This post is also available in: עברית (Hebrew)
Internet of Things – IoT security breaches have been dominating headlines lately. Even if you personally don’t suffer consequences of the mediocre security of the IoT, your connected gadgets may well be cooperating with criminals. Last October, Internet service provider Dyn came under an attack that disrupted access to popular websites. The cybercriminals who initiated the attack managed to take control over a large number of internet-connected devices (mostly DVRs and cameras) to serve as their helpers. As a result, cybersecurity expert, Bruce Schneier, has called for government regulation of the IoT, concluding that both IoT manufacturers and their customers don’t care about the security of the 8.4 billion internet-connected devices in current use.
Seeing as IoT currents have such a huge impact, here’s a list of the six hottest technologies for IoT security, based on Forbes’s analysis:
- Network security: Protecting and securing the network connecting IoT devices to back-end systems on the internet. IoT network security is a bit more challenging than traditional network security because there is a wider range of communication protocols, standards, and device capabilities, all of which pose signiﬁcant issues and increased complexity. Key capabilities include traditional endpoint security features such as antivirus and antimalware as well as other features such as firewalls and intrusion prevention and detection systems.
- Authentication: Providing the ability for users to authenticate an IoT device, including managing multiple users of a single device (such as a connected car), ranging from simple static password/pins to more robust authentication mechanisms such as two-factor authentication, digital certificates and biometrics. Many IoT authentication scenarios (such as embedded sensors) are machine-to-machine based without any human intervention.
- Encryption: Encrypting data at rest and in transit between IoT edge devices and back-end systems using standard cryptographic algorithms, helping maintain data integrity and preventing data sniffing by hackers. The wide range of IoT devices and hardware profiles limits the ability to have standard encryption processes and protocols. Moreover, all IoT encryption must be accompanied by equivalent full encryption key lifecycle management processes.
- PKI: Providing complete X.509 digital certiﬁcate and cryptographic key and life-cycle capabilities, including public/private key generation, distribution, management, and revocation. The hardware specs for some IoT devices may limit or prevent their ability to utilize PKI. Digital certiﬁcates can be securely loaded onto IoT devices at the time of manufacture and then activated/enabled by third-party PKI software suites.
- Security analytics: Collecting, aggregating, monitoring, and normalizing data from IoT devices and providing actionable reporting and alerting on speciﬁc activities or when activities fall outside established policies. These solutions are starting to add sophisticated machine learning, artiﬁcial intelligence, and big data techniques to provide more predictive modeling and anomaly detection (and reduce the number of false positives), but these capabilities are still emerging. IoT security analytics will increasingly be required to detect IoT-speciﬁc attacks and intrusions that are not identiﬁed by traditional network security solutions such as ﬁrewalls.
- API security: Providing the ability to authenticate and authorize data movement between IoT devices, back-end systems, and applications using documented REST-based APIs. API security will be essential for protecting the integrity of data transiting between edge devices and back-end systems to ensure that only authorized devices, developers, and apps are communicating with APIs as well as detecting potential threats and attacks against speciﬁc APIs.