FEATURE

The security issues of

the Internet of Things
Colin Tankard, Digital Pathways
Colin Tankard
The Internet of Things (IoT) was first envisaged in the last century, but interest has
picked up in the past 15 years or so. It is a vision whereby potentially billions of
‘things’ – such as smart devices and sensors – are interconnected using machine-to- easier and remotely activated cameras
machine technology enabled by Internet or other IP-based connectivity. and other networked security equipment
will help to improve physical security.
A recent study by the McKinsey Global implemented as operations management Other benefits are higher operational
Institute estimates that the IoT will have systems get connected to networks. The efficiency, more safety and comfort, and
a potential economic impact of $3.9tn- IoT holds much promise for the energy, lower cost of operation as systems pass
$11.1tn per year by 2025 across nine utilities, medical devices and transport data freely back and forth.
settings – homes, offices, factories, retail sectors, which will see the highest levels
environments, worksites, human health, of adoption in the near term, according “The IoT holds much promise
outside environments, cities and vehicles.1 to SANS, as well as smart buildings. for the energy, utilities, med-
Estimates vary widely regarding how ical devices and transport
many IoT devices will be connected, but Smart buildings sectors, which will see the
an often quoted statistic is from Cisco, highest levels of adoption
which estimates that 50 billion objects Smart buildings are those in which the in the near term”
and devices will be connected by 2020. various systems, such as lighting, heat-
ing, ventilation, air conditioning and The EU has identified further develop-
Potential benefits security, are connected. In terms of secu- ment of smart buildings as an impera-
rity, connected alarms, sensors and track- tive for achieving its goals of a proposed
There are many potential benefits from ing devices will make threat detection improvement in energy efficiency of 27%
embracing the IoT. Verizon estimates
that currently some 10% of organisa-
tions have adopted IoT extensively and
that, by 2025, those that do so will be
10% more profitable than those that do
not. They will be better empowered to
innovate, disrupting both established
players and new entrants, and will afford
their customers better experiences, see
accelerated growth and improved per-
formance, and will be able to improve
safety and reduce risk. For example, IoT
will enable new ways to protect inven-
tory, equipment and machinery, even in
remote locations or over large areas.
According to a recent survey by the
SANS Institute covering organisations of
all sizes, 66% of respondents are either
currently involved in or are planning to
implement IoT applications involving
consumer devices, such as smartphones,
smartwatches and other wearables. Smart
Figure 1: Nine settings identified by the McKinsey Global Institute and their global impact by 2025.
buildings systems are increasingly being

11
September 2015 Computer Fraud & Security
 FEATURE

by 2020, potentially 30% by 2030, under

the Energy Efficiency Directive set out in
June 2015. It states that new buildings
now use half of the energy that they did
in the 1980s owing to the use of new,
smart technologies.
The US is also focusing on this sector,
aiming to increase energy efficiency in
buildings as well as reduce energy costs.
It passed the Smart Building Acceleration
Act in May 2015, which it is hoped will
be a catalyst for increasing the transition to
smart building technology across the coun-
try, in both the public and private sectors.

