Menu

IoT FEATURE NEWS

Is it Possible to Secure IoT?

By Special Guest
John Maddison, SVP, Products and Solutions, Fortinet
March 16, 2017

The sheer scale of IoT, and the speed with which it has achieved this scale, boggles the mind. It touches almost every aspect of personal and business life. Experts forecast that there will be more than 33 billion IoT devices deployed by 2020 – just three years from now. That’s 4.3 internet-connected devices for every person on the planet.

Of course, IoT is not one easily defined category. There are a variety of IoT devices and categories, each with its own implications.

  • Consumer IoT includes the connected devices we are most familiar with, such as smart cars, phones, watches, laptops, connected appliances and entertainment systems.
  • Commercial IoT includes things like inventory controls, device trackers and connected medical devices.
  • Industrial IoT covers such things as connected electric meters, waste water systems, flow gauges, pipeline monitors, manufacturing robots and other types of connected industrial devices and systems.

Given the scope and variety of these connected devices in industries that touch every corner of our lives, the implications for networks, and especially security, are huge.

The Threat Landscape Expands
Increasingly, IoT devices are being woven into local, national and global networks—including critical infrastructures—creating hyper-connected environments of transportation, water, energy, communications and emergency systems. Healthcare agencies, refineries, agriculture, manufacturing, government agencies and even smart buildings and cities all use IoT devices to automatically track, monitor, coordinate and respond to events.

While automating decisions and processes at machine speeds can generate revenue, improve our quality of life, make us more productive and even save lives, it also introduces new risks and expands the threat landscape.

1. Some of the data passing from, to or among connected devices contains personal information that can be exploited, including locations, names and addresses, ordering and billing information, credit card and bank information, medical records or government-issued ID numbers.

2. When compromised IoT devices are connected to IT networks, they can become a conduit for breaches or the injection of malware.

3. Compromised industrial and commercial IoT devices can be used to make changes on the manufacturing floor. Operations technology, SCADA and industrial control systems actually control physical systems, not just the bits and bytes of traditional IT networks, and even the slightest tampering can sometimes have far-reaching— and potentially devastating—effects.

4. Increasingly, IoT technology is also being integrated into the nation’s critical infrastructure. Transportation systems, chemical refineries, wastewater systems, energy grids, culinary water and communications systems all use IoT devices. The cascading effect of a serious compromise can be potentially catastrophic.

IoT Security Lags
The challenge is that many IoT devices were never designed with security in mind. IoT security challenges include weak authentication and authorization protocols, insecure software, firmware with hard-coded back doors, poorly designed connectivity and communications, and little to no configurability. And most IoT devices are “headless,” with limited power and processing capabilities. This not only means they can’t have security clients installed on them but also that most can’t even be patched or updated.

The risk is real. Just last fall, compromised IoT devices were gathered into a massive botnet, causing the largest denial of service outage in history. Unfortunately, the general response by the security industry has been woefully inadequate. Yes, the expo floor at this year’s RSA Conference was filled with vendors promoting devices and tools to soothe the IoT worries of organizations. The problem is that the network teams that need to test, deploy, manage and monitor these devices are already overwhelmed.

Dozens of isolated devices with separate management interfaces have placed a strain on limited IT resources. Large enterprises already need to manage an average of 30 security consoles, connected to hundreds of security devices that usually operate in isolation. This makes gathering threat intelligence a cumbersome and time-consuming task, often requiring the hand correlation of telemetry data in order to identify malware or compromised systems.

And now, specialized security tools being created and promoted for IoT are going to expand the number of deployed hardware-based and virtual security devices even further.

Rethinking Your Security Strategy
The reality is that IoT cannot be treated and secured as an isolated, independent network. It interacts across your existing extended network, including endpoint devices, cloud, traditional and virtual IT, and OT. Isolated IoT security strategies simply increase overhead and reduce broad visibility. Instead, security teams need to be able to tie together and cross-correlate what is happening across their IT, OT, IoT and cloud networks. Such an approach enables visibility across this entire ecosystem of networks, allowing the network to automatically collect and correlate threat intelligence and orchestrate real-time responses to detected threats.

This requires a rethinking of security strategy. A distributed and integrated security architecture needs to cover the entire networked ecosystem, expand and ensure resilience, secure compute resources and workloads, and provide routing and WAN optimization.

New solutions have been developed that solve the challenge of security sprawl by integrating your security infrastructure together into a single, holistic framework. This allows you to effectively monitor legitimate traffic, including IoT devices, check authentication and credentialing, and impose access management across your distributed environment through an integrated, synchronized and automated security architecture managed through a single pane of glass.

A Safer Digital Horizon
IoT has worked its way into every facet of life – and so quickly that manufacturers usually didn’t stop to think about building security into their products. Organizations are re-architecting their security measures with a more comprehensive approach that enables connectivity while ensuring safety. They are using advanced security solutions designed to help defend against the continually evolving threat landscape that threatens the success of their digital business and the emerging digital economy.

About the author: John Maddison has more than 20 years of experience in the telecommunications, IT Infrastructure and security industries. Previously, he held positions as general manager data center division and senior vice president core technology at Trend Micro. Before that, John was senior director of product management at Lucent Technologies.




Edited by Ken Briodagh


SHARE THIS ARTICLE
Related Articles

Mirror, Mirror, or the Science of Understanding in the IoT Age

By: Special Guest    12/12/2017

Today, the news that Atos offers to buy Gemalto for 4.3 billion euros to boost cyber security services hits.

Read More

Privacy and Compliance: The Next Big IoT Challenge

By: Cynthia S. Artin    12/11/2017

Kabir Barday, CEO of OneTrust, shared his insights on what could be a tsunami of impact on the IoT industry that many may not have seen coming.

Read More

Huawei Smart City Solution Supports Yanbu, Saudi Arabia

By: Ken Briodagh    12/11/2017

In line with Saudi Arabia's vision, the Smart Yanbu Industrial City project reportedly has started to build upon the hopes of Saudi Arabian citizens f…

Read More

An Outlook on the Cybercrime Epidemic - What Will 2018 Bring?

By: Special Guest    12/11/2017

While companies are racing to protect their organization's data from future attacks, it is important to keep in mind that hackers are only getting sma…

Read More

How the Civil Infrastructure Platform Project Powers Smart Cities

By: Cynthia S. Artin    12/11/2017

For everything from critical infrastructure to communications systems, water management, roads, trains, airports, public transportation can be upgrade…

Read More