principally two ways that DevicePilot can massively help to increase your security and situational awareness:
- Notify: Problems will happen - ranging from a one-off problem with a device (perhaps caused by a bug in a rarely-executed code path) to something drastic that affects all devices (such as the expiration of all device certificates - yes, we've seen this happen!). The secret is to be prepared for the unexpected, which means constant vigilance. DevicePilot can easily be configured to warn if individual devices encounter unexpected situations that warn of a security problem, but also (with the new "KPI action" feature) to warn if overall device performance changes over time in some way which might mean that devices have been compromised. For example, a sudden decrease in battery life might mean that a device is running malicious code.
- Audit: When you discover a new problem you need to be able to rapidly audit your device estate to discover the extent of the problem and therefore the best plan of action.
- Automate: As far as possible automate all security processes, so that they are done right, and done immediately, every time. DevicePilot can help with this by turning what might otherwise be a reactive human process into an automated one, with DevicePilot spotting that a device has entered a state where action is required, triggering the action.
DevicePilot puts you in control
With DevicePilot all three of these approaches can be combined. To take a recent example, imagine that you're a router manufacturer and you've just discovered a hole in your security processes which allows hackers to gain access to your router from the internet and turn it into a botnet (for example, via a poorly-protected management interface with a factory-default password).
- You should be the first to know about the problem, rather than reading about it in Hacker News, so with a carefully crafted set of DevicePilot Notifications you can get an early heads-up that something is wrong with a small and growing number of devices. It's rather like monitoring the vital signs of a human - if the temperature or blood-pressure goes up it's a sign that something bad is happening. Once DevicePilot has drawn your attention, your engineers can diagnose the problem and start to craft a solution.
- At this point you'll want to Audit the extent of the problem - how many of these routers have been deployed and are still in use? How many are running the version of code with the vulnerability?
- Then finally when it comes to rolling-out updated code to fix the problem, you'll want to Automate this to ensure that it is done to every device (even devices that are currently offline, once they come back online).
DevicePilot brings peace-of-mind to IoT security as it does to every other aspect of device estate management. With DevicePilot you can get onto the front foot to minimise security vulnerability, be the first to know when inevitable problems do occur, and rapidly and completely resolve them. Contact us today for a demo.