Security issues
Figure 2: Device-level IoT security vulnerabilities. Source: HP Fortify.
While the IoT holds much promise,
many security issues have been uncov- UÊ ˜ÃiVÕÀiÊÜiLʈ˜ÌiÀv>Vi° taken. Security needs to be built into
ered. Owing to the wide range of sectors UÊ ˜ÃÕvvˆVˆi˜ÌÊ>ÕÌ i˜ÌˆV>̈œ˜É>ÕÌ œÀˆÃ>̈œ˜° products by design. It cannot be bolted
involved and their impact on everyday UÊ ˜ÃiVÕÀiʘiÌܜÀŽÊÃiÀۈVið on afterwards. There are moves, such
life, such security issues can have seri- UÊ >VŽÊœvÊÌÀ>˜Ã«œÀÌÊi˜VÀޫ̈œ˜° as the position being taken by the US
ous consequences, causing damage, UÊ *ÀˆÛ>VÞÊVœ˜ViÀ˜Ã° Food and Drug Administration regard-
disruption to operations or, in some UÊ ˜ÃiVÕÀiÊVœÕ`ʈ˜ÌiÀv>Vi° ing medical equipment, to encourage
scenarios, even loss of life. In a smart UÊ ˜ÃiVÕÀiʓœLˆiʈ˜ÌiÀv>Vi° manufacturers and facilities to ensure
building – where systems ranging from UÊ ˜ÃÕvvˆVˆi˜ÌÊÃiVÕÀˆÌÞÊVœ˜vˆ}ÕÀ>LˆˆÌÞ° that appropriate security safeguards are
HVAC (heating, ventilation and air UÊ ˜ÃiVÕÀiÊÜvÌÜ>ÀiÉvˆÀ“Ü>Ài° built in from the start of the design
conditioning), lighting and door access UÊ *œœÀÊ« ÞÈV>ÊÃiVÕÀˆÌÞ° process, as well as to remain vigilant
controls, to video surveillance and eleva- This is echoed by recent research regarding new risks and threats as
tors, are all interconnected – a security undertaken by HP Fortify, the findings they are uncovered. This is especially
threat that is exploited to disrupt power of which are shown in Figure 2. Overall, important since it has already been
or lighting could cause loss of life if it it found that 70% of the most com- demonstrated that implantable medical
were something like a hospital. In office monly used IoT devices contain security devices such as pacemakers and defi-
buildings, a door access control that is vulnerabilities and there are an average brillators can be remotely hacked and
hacked could provide an intruder with of 25 security concerns per device. exploits such as changing dosage levels
unauthorised access. Issues with IoT Among the reasons for this is that of insulin pumps have been accom-
devices are far from hypothetical: one many IoT devices are not developed plished from a distance of up to 300
example of a threat is the Stuxnet worm, with security in mind. Many contain metres. As well as this, the University of
which has been seen to be able to dis- embedded software, often proprietary Michigan has shown that the majority
rupt industrial control systems, causing firmware, which is problematic to patch of hospital devices use Windows XP or
extensive damage. and upgrade, leading to vulnerability and Windows 95 operating systems, which
configuration management issues. Many are extremely vulnerable to computer
“A different stance needs devices do not undergo any kind of secu- malware, and many monitoring systems
to be taken. Security needs rity review. According to SANS, just 52% use open wifi connections that can be
to be built into products by of IoT devices undergo security evalua- hacked.
design. It cannot be bolted tions or testing prior to production. Building in security by design means
on afterwards” that controls need to be introduced at
Solving the security the operating system level, should use
A range of security risks have been uncov- the device’s hardware security capabili-
ered in the devices themselves that make up
challenges ties and should extend right up through
the IoT. OWASP has identified the top 10 To solve the security challenges of IoT the device stack to the applications it
such issues involved with IoT devices:2 devices, a different stance needs to be deploys.

12
Computer Fraud & Security September 2015
 FEATURE

In order to address security through-

out the device lifecycle, from the initial
design to the operational environment,
software vendor Wind River states that
there are five essential requirements:
1. Secure booting – the authenticity
and integrity of software on a device
should be verified via a digital signa-
ture attached to the software image
and verified by the device to ensure
that it has been authorised to run
on that device and that there are no
runtime threats or malicious exploits
present. Only then will it be allowed
to load.
2. Access control – mandatory or role-
based access controls should be built Figure 3: Top controls currently in place for securing the IoT. Source: SANS Institute.
into the operating system. If compro-
mise of any component is detected, Essential steps information can be viewed and how it
access to other parts of the system is communicated and stored. All data
should be minimised as much as pos- It is unlikely that security will become held on devices or in transit should be
sible. This will help to minimise the an over-arching requirement in the encrypted to safeguard it from unauthor-
effectiveness of any breach of secu- design process any time soon. There are ised access or loss. In terms of devices
rity. also standards that need to be developed that are lost or stolen, device manage-
3. Device authentication – a device before this happens and it is also likely ment tools that extend to remote data
should authenticate itself at the that some form of regulation or specific wipe should be considered, especially
point at which it is plugged into the industry pressure will be required in for consumer devices that are personally
network, prior to receiving or trans- order to force manufacturers to place the owned.
mitting data. Machine authentica- necessary emphasis on security. For devices used for business opera-
tion only allows a device to access a Organisations should look to limit tions, systems will need to be used
network based on credentials that are what is allowed in the workplace, con- to link physical and network security
stored in a secure storage area. sidering the risks versus the benefits, and together to enable a total view of inci-
4. Firewalling and IPS – each device look at how systems are interconnected dents, enabling management to make
needs to have a firewall or deep and therefore how risks such as malware decisions regarding the threat posed and
packet inspection capability for infections can be spread. how it can be controlled. This requires
controlling traffic, but this requires that all IoT devices are managed the
that protocols are needed to identify “Systems will need to be same way as other equipment connected
malicious payloads hiding on non-IT used to link physical and to the Internet and the network. All
protocols. And these protocols need network security together activity should be closely and continu-
to be industry-specific since – for to enable a total view of ously monitored to look for anomalies
example, smart energy grids have incidents, enabling man- from normal baseline behaviour and
their own set of protocols governing agement to make decisions organisations should ensure that all
how devices talk to each other. regarding the threat posed” devices are correctly configured and are
5. Updates and patches – the ability to operating properly.
deliver software updates and patches Organisations also need to find a way Where anomalies are uncovered,
to thousands of devices in a way to enforce data protection policies on organisations need to have workflow and
that conserves limited bandwidth all devices in use and to control what escalation procedures in place so that
and intermittent connectivity of data people can access. Identity and those in charge of security are alerted
embedded devices, while ensuring access rights should be tightly managed promptly to any potentially serious secu-
that there is no possibility of func- in order that all devices and connec- rity threat or incident. This will help
tional safety being compromised, is tions are authenticated and authorised, greatly in the time taken, and therefore
a necessity. and controls should be placed on what cost, for remediating problems. It is

