How do you set up and maintain a sufficient security framework? And how do you keep the IoT system secure while scaling your business? We asked innovation manager Jaap Kautz a few questions about IoT security.
How do you set up a security framework?
Building an IoT security framework takes a four-step approach. The first step is risk assessment, in which you need to ascertain the most significant risks. Secondly, for every risk mitigation several layers of security have to be implemented. These two steps already constitute the base of a secure system. However, to validate this, you need to carry out penetration tests. In addition to these tests, it is necessary to monitor the system continuously to detect any threats. The security of your IoT solution is not a one off, you need to do regular firmware updates to keep the system protected, keep testing and checking: Keeping your security up to date is an ongoing task.
What do you mean by implementing several layers of security?
There are several components in an IoT system: hardware devices, firmware, communication between the devices and the cloud, backend system, database, and frontend system. To secure all these components of an IoT system, you need to add multiple layers of security to each component. For example, preventing access to data on the device, ensuring the data on the device is hard to read while also encrypting it.
What are the key ingredients in creating a high-quality IoT security system?
First of all, you need to secure every component of your system in more than one way. Secondly, being able to update with the latest security measures is essential. Creating a system that is secure today is not good enough for the threats of tomorrow. However, securing each component is complex, and protecting the entire system from attacks is even more complicated. Knowledge in-house or an experienced partner is recommended to oversee all constituents.
Is there a part of an IoT system that is most vulnerable to security breaches?
Technically there is not. Each component should be secured similarly. In practice, humans are the uppermost vulnerability of any IoT system. When choosing a password or configuring, malfunctions happen. One of the fundamentals of IoT security is to automate and standardize as many steps as possible. By doing this, you reduce the chances of human error and, in turn, security flaws. If a human error still occurs, an additional step in security is to limit the damage that can be done in that case.
Bolt-on engineering is another practice that creates many vulnerabilities. This means that you build your system on top of partially existing systems by adding software components to it. A better solution is to design your IoT system from the ground up and incorporate IoT security from the start, also known as ‘Security by design’.
‘Security by design’ is an often-mentioned term. Could you explain what that means?
As IoT started gaining ground, companies mostly focused on getting their system to function successfully. Only after their system was up and running, they realized it needed to be secured. We now know that security is an essential aspect of IoT systems and therefore already incorporate it at the first conceptual stages of the product design. For example, BACE IoT devices have a secure element installed that provides cryptographic operations on the hardware device. This secure element has no other functionality than enabling secure communication. By incorporating IoT security in the first stages of design and implementing security features in the hardware, you avoid difficulties in a later stage.
What can be the consequences of a security breach?
The consequences depend a lot on the application. IoT systems have different purposes, such as measuring parameters in the field or controlling devices remotely. For measurement systems, a security breach can lead to incorrect or missing data and devices falling out. Control systems, when not well protected, are at risk of attackers gaining control of the devices. A malicious person can then obtain data or use the devices to perform attacks on secondary devices or websites. For instance, back in the days, IoT devices were often used to perform a distributed denial of service (DDOS) attacks on websites. Malicious attackers would take control of an entire fleet of IoT devices and use them for an orchestrated attack on a website, which then would break down.
One of the most common attacks is DDOS. What can we do to prevent this?
Attackers can orchestrate DDOS attacks due to many vulnerabilities in the design of the IoT system. One way to prevent this is by using different credentials for every device to ensure that if attackers gain control over one device, that device does not give any information about the entire fleet. Another measure is to fully secure the cloud environment and make sure your device is connected to that cloud environment and not to the cloud environment of a potential attacker. These two courses of action ensure that most of the weaknesses exploited in a DDOS attack are mitigated.
What happens to IoT security when you want to scale your business?
It depends a lot on how you designed your IoT system. If it is built with security in mind, then it should be possible to scale without introducing additional vulnerabilities. The framework is already solid and ready for scale-up. Also, by automating and standardizing every step, scaling up becomes even easier. One of the solutions for this is over-the-air (OTA) updating. In order to be future-ready, the IoT systems need to be adaptable to new threats of the future. In addition to software updates for new functionalities, you also have to perform regular security updates so that your IoT solution remains well protected. With OTA updates, you can update the system remotely and ensure that the device that is secure today is still secure in ten years.
With more and more devices getting connected to the internet, IoT security is essential. New systems need to be secure, but they also need to be well suited to install new security features in the future. Upscaling the system while maintaining a high-security level is a challenge that you should not underestimate. IoT security requires specialized skills.
