The gravest concern after choosing the right M2M platform and overcoming the challenges in the process of implementation is securing it. While leveraging an M2M platform, companies connect their workforces and mobile resources for gathering or exchanging a lot of data – data that is valuable for business, is the backbone of the system, and forms the base for decision making. The various applications on the platform that help run the system efficiently are also important business assets. However, as our dependence on such platforms and the number of objects/people interacting through them increases, the issue of security grows even more complex. Moreover, the threats come from both direct and indirect attackers, complicating matters further. Hence security for any solution, must be seen on the following attributes
Value Centric
– Security enhances the value of any architecture
– Security reassures competitive advantage
– Creates business value
Importance Centric
– Security should be built in the architecture
– Security should be built-in the requirements
– Security as an end-to-end solutions
Risk Centric
– Security bridges and gap between risk exposure and ways to minimizing it.
– Security bullets the tools and techniques to mitigate the risk.
The Need of the Hour
Today, machine-to-machine interactions create an ecosystem of connected devices that help achieve organisational objectives. A holistic approach to securing your M2M platform is, thus, imperative for safeguarding assets in an automated computing environment. The M2M environment usually consists of three main units: vertical-specific machine-to-machine devices, wired and wireless communication networks and the machine-to-machine backend server. For the system to work efficiently, an effective security strategy spanning all these facets without hindering the flow of information is required.So what businesses need is an end-to-end measure to counter the risks inherent in an M2M environment for ensuring:
- System tamper protection
- Incorporation of updates in a secure environment
- Availability of a secure test and admin interface
- Web application services and API security
- Firmware authenticity and integrity
- DBMS and application configuration hardening
- Network architecture management and security
- System logging and alerting – activity and integrity
- Securing short and long-term data storage
- System authenticity and integrity
- Program code security
- User data integrity and security
- Confidentiality, integrity and authenticity of communications links and networks
- Reliable access controls
- OS configuration hardening
The Fundamentals
There are three basic principles of security, regardless of the platform or environment.
- Confidentiality: Information should not be disclosed to unauthorised entities, be it a person of a device. A secure platform is one that operates on strict security protocols.
- Integrity: As the information flows from one place to another or through various communication networks, you need to ensure that it cannot be modified or tapped without detection.
- Authenticity: The data sent out or received by the system must be authenticated, along with the sources of information.
Today, all the components of an M2M ecosystem are prone to:
- Physical Attacks
- Configuration Attacks
- Protocol Attacks
- Data & Identity Attacks
- Attack on Cloud Network
- Compromise of Credentials
This means the M2M framework must have checkpoints at various levels so as to ensure that the security of the platform isn’t jeopardised.
- At the solution layer, the design must have security controls for processes, policies and procedures.
- At the intelligence layer, business rules must be defined to reduce the risk of unauthorised actions or data access.
- At the interconnection layer, a smart system must be used to ensure that the M2M devices are securely interconnected.
- At the instrumentation layer, it must be ensured that the devices and data sources are known and well under control.
A Concept-based Model
Communication channels between the various components of an M2M environment can be secured through authorisation, authentication and encryption. This would entail creating a model based on realms and user/s or authorities, where
- realm is the database of those with the same authentication and authorization privileges
- users are external sources or people entitled to access the protected resources (as defined by access rights)
Once such a model is in place, is would become easier to ensure that the ability of executing certain functionalities is dependent on permission and ownership. Permissions and access controls should be role-based and explicitly define what a user can and cannot do. This would also ensure that once a command is executed, the user is responsible for the changes reflecting on the system as a result.
The access to resources should be protected through authorization and authentication. The user could login with a username and password assigned to him. Also, to take it a step further, timelines could be defined wherein a user could gain access to the resources only for a limited time period with prior authorization granted by another user with more privileges.
In addition, security-relevant events should be logged. Whenever a user makes any changes to the data, application, access rights, etc. that might have an effect on the functioning of the system, the event should be recorded for reference or auditing purposes. This would increase transparency and ensure ownership.
Moreover, as the number of machine-to-machine transactions continues to increase, not only must the M2M platforms be physically secure, but outgoing information must also be encrypted to ensure that vital corporate data is not compromised.
Aditya is a former Happiest Mind and this content was created and published during his tenure.
