There were two interesting pieces on the fast-evolving topic of security and the Internet of Things that are worth reading. The first is a long piece by Bob Violino over at CSO that takes the pulse of the IoT and security question right now. The big picture: its early days, but that there are some troubling trends.
The vast expansion of IP-enabled devices is matched by a lack of security know-how at device makers, Violino writes. And, as the environment of “smart devices” grows, the interactions between those devices become more difficult to anticipate – especially as devices start sharing contextual data and taking actions based on that data.
“As machines become autonomous they are able to interact with other machines and make decisions which impact upon the physical world,” notes Andrew Rose, a principal analyst at Forrester Research Inc. in Cambridge, Mass. Rose says. “But these are coded by humans who are fallible, especially when they are writing code that works at the speed [and] frequency that computer programs can operate.”
The other article is by Byron Acohido over at USA Today anbd addresses what he calls the “plundering of the Internet of Things.” Acohido profiles the firm Norse Security (@NorseCorp) of St. Louis, Missouri, which has a cloud-based security intelligence service that operates honey pots that attract Internet attacks, then probes the sources of those attacks using automated crawlers. Citing Norse data, Acohido says that cyber criminals are already making use of Internet-connected consumer devices to spread malicious code and build massive networks of devices.
“The adversary just wants IP space to launch attacks and doesn’t really care if it’s a baby monitor or a server at a Fortune 1000 company,” Acohido quotes Norse CEO Sam Glines saying.
As with the CSO article, Acohido notes the difficulty that enterprise IT groups will have managing the size and complexity of networks with both traditional endpoints (desktops, laptops, servers) and non traditional ones (mobile phones, tablets, consumer devices).
Part of the problem is that existing security technologies, such as vulnerability- and intrusion detection sensors were built to work in an IPV4 (Internet Protocol Version 4) world, where the number of connected devices was small and manageable. However, as the world transitions to IP Version 6 (IPV6), the number of IP addresses will grow by orders of magnitude, making thorough scanning of even parts of the IPV6 address space all but impossible.
Too infrequently, however, the firms that are rushing headlong into the Internet-connected device space aren’t devoting thought or development resource to security.
“Competitive struggles force manufacturers into early release cycles, networks are becoming increasingly complex, and the complexity is hard to overcome,” says Norse CTO Tommy Stiansen.