recommended reading

A Hacker’s POV of Internet of Things Security

a-image/Shutterstock.com

ARCHIVES

By Jason Haddix April 25, 2017

recent posts

Jason Haddix is the head of trust and security at Bugcrowd.

Today, internet of things devices outnumber humans. Internet-enabled children’s toys, household appliances, automobiles, industrial control systems and medical devices—new IoT devices are being designed and released every day but many of these devices are built with little-to-no security in place. Given the rapid growth of these devices and unregulated market, it’s no surprise that these devices represent a growing threat as well as a major opportunity for hackers.

How Manufacturers Play a Role in IoT Insecurity

The sheer number and types of the devices being networked and connected to cloud interfaces and on-the-internet APIs are one of the greatest challenges in security today. Each device has its own set of technologies, thus its own set of security vulnerabilities. Add to that the pressure to rush to market and meet consumer demand, many manufacturers have simply not implemented a robust security review process.

» Get the best federal technology news and ideas delivered right to your inbox. Sign up here.

What’s especially concerning is that IoT manufacturers are collecting large amounts of life pattern behavior on their users, as well as access to home and work networks. This is a treasure trove of useful data for those that would target phishing attacks or product marketing, or pivot off these relatively insecure devices to compromise other systems on the network that contain more valuable data.

Unfortunately, many internet-enabled device manufacturers have not yet fully realized that they are now complex software vendors, shipping not only the embedded control system on a toy or vacuum, but frequently also managing mobile applications across multiple platforms, web applications, cloud storage, and web APIs. They have a responsibility to ensure product security throughout the life of the device. However, many IoT devices have poor software update mechanisms that compound the impact of design flaws and security vulnerabilities.

As a result, while the attacks we've seen in the last year have been massive, they’re built around trivial vulnerabilities. The Mirai botnet, for example, has grown by exploiting IoT devices with weak or default passwords. It was responsible for unleashing one of the largest DDoS attacks to date and is still at large.

It's important for IoT vendors who haven't prioritized security to take attacks as a wake-up call, and understand that we're entering a period where there is a very real, calculable, and painful impact to having insecure products. These types of attacks will only grow until the industry gets a handle on the issues of IoT security.

Defenders: Evolving today’s policies  

IoT security is in the standards phase right now, which means legislators haven’t yet prescribed specific policies around what security devices need to have in place for manufacturers to ship them. Some existing efforts have been made to classify the devices by the confidentiality of data connected devices handle, but even this proves to be troublesome with such a large diversity of devices.

Another challenge is the physical aspect of security when it comes to IoT devices. Should they be held to a standard that requires not only protection from remote exploitation, but also having protections from reverse engineering a device that an adversary has physical access to? If so, the requirements become very high in the development and electrical engineering aspects of these devices and systems.

Simple policies (that should be enforced by the FCC or some other regulatory/industry-council) should require annual third-party security testing on both the device and the websites or APIs it uses. This should mimic the likes of what the PCI Security Standards Council mandates for payment processors. In addition, minimal standards should be enforced, like the use of HTTPS or SSL in all communications, forced changing of default administration passwords, two factor authentication options, encryption of data at rest, and logging. Several projects have been spun up to threat model (generically) the IoT landscape that would work as standards for policy, including the OWASP Internet of Things (Security) Project.

The industry has learned some major lessons around IoT security in the last year. However, change takes time. Security isn’t a destination, it’s a process. The adversary is going to continue to find new ways to attack devices, and the industry needs to be better prepared. That’s why securing IoT begins at the bottom: bringing together security experts that can engage in this process. IoT is an enormous category so creating a set of standard requirements will be challenging yet it’s vital to start identifying vulnerabilities no matter how minor or obvious, and making changes to move the security maturity of this market forward.  

JOIN THE DISCUSSION

Close [ x ] More from Nextgov
 
 

Thank you for subscribing to newsletters from Nextgov.com.
We think these reports might interest you:

  • Modernizing IT for Mission Success

    Surveying Federal and Defense Leaders on Priorities and Challenges at the Tactical Edge

    Download
  • Communicating Innovation in Federal Government

    Federal Government spending on ‘obsolete technology’ continues to increase. Supporting the twin pillars of improved digital service delivery for citizens on the one hand, and the increasingly optimized and flexible working practices for federal employees on the other, are neither easy nor inexpensive tasks. This whitepaper explores how federal agencies can leverage the value of existing agency technology assets while offering IT leaders the ability to implement the kind of employee productivity, citizen service improvements and security demanded by federal oversight.

    Download
  • Effective Ransomware Response

    This whitepaper provides an overview and understanding of ransomware and how to successfully combat it.

    Download
  • Forecasting Cloud's Future

    Conversations with Federal, State, and Local Technology Leaders on Cloud-Driven Digital Transformation

    Download
  • IT Transformation Trends: Flash Storage as a Strategic IT Asset

    MIT Technology Review: Flash Storage As a Strategic IT Asset For the first time in decades, IT leaders now consider all-flash storage as a strategic IT asset. IT has become a new operating model that enables self-service with high performance, density and resiliency. It also offers the self-service agility of the public cloud combined with the security, performance, and cost-effectiveness of a private cloud. Download this MIT Technology Review paper to learn more about how all-flash storage is transforming the data center.

    Download

When you download a report, your information may be shared with the underwriters of that document.