The number and variety of devices getting connected to the internet are increasing everyday. Leading analyst estimates indicate that over 26 billion devices will be connected to the internet by 2020 creating the internet of things (IoT). Surprisingly this list excludes PCs, tablets and smartphones, representing an almost 30-fold increase from 0.9 billion in 2009.
Securing the internet of things is increasingly becoming a challenge. With every new device getting connected to internet, the ways in which a system can be compromised are also changing. IoT devices usually have embedded systems, with minimal or zero inbuilt security features. New pathways and vulnerabilities that were once viewed as isolated phenomenon, are now becoming regular system vulnerabilities. New devices, network traffic and new protocols are increasingly getting aggregated becoming difficult to monitor and secure. They are providing cyber criminals innovative ways to enter a system.
Security and IoT
IoT is creating security issues on two fronts. On one hand, the number of connected devices is exponentially increasing, posing a security challenge in the form of new pathways and parameters for the cyber-criminal. On the other, the amount of data that needs protection is also increasing. More and more data is getting created and transferred everyday. The network traffic, database transactions and workloads are increasingly becoming overwhelming, leading to increase in data security issues.
Today there are more “devices with people (DWP)” connected to the internet, so we have intelligent human beings who can be made a part of the solution. However, tomorrow a situation will arise when more “Devices sans people (DSP)” will be connected as compared to DWP. In such a scenario, intelligence and responsibility will need to be built inside the devices itself. This is another problem, the solution to which is yet to be ascertained.
CIO and Security
Here the role of the CISO becomes very important in terms of defining the IT security strategy because the world of IT security is getting fundamentally transformed.
In the world sans IoT, very few devices existed in the Operational Technology (OT) layer, that were connected to the internet or IP enabled. At that time, only the devices in the Information technology layer were connected. Hence, IT security primarily referred to the security of the IT layer and both the IT layer and the OT layer were controlled and secured differently. While IT security mainly focuses on confidentiality of data and network infiltration, OT security emphasizes more on physical security, safety, and business continuity that involves maintaining round the clock availability of critical systems.
It is increasingly seen that more and more devices are getting connected to the internet leading to the OT layer becoming increasingly IP enabled. This in turn is making the IT layer more vulnerable. So the traditional model of IT security – securing the IT layer and the OT layer differently, will have to change. A unified approach is the need of the hour. Today’s CISO will have to devise a unified IT strategy that takes into account the growing interconnected nature of the OT layer.
What this essentially means is that the following will be the drivers of any strategy that will attempt securing the IoT :
Visibility across every layer – The strategy and actions should provide visibility across the OT layer, the IT layer and other layers of the network considered untouchable so far. No layer or devices should be considered safe or untouchable.
Visibility across all kinds of threats – Known threats and attacks through them are soon going to be things of the past as newer devices provide new loop holes and new threat vectors. The strategy should help to see the potential vulnerability in the device, the moment it gets connected to the network and monitor all the potential vulnerabilities rather than waiting for something to happen. What is being referred to here is real time threat/ vulnerability assessment and definition. The library of potential vulnerabilities should get populated round the clock, based on the profiling of new devices added rather than new attacks.
Visibility across all platforms – The creation of monitoring resources should be such that they are platform agnostic. It is the world of continuous updates, open source and self imposed redundancy as far as software platforms are concerned. So a system that is crafted to be platform independent in terms of its ability to monitor and see what’s happening will go a long way in securing the network.
Encryption of Networks – Entire internal networks will have to be encrypted. What we are pointing out here is a point to point and point to multipoint encryption based on network segments, protocols and network flows.
Remediation through automation – The IoT enabled security solutions will need to be developed and implemented in such a way that supports machine to machine intelligence for immediate security control that is automatic and which does no need any human intervention.
As IoT will gain ubiquity, it will change the world of IT through increasing scale, broadening scope and encouraging cooperation. Forward looking CISO’s who understand the need of the hour will be best placed to overcome these challenges posed by IoT and exploit the opportunities presented by it.
Prasenjit is a former Happiest Mind and this content was created and published during his tenure.
