Modern enterprise networks are populated by both people and, increasingly, “things.” But securing the growing population of Internet of Things devices presents unique challenges. In this thought leadership article, Brian Trzupek, the Senior Vice President of Emerging Markets at DigiCert discusses what is needed for effective IoT security.
We’ve seen the IoT come of age over just the past few years, and innovative use cases continue to build momentum. Gartner forecasts that 25 billion connected things will be in use by 2021. However, although the IoT has tremendous potential across many industries, Gartner surveys still show security is the most significant area of technical concern.
When it comes to security, IoT challenges are distinct from the enterprise. Although identity and identification are cornerstones of effective security, IoT and enterprise environments face different challenges. End users are generally involved in enterprise authentication. When trying to use an application or service, they can be present to respond to multifactor authentication challenges. End-users may also have varying sets of roles or access constraints that evolve as their position changes in the organization.
IoT: Insecure by Design
IoT devices do none of these things. A device is typically manufactured and provisioned an identity that will generally last for the entire duration of that device. However, the software on that device may change quickly and frequently throughout the lifetime of the device. Another key difference between IoT and enterprise identity and authentication is that, in IoT environments, devices may be only rarely connected to the network. That means they may not be able to get updates, or, in some cases, may not even be able to support standard revocation models. These key differences mean you need a way to ensure every device’s authenticity and integrity.
What’s needed for effective IoT security?
A few fundamentals are needed to secure IoT environments.
Robust device security
First, you need a cryptographically strong device identity. This is commonly called the device “birth certificate.” A device certificate creates an identity for each “thing” in an IoT ecosystem, making sure each device authenticates as it connects, and protects communication between devices.
IoT supply chain security
Manufacturers need a way to track and ensure their devices’ content to respond effectively to future vulnerabilities or compromises. Not knowing what is on your devices, such as libraries, software, chips, open-source, is the easiest way to get compromised.
Ability to disable a device
If the device is connected to the network and using Public Key Infrastructure (PKI), revocation of the certificate is a very effective way to disable its ability to bad things. However, if you do not have a means of using revocation with a device, but it is communicating back to a service the manufacturer controls, then the device identity can be used to gate access to backend services and have the effect of quarantining and identifying a troublesome device. If you are not the manufacturer and have a compromised device, then network segmentation and egress monitoring allow you to control the device.
Ability to update a device
However, many devices are connected in a way that they can be updated. It’s essential to ensure that a secure update mechanism is designed in from the start—and that the integrity of the update can be confirmed before the update takes place.
It’s also important to be able to build in the ability to respond to unauthenticated access and recovery. Some organizations create update procedures that coordinate closely with routine device maintenance, or any other occasion that a certified employee visits the device. In these cases, using cryptographically secure authentication to the device through PKI will allow the qualified worker to gain proper access and perform necessary duties. This needs to be designed in from the start. It is also important to remember that in some cases, a device may not be updatable, and will require its own specific deployment policies and practices.
Service side authentication
IoT devices should all use strong authentication when communicating with their services. Unauthorized devices should be identified and dealt with per your policy.
Despite your best efforts, you may need to respond to breaches. Consider how you will identify compromised devices or spot vulnerabilities in the software used in your device. Once you have developed a plan to discover these issues, you can determine how you will respond to correct the issue or quarantine the device. Developing a well thought out remediation plan in advance will greatly help you when the time comes to respond to an issue.
PKI delivers for IoT security
PKI is uniquely positioned to deliver on essential, distinct security needs of the IoT. It’s market-ready, widely adopted, and provides the flexibility and interoperability organizations need to support a wide range of IoT applications.
According to the Institute of Electrical and Electronics Engineers, “When you’re looking at authenticating devices, the only real standards at the moment that offer any real interoperability tend to be Public Key Infrastructure (PKI).”
It’s clear that PKI delivers the essential authentication and encryption components needed by the IoT for data security, making it a proven solution and market-ready platform for IoT device security today. With a strong PKI platform from a leading global provider, modern PKI that fits the large scale and flexible deployment models of the IoT is effective and ready to use.
(*) Disclosure: This article was sponsored by DigiCert. For more information on how Security Ledger works with its sponsors and sponsored content on Security Ledger, check out our About Security Ledger page on sponsorships and sponsor relations.