13
September 2015 Computer Fraud & Security
 FEATURE

essential that all procedures and process- But the industrial IoT holds the great- policies in place, and keeping a constant
es are documented, completed in a com- est promise, offering to improve produc- eye over what is connected to their net-
pliant way and an audit trail is generated tivity, ease safety issues and reduce opera- works and how devices are performing.
to provide evidence of the effectiveness tional costs in a wide range of scenarios
of actions taken. and industries. About the author
Figure 3 illustrates the controls that Organisations would be well advised Colin Tankard is managing director of data
organisations currently have in place for to thoroughly research the risks security company Digital Pathways which
controlling IoT devices in the workplace involved in each scenario in which IoT specialises in the design, implementation
according to the SANS Institute. devices are deployed and to communi- and management of systems that ensure the
cate with employees, partners and cus- security of all data whether at rest within
Remain vigilant tomers about security and privacy risks, the network, mobile device, in storage or
especially, where sensitive data is at risk. data in transit across public or private net-
While it could be said that the IoT is still This should include both consumer works.
in its infancy, IoT devices and increased devices that they wish to purchase and
connectivity are being seen across a wide use to interact with corporate informa- References
range of sectors. Many will be familiar tion, as well as how devices used, for 1. Manyika, J; Chui, M; Bisson, P;
with consumer-oriented smart, highly example, in smart buildings should Woetzel, J; Dobbs, R; Bughin, J;
connected devices and these are invad- be closely monitored and maintained. Aharon, D. ‘Unlocking the potential
ing the workplace. Organisations are still One point of failure in a hyper-inter- of the Internet of Things’. McKinsey
grappling with the BYOD phenomenon connected network can initiate a chain Global Institute, June 2015 Accessed
that has an increasing array of person- of events that could have catastrophic Aug 2015. www.mckinsey.com/
ally owned smartphones and tablets consequences. insights/business_technology/
being used for work purposes, creating The IoT appears to be an unstoppable the_Internet_of_things_the_value_
headaches for many in terms of manag- force and the rising tide of devices can- of_digitizing_the_physical_world.
ing them and controlling what sensitive not be turned back. Until security issues 2. ‘OWASP’ Internet of Things Top
data can be accessed. Now this is being are solved, organisations need to be 10 Project’. OWASP. Accessed Aug
extended to wearables such as smart- vigilant, ensuring that they weigh-up the 2015. www.owasp.org/index.php/
watches and health and fitness monitor- security risks against the benefits to be OWASP_Internet_of_Things_Top_
ing devices. gained, putting appropriate controls and Ten_Project.

Big data – the future

of cyber-security or
its latest threat? Cath Everett

Cath Everett, freelance journalist

Everyone seems to be talking about big data lately. The much-vaunted ability
to analyse large diverse data sets very quickly really does appear to have become
the hottest of hot tech topics over the past few years. In fact, big data, despite
being such an over-used term, has even managed to worm its way into main-
stream public consciousness – mainly because of the insights it has been able to claiming that information security is big
afford by finding patterns in what often appears to be unrelated information. data’s killer app. But is there any truth in
such hyperbolic statements? And if so,
what is this future likely to look like? As
Killer app the computer press recently extolling the usual, views are mixed.
In an industry context, meanwhile, a technology’s virtues and dubbing it the According to Peter Wood, chief execu-
raft of glowing articles have emerged in future of cyber-security – or alternatively tive of information security consultancy

14
Computer Fraud & Security September 2015