The internet of (compromised) things: securing IoT when you can’t trust (any) “thing”

A few years ago, I was at an industry conference attending a cybersecurity session when the presenter referred to the Internet of Things as the Internet of (Compromised) Things.

The audience laughed. But, like all good humor, it was funny because it was true.

The Internet of Things has transformed the way we monitor, manage and operate everything from factories and utilities to buildings, vehicles and supply chains. Sensors, cameras, meters, beacons, probes and controllers are now connected to networks and continuously sending data back to applications that make our businesses smarter and more efficient.

But there is a fundamental cybersecurity problem hiding inside all of that connectivity: we have dramatically increased the number of devices connected to our networks without necessarily increasing our ability to secure them.

Over the years, we have seen numerous vulnerabilities in the software embedded in IoT and industrial devices. One particularly striking example was Ripple20, a collection of vulnerabilities discovered in the Treck TCP/IP stack used in a wide range of IoT and industrial products. Some of the vulnerabilities could be exploited remotely, including one with a CVSS severity score of 9.8. CISA’s recommended mitigations included minimizing network exposure, putting control-system devices behind firewalls and isolating them from business networks.

And that brings us to an uncomfortable question. Is industrial IoT really more secure than the IoT devices we have in our homes?

It is tempting to assume that the answer is yes. After all, commercial and industrial solutions are generally designed for professional environments, purchased through established vendors and deployed with more formal IT and operational processes. But I don’t think that is a safe assumption.

In fact, industrial IoT can present a particularly difficult cybersecurity challenge. Unlike our PCs and smartphones, which routinely tell us when an operating-system or application update is available, many IoT endpoints are designed to perform a very specific function and then remain in service for years — sometimes decades.

Consider:

• A sensor doesn’t necessarily have an IT department.
• A controller doesn’t necessarily have an automatic patch-management system.
• Taking an industrial device offline to install a firmware update may not be as simple as clicking “Restart Now.”

The result is that vulnerability identification, remediation and patching may happen far less frequently — or, in some cases, not at all. So perhaps we should approach the problem differently.

What if we assume the IoT endpoint will eventually be compromised? That may sound pessimistic, but it leads to a much more realistic and resilient security architecture. Rather than relying solely on the device itself to remain secure, we can use the network surrounding the device to contain the risk.

I would suggest three network-centric principles for securing IoT endpoints:

1. Keep the “things” away from the people.
2. Control the flow of traffic between the “things.”
3. Monitor the network behavior of the “things” and mitigate when necessary.

This is not a foolproof approach. As we like to say in cybersecurity, nothing connected to the Internet can ever be made 100% secure. However, we can make it considerably harder for a compromised IoT device to become a compromised network.

1. Keep the “things” away from the people

At this point, it is fairly well-documented that human error is a major contributor to cybersecurity incidents. So why would we put our IoT devices on the same network as the people?

An IoT network should not be allowed to freely co-mingle with the broader administrative network that supports email, financial applications, collaboration tools and other systems used by employees.

Instead, the “things” should live in their own network environment, separated from the people and the applications they use. That could mean a dedicated VLAN, a separate VRF or, more broadly, a dedicated VPN and security policy for IoT traffic.

For cellular-connected devices, technologies such as Private APNs — Access Point Names — can provide another layer of separation. A Private APN allows traffic from cellular-connected devices to flow into a private network rather than traversing the public Internet.

The objective is simple: If an employee falls for a phishing attack, don’t let that mistake take down your IoT network.

Network segmentation creates a barrier between the administrative environment and the IoT environment, limiting the ability of a compromised user device to reach thousands of connected endpoints.

2. Control the flow of traffic between the “things”

Most IoT applications are fundamentally hub-and-spoke architectures. Sensors, beacons, probes, meters and other endpoints collect information and report it back to a centralized server or cloud application. The endpoint generally doesn’t need to communicate with every other endpoint on the network.

Traffic between IoT devices should be restricted wherever possible. A temperature sensor should be able to send temperature data to the application server. It probably doesn’t need to initiate a connection to another temperature sensor across the building.

The same principle applies to cameras, meters, controllers and other connected devices. By restricting east-west traffic between IoT endpoints, we can limit the ability of one compromised “thing” to compromise another.

This is particularly important because once an attacker gains control of an endpoint, the attacker may use that device as a launching point to discover and attack other devices.

The goal should be minimum access privilege for machines, just as we apply minimum access privilege to people. A thing should be allowed to communicate with the things and applications it needs to perform its job — and nothing more.

3. Monitor the network behavior of the IoT “things” and mitigate when necessary

Even with segmentation and traffic controls, we should operate under the assumption that something will eventually get through. That makes behavioral monitoring the third layer of defense.

Modern cybersecurity tools are capable of modeling expected network behavior and identifying activity that falls outside the normal pattern. IoT devices are particularly well suited to this approach because their behavior is often highly predictable.

Consider a sensor that normally communicates with an applications server once every hour. That is its normal behavior. If that same sensor suddenly starts communicating continuously, something has changed. If a device that normally sends a few kilobytes of telemetry suddenly begins transmitting hundreds of megabytes, something has changed.

And if a sensor whose only job is to send data suddenly attempts to log into another server, scan the network or communicate with dozens of other devices, something has definitely changed.

Those behavioral changes should generate an alert — and, where appropriate, trigger an automated response. The network should be capable of saying, in effect: “That’s not what you normally do, so I’m going to stop you.”

That could mean blocking the offending traffic, quarantining the device, restricting it to a limited set of destinations or otherwise containing the endpoint until it can be investigated.

Assume the thing will be compromised

The traditional approach to IoT security has often focused on making the device itself more secure: better passwords, stronger authentication, secure firmware and regular patches. All of those elements are important. But they aren’t enough.

We need to recognize the reality of IoT deployments. Some devices will have vulnerabilities that aren’t known when they are deployed. Some vulnerabilities won’t be patched quickly. Some devices won’t be patched at all. And some devices will remain in service long after their original manufacturer has stopped supporting them. 

The answer, therefore, isn’t simply to build a better “thing.” It is to build a network that assumes the thing might not be trustworthy.

The Internet of Things isn’t going away. In fact, it is becoming an increasingly important part of how we operate our businesses and critical infrastructure.

The challenge for cybersecurity professionals is to make sure that the convenience and intelligence created by billions of connected devices don't come at the expense of the security of everything else.

Maybe the presenter at that conference was right. Perhaps we really are building an Internet of (Compromised) Things. But with the right network architecture, a compromised thing doesn’t have to become a compromised enterprise.