Internet Of Things Security

If you are building an Internet Of Things (IoT) device then you are likely extending your network to a much wider audience. For example, you may be deploying a light bulb device that connects to a home hub. The home hub then reports back some status information or commands back to a web service you have made. The web service then passes some information back to your CRM system. It is possible to draw a straight line of communication from the users’ homes to your CRM system. Cyber-attacks often begin with malicious software taking control of a “soft” target such as an IoT device and then using that target to leap frog on to other systems.

The Perimeter Has Gone

In the good old days, network security was a lot simpler. A network perimeter was established and secured. DMZs (a tightly controlled network perimeter for exposing services) were used to store services that were externally accessed or VPNs were used for well-known users to tunnel into the network to access restricted resources. The expansion of Internet of Things solutions and devices means that the network perimeter no longer exists as a simple line. Obviously, cloud hosting and DMZs can still be used to mitigate some of the risks, but nevertheless, IoT devices are deployed outside the secure network and are open to tampering and reverse engineering.

IoT Security and Securing the Device

Multiple layers of security are required on your IoT devices as they represent the edge of the network and the starting point for an attacker. There are two types of security to consider here: authenticating the device and authenticating the user.

Authenticating the user should be done using a token-based system such as OAuth. This means that a centralised identity provider (e.g. a Google account or similar) can be used to log a user on to a device. The device then receives a temporary token which can be used to authenticate the user to external services (e.g. the web service that the device talks to). The token can be stored using a secure encryption key (more on this in a moment). The user’s Google password is never stored by the device and so cannot be compromised.

Authenticating the device is a little more involved, but the technology is well established. The device should contain a Hardware Security Module (HSM) (Bitlocker fans may know of the popular TPM chip which can be used on Windows PCs). The HSM is responsible for storing secret information on the IoT device such as encryption keys. An HSM is a tamper-proof microprocessor that can store information that needs to remain secret. Using public key encryption protocols, each device can have a unique key assigned to it and stored securely in the HSM. The HSM can use this key to “sign” its communications with external web services, thus guaranteeing that calls into the network from devices come from genuine devices and not hacker clones.

The Rest Of The Network

For the rest of your network, follow your normal recommended practices. Secure your endpoints, monitor network activity, scan for code injection, use firewalls and virus scanners. Consider cloud hosting your resources so that you can benefit from the billions of dollars spent on security by giants such as Microsoft, Google, Amazon etc.

IoT is changing the way we think about security. A huge amount of your security knowledge is still valid and you have a few new things to learn about securing endpoints (such as IoT devices) that are outside your network perimeter.

If you are interested in learning more about cloud solutions in relation to IoT, then please read our previous post, regarding the Microsoft Azure IoT Hub.

Alternatively, if you are interested in McKenna Consultants helping you with your IoT security or would like to know more about our IoT services and Internet of Things Solutions, please fill in the form below or contact us.