EFFICIENCY MANAGEMENT EFFECTIVE PRODUCTION

Enterprise dynamics

Industry news

Social responsibility

Videos

Home page

Iot device security: A Guide for technology leaders and users

Release Time:

2021-07-12

The Internet of Things, some call it the next industrial revolution, others call it the lifestyle revolution. Connected cars, connected machines, smart cities, devices that track human behavior, wearable technology, personalized medical devices -- the iot world is filled with countless fascinating applications. A Gartner report suggests that as many as 20.8 billion devices will be part of the global iot ecosystem by the end of 2020. The iot backbone includes advanced communication platforms and cloud computing solutions that enable seamless integration of devices, applications, services, networks and gateways. However, this complexity also exacerbates the security challenges posed by the Internet of Things. This guide aims to highlight the iot device security challenges facing technology leaders and help them address them.

Iot device security: A greater challenge

Iot device security is more challenging than general IT security for several reasons:

▲ Complex security requires computing power. Internet of Things devices don't always have the capacity to host such electronic components due to size limitations.
▲ Cloud data is a real playground for hackers to practice and stick to their nefarious plans.
▲ Man-in-the-middle attack is a known disease of the Internet of Things, but it is still difficult to defeat.
▲ The complexity of the Internet of Things creates a complex network of multiple attack surfaces and multiple potential vulnerabilities.
▲ Since Internet of Things devices are cheap and readily available on the market, it is easy for hackers to become familiar with the hardware.
▲ Most device information is stored in the cloud, making it easy for hackers to forge device identities.

Whatever content the Internet of Things implements, be aware that the security parameters of this data -- confidentiality, authenticity, availability, and integrity -- will require all the protection you can provide.

Requires a dedicated security policy for iot devices

Do you think existing IT security strategies are adequate for the Internet of Things? That was a big mistake. Another common mistake -- IT leaders start looking for an all-encompassing Internet of Things security solution. Assuming that your iot project covers all levels of the technology's entire ecosystem, a single solution simply won't work for you.

Iot needs the best in all aspects of security - physical, operational technology and cyber security, so it makes sense to think of iot security as part of the ecosystem. Because there are multiple layers in the iot ecosystem, all with the potential for unexpected challenges to erupt, this requires leaders to initiate risk assessments so that they can keep an eye out for specific vulnerabilities in the iot. This helps companies build a solid action manual that will allow them to navigate the security challenges of the Internet of Things.

Iot device security: Understanding the device lifecycle

The iot ecosystem is made up of hundreds of devices, each with a single purpose. This is in contrast to devices such as personal computers, where a single computer device can perform multiple functions. The basic equipment life cycle consists of the following steps:

▲ Boot: Load the firmware and start as expected.
▲ Initialization: Read configuration, establish connection and synchronize data.
▲ Operation: long time to perform the specified key functions.
▲ Update: New firmware installed, restart.

Protect every step of the life cycle

At each step, specific security features need to be implemented. Some of these include:

Safe guidance
▲ Firmware integrity check via embedded password to ensure that no tampering has been done.
▲ Firmware encryption based on public/private certificates, so that the startup is completely safe.

initialization
▲ Users need to change the default password of Internet of Things devices.
▲ Encrypt communication between devices, between devices and networks, and between devices and the user interface.
▲ Use a key management system to protect encryption keys.

operation
▲ Delete the Backdoor debugging account. Studies have shown that the existence of such accounts increases the risk of devices.
▲ Highlight the end user's abnormal operations in the device system.
▲ Integrity check during operation to ensure that the device will not be affected during operation.
▲ Host IPS and virtual patches minimize risk before firmware Wireless upgrade (FOTA) is triggered.

update
The new firmware must also be encrypted before FOTA triggers to ensure that the next boot is secure and repeats the life cycle.

More DOS and don 'ts for Internet of Things device security

In addition to the technical details we cover in this article, there are other things to remember about iot device security that can make your entire iot environment more powerful.

When you buy an iot device, make sure it has enough memory and computing power to support the level of security you intend to implement for your iot device. Soon, you'll see an increase in device security issues, as well as manufacturers upgrading devices to support enterprise security goals.

The device you use must be repairable. If you are unable to patch the device, this is a huge security risk that will become more apparent over time. Think about how baby monitors and security cameras have been affected by the Mirai botnet, which also means that older devices need to be used with extreme caution.

Watch out for devices with hard-coded passwords -- they will almost certainly be targeted by hackers. In addition, some devices do not support encryption at all, and their performance will suffer if encryption is introduced. Devices that cannot be updated over the air (OTA) can also put your Internet of Things system at unnecessary risk, so avoid them.

"Things" is the superstar of the Internet of Things, and the speed of its adoption in the enterprise has been impressive. If your business is part of this huge wave, it's important to understand the security core of iot devices. The tips, methods, and tricks shared in this guide can help IT leaders make better purchasing and implementation decisions.

Reprinted in the House of Things