Critical Success Factors to Widespread Deployment of IoT

Digital technology and connected IoT devices have proliferated across industries and into our daily lives. Electric grid utilities are deploying smart meters to better correspond to consumers energy demands while lowering costs. Connected medical devices, such as insulin infusion pumps and pacemakers, are assisting doctors to treat and help even the most remote patients. Sensors are used for traffic management in big cities to lower the impact of traffic jams during peak commuting hours. Finally, IoT devices are being used extensively in smart vehicles and home appliances to provide enhanced user experiences. These connected devices provide enormous opportunities and benefits for citizens, consumers and businesses.

Threat vectors on IoT

Besides the obvious benefits, IoT devices create an expanded threat landscape and have already been exploited in numerous cyber attacks (e.g., Mirai, Jeep Hack, etc.) The root cause of these attacks is that the devices are lacking the security mechanisms to defend themselves against malicious actions that lead to the control of hijacked devices.

There are three major threat vectors that harm IoT deployments:

• Devices are hijacked by malicious software;
• Data collected and processed in IoT ecosystems is tampered with and impacts the confidentiality, integrity and availability of the information; and,
• Weak user and device authentication.

The common denominator in IoT attacks is the assumption that these simple devices do not require strong security measures. The truth, however, is far from that. An IoT device connected to a network is simply a potential bridge between the internet and a malicious entity.

Security mindset is changing

However, the security mindset is changing. Driven by the need to secure themselves against increasing threats, organizations (both manufacturers and IoT consumers) realize that they need better built-in security. Security vulnerabilities in IoT products can seriously expose manufacturers and service providers to cybersecurity risks, resulting in reputational damage and heavy fines for violating security and privacy legislation.

To safeguard users against the implications of flawed IoT devices, governments and international organizations have published regulations, including:

• The IoT Cybersecurity Improvement Act of 2020 in the United States, which provides guidelines for Federal agencies to purchase secure IoT devices;
• The Food and Drug Administration (FDA) for the premarket and postmarket management of cybersecurity in medical devices; and,
• The EU Cybersecurity Act of 2019 with its Cybersecurity Certification Framework.

In support of these regulations, NIST and ENISA have published baselines and guidelines to drive the secure-by-design development of IoT products.

Secure software validation and verification

The common context behind these regulations and guidelines is secure software validation and verification. Distributed devices require secure mechanisms (which may be conducted in-line or over-the-air) to securely deploy upgrades and patches to heal bugs.

The importance of secure software validation is highlighted by two recent security events:

• The SolarWinds supply chain attack, where malicious actors got inside the development operations of SolarWinds and managed to insert malware inside a software update that was distributed by the company in March. Once installed, the malware “phoned home” to a command-and-control network run by the hacking group, which enabled them to enter the network and take further action. The attack affected numerous U.S. federal agencies, cybersecurity companies and industrial industries; and,
• Mimecast SSL certificate compromise for customers to securely connect Microsoft 365 Exchange to their services.

A chain of trust through certificate lifecycle management

To secure data exchanged between IoT devices and the software required for operating these devices – bootstrap, firmware, apps – we need to establish a chain of trust. The use of digital certificates to sign code, ensure mutual authentication of devices connected to corporate networks, and encrypt data traffic is a well-established and effective solution.

To reap the benefits of digital certificates, a robust certificate lifecycle management process needs to be established and enforced, which will include generation, transmission, manipulation, rotation and retirement of associated keys. The key to effective certificate lifecycle management is the secure storage of the cryptographic keys to avoid compromise.

To securely protect these keys, NSA strongly recommends “deploying a FIPS validated Hardware Security Module (HSM) to store on-premises token signing certificate private keys.” The use of FIPS-140 Level 2 or higher certified HSMs ensures the protection of code signing keys. IoT manufacturers may elect either using an on-premises HSM or (even better) using a managed, on-demand cloud-based HSM service.

How users benefit from IoT security protection

There are three key factors worth considering when investing in enhanced IoT security:

• By enforcing that only authorized and validated IoT hardware and software can run in the system, and the data collected and processed by the IoT devices will remain secure, the risks of counterfeit products, malware entering the system, or data breaches will be greatly reduced. This shields the system from attacks by malware, protects systems from security and privacy breaches, and thus safeguards the trust and investment of manufacturers and users;
• IoT components and systems that are regulatory compliant earn their tickets to market entry. This also demonstrates the care taken by manufacturers and service providers and will enhance the consumers’ trust and their shareholders value; and,
• Sustainable operation is now possible through continual validated support and upgrades. Customers benefit from the constant product and service enhancements while the manufacturers and service providers can provide such maintenance and receive recurring revenue in return.

How Thales can help secure IoT deployments

Thales has developed IoT solutions that provide data encryption for IoT data, and management of encryption keys for IoT devices. Thales IoT security solutions can help you defend against attacks and data loss, reduce operational costs, and protect revenue and reputation. Thales’s HSMs and CipherTrust Data Security Platform also provide a root of trust for connected devices and edge-to-cloud data protection.

In our next blog we are going to explore some use cases to understand the importance of IoT security. In the meantime, read my recent post on LinkedIn about enabling safe and secure IoT deployment.