NC1701

FEATUREIOT
THE SECURITY OF THINGS
READY OR NOT, THE INTERNET OF THINGS IS COMING.
IN FACT THE DEMAND FOR IoT DEVICES IS OUTSTRIPPING
ITS ABILITY TO BE SECURE. JOHN SMITH, PRINCIPAL
SOLUTIONS ARCHITECT FOR SECURITY AT EXTRAHOP,
EXPLORES THE ISSUES
Just five years ago BYOD (Bring Your
Own Device) was the hottest topic in IT
security. iPhone and Android had rapidly
usurped the mobile market from Blackberry,
ushering in a wave of connectivity and
unsecured access to enterprise resources
that were not issued, configured or
controlled by IT.
Fast-forward half a decade and a device is
a lot more than a mobile phone. The rise of
connected devices, known as The Internet of
Things, has exploded the number of
endpoints connecting to and communicating
on the network, ranging from personal
fitness trackers to drug infusion pumps and
industrial equipment. Although security for
mobile devices matured following some
hard lessons, IoT security is still in its infancy.
The high demand for IoT functionality and
its advantage is currently forcing solutions to
market without many of the existing
functions and established security disciplines
in place. That means that the security we
depend on for compliance with regulatory
frameworks in our non-IoT systems just
doesn't exist within the IoT estate, and this
provides a greenfield opportunity for
hackers. IoT system owners who want to
have systems accepted and promoted into
production will need to innovate to provide
the necessary auditing and compliance that
is present in existing production systems.
Functions and solutions around logging,
agents, SNMP MIIBs etc. will likely be
missing from these systems.
To bridge the gap between IoT adoption
and security maturation, information
security teams need to implement
monitoring technologies that can
supplement the lack of native auditing and
accountability. While traditional monitoring
tools like agent instrumentation and
NetFlow still struggle to support IoT
deployments at scale, emerging options
that deliver streaming analytics of networkbased
data - so-called wire data - offers
much better visibility into the interactions
occurring between IoT devices and other
systems. Given the broad visibility that wire
data analytics technologies deliver into IoT
devices, they may well become the de facto
standard for monitoring and auditing.
But it's not just information security teams
that need to take a proactive stance.
Consumers need to make themselves
aware of the risks to their privacy when
they deploy IoT-based devices. Businesses
need to move beyond the regulatory
framework and actively test the security of
their IoT devices, implement and enforce
login and authentication policies, and
customise security policies for specific IoT
devices in the environment. Incumbent
policies that may work for existing shared
services are not necessarily appropriate at
the device level.
Most importantly, IoT needs to be
standardised concerning what protocols and
encryption levels are acceptable. While a
regulatory framework is not the only solution,
some standardisation based on the types of
data being transferred, the likelihood of a
breach and its potential impact will be critical.
While the hacking of a domestic Bluetoothenabled
speaker system could prove
annoying, it has nowhere near the impact of
an Iranian centrifuge spinning out of control,
or a hospital unable to perform diagnostic
testing and administer life-saving treatments.
The time to begin planning for this is now,
while the harm is still mostly theoretical.
Proactive policy development and
enforcement, comprehensive monitoring,
protocol and even in-transit encryption
standardisation are all valid options.
In terms of practical approaches, the first
steps should be a baseline audit of what is
attaching to the network, followed by a
schedule of periodic re-detection. The
creation and dissemination of a formal
policy to mandate that end users and IT staff
declare and receive permission for the IoT
devices they would like to add to the
network, should be mandatory. This at least
makes the issue visible and helps to raise
awareness on the part of businesses and
consumers. It is not a solution, but it will go
a long way towards better securing the
connected world. NC
WWW.NETWORKCOMPUTING.CO.UK @NCMagAndAwards JANUARY/FEBRUARY 2017 NETWORKcomputing 17