Mohit Mehta, Vice President and Commercial Leader: Cloud, Infrastructure and Security – Global Growth Markets, at the digital and cloud company Cognizant discusses how IoT devices can balance security requirements with cost and complexity.
A staggering 25 billion IoT devices are expected to be in the world by the end of 2020, many of them in our homes, from fridges and thermometers to cameras and speakers. Yet, while IoT technology introduces convenience and benefit to our everyday lives, the devices also make us more vulnerable to cyber criminals.
As IoT technology and its areas of application advance, cyber-attacks are also becoming increasingly sophisticated. Unfortunately for those of us that are living in smart homes, IoT devices are a hacker’s top target, with their many points of access and internal vulnerabilities often open exploit.
To help protect end-users and their data, manufacturers need to implement a number of measures aimed at optimising device level security.
Knowing where you are vulnerable
Almost 70 per cent of the IoT devices and deployments in the world have not been designed with security at the core of the design. This poses a problem, particularly because the firmware, default credentials, operating systems, connectivity options, and application update processes can be an easy target for hackers. Hackers have been show to use these vulnerabilities as access points to spread malware.
As a result, the number of attacks relating to IoT has increased significantly over the last few years. In fact, it has been reported that cyber-attacks on IoT devices surged by 300 per cent in 2019 alone, which equalled a total of more than 2.9 billion events. Most of these attacks were related to devices or systems being compromised due to nefarious activities, such as eavesdropping, interception or hijacking. Poor code development and insecure code libraries usage is also one the most common threats, eventually enabling hacking and malware incidents.
Optimising device-level security
With limited solutions available that can deliver a fully secure end-to-end device security code signing, the onus lies on the IoT device manufacturer to incorporate security – and it is vital that organisations ensure the manufacturers have done so, before moving ahead with purchase or implementation. Some of the main areas of focus should be on cyber hygiene such as secure credentials, X.509 certificates, firmware updates, zero-trust network and data security IoT devices and associated networks should also be assessed for vulnerabilities at a regular cadence to stay ahead of the threat curve.
Further connected devices are only as valuable as the operating systems and applications that they execute. Keeping this purpose in mind, businesses can work with consulting firms to architect IoT security in every layer of the technology stack – from the device to the application to cloud – and create processes that protect data flows from devices, assets, products and places in the cloud.
To find balance between security, cost and complexity, it is important that organisations and their IT teams follow some best practice guidelines, including:
1.Ensure you have visibility of the supply chain and external dependencies that are involved in the manufacturing process of IoT device development.
2.Understand the people, processes, and technology that comprise the operational environment.
3.Understand the topology, network and wireless connection points, and connected devices and assets.
4.Identify the key processes and data that need to be protected.
5.Segment the IoT/IT environments to contain and prevent lateral movements.
6.Incorporate secure user stories, threat modelling, secure coding and testing in your DevSecOps cycle.
7.Focus on basic cyber hygiene such as strong credentials, secure protocols, device certificates, IAM, firmware and patch management.
8.Leverage platforms for monitoring through AI and machine learning to track abnormal, suspicious patterns in device, network, data storage and the cloud.
9.Watch critical processes and data for firmware and configuration changes outside the proper change control process.
10.Create and socialise an IoT incident response plan.
All too often, security decisions rely simply on experience and expert advice rather than a structured ‘secure by design’ approach. Building a measurement-oriented security culture, conducting thorough cost-benefit analysis and moving to a more advanced and ever-evolving AI/ML based platform, is a key method to help balance the cost compliance and security coverage aspects.
Securing our future
We, as consumers, should relish the advantages and convenience that IoT devices are bringing to our lives. However, while cyber actors are still at large and becoming more ambitious in their attack methods and victims, it is vital that manufacturers make device-level security an absolute priority. Although cost and complexity naturally are factors involved in improving the security of these devices, there is a way for businesses to achieve this desired balance so that all goals can be met.
