Chief Product Officer
A range of security risks threaten IoT deployments. Devices and data can be vulnerable, even the processes involved in manufacturing can introduce weaknesses that could be exploited. IoT security must therefore be robust, from SIM authentication to the network and onward to secure Cloud service access.
According to Microsoft/Ponemon Institute research, over half (55%) of surveyed IT, IT security and operational technology (OT) security professionals don’t believe IoT and OT devices have been designed with security in mind. What’s more, the 2021 research discovered that over a third (39%) had experienced a cyber incident in the past two years where an IoT/OT device was the attack target.
Data has a value, which puts connected devices at constant risk of a cyber-attack. IoT devices exchange patient, payments and energy data, all of which is extremely sensitive. Other hackers might have disruptive intent or be seeking financial gain. For example, a ransomware or denial of service attack could lead to loss of revenue and reputuation.
All companies deploying IoT devices must consider the threats they will be exposed to very carefully and ensure their IoT security is as robust as it can be.
Cloud Secure explained
Paul explains in more detail why businesses should invest in IoT security in the below video.
Where do security risks occur in the IoT?
An IoT solution can be attacked in a number of ways. Collectively, these methods represent the attack surface and include devices themselves, data exchanges on the network and the servers or cloud applications. Cyber criminals can even capitalise on insecure practices and processes sitting behind IoT solutions.
Thousands, or tens of thousands, of devices can make up an IoT deployment and each new connection increases the attack surface. Security vulnerabilities can begin at the point of manufacturing if device identifiers (security keys or certificates) need to be shared with multiple parties during manufacture. If certificates are not kept completely private and secure then it can result in device spoofing or open the organisation up to ransomware attacks. The more components and suppliers involved in IoT development the higher the risk of exposure to security threats.
Once deployed, access to IoT devices and services should only be possible for authorised users. Therefore, identity verification must be in place to mitigate the risk of unauthorised access.
When IoT devices aren’t in use, open ports and connections present opportunities to hackers looking for a way in. When data is transmitted, there is risk of Man-in-the-Middle attacks, whereby data is intercepted.
Of course, cyber threats evolve all the time. That places deployments in place for a long time at even further risk, because they will quickly become out of date if software vulnerabilities cannot be patched later on.
How can the IoT be secured?
At the device level, security starts with authentication. When people connect to services through a device such as a laptop, tablet or smart phone, they provide a password, PIN or other form of identification. In the case of the IoT, there is no user so the device must contain the identifier which should be provided by the SIM through an embedded security key. There is a standard for SIMs to authenticate to mobile networks; it is known as IoT SAFE.
At the next stage, data passes from the device over the network to the services that process it. Services are often cloud-based, including those hosted by Amazon Web Services (AWS), Azure, Google Cloud and others. With IoT SAFE, these cloud certificates can be embedded in the SIM to authenticate the device beyond the mobile network to the cloud service provider. This is an important level of security to look for; it secures solutions end-to-end.
Without this, solutions will need separate components in the hardware to authenticate beyond the network. This adds cost and complexity to manufacture and production. It also adds additional points of weakness because multiple components, accessed by third parties during manufacturing, increase the attack surface.
A wide array of network protocols and best practices must also play their part in securing data transmission and access to data. These include secure private networking methods for device identity, device management and data transmissions to ISO accredited data management (ISO 27001).
Security still doesn’t end there. Where possible data should be encrypted when it is being held and transmitted. In addition, advanced IoT security solutions can include fraud detection through an IMEI hardware identifier locked into the SIM, to detect and block unauthorised use of the SIM in another device. Additionally, remote ‘over-the-air’ software patch deployment helps companies maintain device protection as new vulnerabilities emerge.
How Cloud Secure helps
Cloud Secure from Wireless Logic uses on-SIM technology for IoT deployments with security in mind. This includes IoT SAFE and it simplifies device provisioning processes and extends the root of trust for device authentication to cloud services from providers such as AWS, Azure and Google Cloud.
Combining this GSMA standards-based on-SIM technology with mobile core network and platform services, Cloud Secure resolves IoT device identity, enables dynamic scalability and provides defence against IoT device spoofing, ransomware and unauthorised device access to network and cloud services.
The IoT carries important data that needs the maximum level of security possible to protect finances, operations and corporate brand reputations. Every application gets exposed to security threats, making it a constant battle to minimise IoT vulnerabilities. To secure the IoT, risk mitigation should occur at the level of operational processes, device design and cloud service connectivity.
To find out how Wireless Logic can help you secure your IoT deployments, get in touch.
