Is Internet of things Heisenberg and not Walter White?

The automobile manufacturers who showed off their newest models at the New York Auto Show are representative of the opportunities and challenges before all Internet of Things (IoT) hardware manufacturers. Automakers are implementing an incredible range of smart connected technologies to create an amazing user experience, but they also need to focus on user security. That mindset should be the guiding principle for all IoT device manufacturers, no matter their size or business/consumer application.

Increased Connectivity, Increased Risks

A recent McKinsey & Company report on cybersecurity and connected cars states, "Products can be secure only if they are designed with security in mind." As cars become more complex, they require more electronic control units and lines of code. Connectivity enables self-driving or driver-assist capabilities and improved safety features. But connectivity also increases the risk, as these complex safety and navigation systems are more vulnerable to hacking.

That's true of any device that connects to the internet. No matter the device or its application, it shares an underlying need for critical security and authentication with all other IoT devices.

Organizations across a variety of industries are deploying IoT devices to create new efficiencies and a higher level of visibility into operational insights. However, because these smart devices all connect to the network and all collect, analyze and share ever-growing volumes of data, they also create new cybersecurity vulnerabilities. Attackers are always on the lookout for new ways to penetrate organizations' networks and gain access to systems and sensitive data stores. For example, the Journal of the American College of Cardiology warns that personal smart medical devices such as pacemakers could become prime targets for hackers.

More parts suppliers creates a fragmented supply chain. As manufacturers incorporate dozens of connected systems from different vendors, they inevitably build multiple devices that cannot "talk" to each other and share data efficiently (if at all), increasing security risks and raising costs.

Secure By Design

The onus is on all manufacturers those that make individual components like connected car airbags and those that incorporate multiple components into their products like automakers to address security during the design process. The tips below can help assure the proper security considerations in the design of connected devices for all applications (not just cars).

1. Build threat models: Assess the use case of your devices and services during the product design phase. Evaluate the various risks, and build mitigation plans into the overall product design.

2. Create security and abuse cases: Make sure that you put your team to work doing tests to validate your threat model. Put in play a continual evaluation with each product iteration to ensure the threat model continues to meet your threat scenarios.

3. Securely manage keys: Integrate your processes by generating and storing your private keys securely, either using hardware security modules (HSMs) or one of the major cloud-based IoT platforms.

4. Put certificates to use: Enable your devices to use certificates instead of passwords for authentication. Public key infrastructure (PKI) certificates play a critical role in your IoT solution, as they validate a device's identity to only allow authorized devices, users and servers to access the device. Certificates are also used to encrypt data sent to and from the device. Additionally, code signing certificates ensure over-the-air updates are signed with tamper-proof code and that the device securely boots every time.

5. Automate authentication to scale: Scaling authentication is important. Using standardized and proven technologies like digital certificates and certificate enrolment protocols such as SCEP, EST and secure APIs will allow you to scale your security operations as your volumes grow.

Security by design is a methodical process, not an ad hoc undertaking. Failure to adopt this mindset for every single IoT device that rolls off an assembly line will likely lead to the need to make quick fixes to address bugs or newly discovered security threats. That's an expensive, complicated solution that may still fail to make the device more secure because an attacker can develop a workaround to a fix that does not address the vulnerability from a structural standpoint.

According to the McKinsey report referenced earlier, "No one 'silver bullet' can eliminate cybersecurity issues. What's clear is that future automotive designs have to be 'cybersecurity natives,' integrating these concerns into the earliest stages of development."

That holds true for all IoT manufacturers. The time to address security in your connected device designs is now.

Source: HOB

Share This On

Previous Story Next Story

Latest News Feed