{"id":10991,"date":"2017-02-28T14:46:09","date_gmt":"2017-02-28T19:46:09","guid":{"rendered":"http:\/\/www.iri.com\/blog\/?p=10991"},"modified":"2017-11-03T14:17:37","modified_gmt":"2017-11-03T18:17:37","slug":"the-formidable-but-imperative-task-of-iot-security","status":"publish","type":"post","link":"https:\/\/beta.iri.com\/blog\/data-protection\/the-formidable-but-imperative-task-of-iot-security\/","title":{"rendered":"The Formidable but Imperative Task of IoT Security"},"content":{"rendered":"

The Internet of Things (<\/span>IoT<\/span><\/a>) continues to grow at an unbelievable rate, and creates tremendous benefits and opportunities for society. With it grows the demand for products and services that control, manage, and protect the massive amounts of data streaming from all those network-connected devices. \u00a0But as they provide more and more advantages, and even become essential to our daily lives, security has not managed to keep pace with the vicissitudes of the rapid development taking place. \u00a0<\/span><\/p>\n

This article discusses some of the substantial economic and safety risks, challenges and vulnerabilities, as well as strategic principles and practices to consider when endeavoring to secure your IoT operation or application.<\/span><\/p>\n

<\/a><\/b><\/p>\n

Associated Risks<\/b><\/h3>\n

It is no secret that the ubiquity of IoT has led to the increasing prevalence of cybercrime. Data is being stolen at an alarming rate while it is being generated, gathered, and analyzed. \u00a0<\/span>Vigilante.pw<\/span><\/a>, a prominent, non-profit website continually logging data breaches and compromised databases, shows in real time just how frequent this problem is. \u00a0<\/span><\/p>\n

Data breaches often include payment card information (PCI), personally identifiable information (PII), sensitive personal information (SPI), and protected health information (PHI), which are among the most valuable commodities for sale on the black market.<\/span><\/p>\n

\u201cRight now there\u2019s a much bigger database leaking\/trading scene than ever before,\u201d according to Keen, the pseudo-named owner of Vigilante.pw. \u00a0\u201cThere are a lot of different people playing in this scene. \u00a0I don\u2019t think anything is getting better, that much is pretty clear, (and) there’s a lot of stuff out there that we don’t even know about.\u201d<\/span><\/p>\n

In addition to privacy concerns, there are physical risks, too, with IoT connected devices and the information they produce. Concern is escalating over those utilizing them for crimes like impersonation and cyber-theft, and for sowing discord. Harassment and stalking, break-ins, fraudulent transactions, vandalism, and burglary are also possible.<\/span><\/p>\n

\f\"IoT<\/a><\/b><\/p>\n

Challenges and Vulnerabilities<\/b><\/h3>\n

Unauthorized access that makes data, property, and lives vulnerable must be avoided, especially in mission-critical environments like banking and healthcare. IoT is mostly dependent on cloud and mobile services for information exchange between applications and their devices. Thus, sufficient measures to configure the security of these interfaces are paramount in making sure data is transferred, processed, and stored safely. \u00a0<\/span><\/p>\n

The majority of IoT devices transmit data via a Web Interface, and many of those transmissions have security holes. Allowing plaintext login credentials, and not requiring strong passwords or disabling access after a certain number of failed login attempts can all lead to lost data and control of the IoT device.<\/span><\/p>\n

Data can also be intercepted if network communications are unencrypted, or transmitted through insecure protocols. \u00a0More stringent regulations are necessary to prevent data loss and manipulation. Otherwise, IoT devices may be compromised and used in deviant ways, or rendered unusable.<\/span><\/p>\n

Regular firmware or software updates may then be necessary once all interfaces are secure. \u00a0Integrity verification and systems with strong authentication\/authorization procedures may be difficult and expensive to implement. However, the risks and results of not doing so may be much costlier!<\/span><\/p>\n

\"Cloud<\/a><\/p>\n

Physical security is also necessary for many IoT devices. Businesses should mandate strict monitoring and control over the physical access to their devices to safeguard the data used for analytics, application integration, and other purposes. Like cloud\u00a0and mobile interfaces, the consequences of neglecting physical security can end up being dire.<\/span>
\n<\/b><\/p>\n

IoT Security Principles and Practices<\/b><\/h3>\n

Implementing security beyond the basics — which some IoT devices don\u2019t even have — can help mitigate the kinds of risks and vulnerabilities above. The U.S. Department of Homeland Security recommends the following six principles, along with suggested practices to address IoT security challenges:<\/span>1<\/sup><\/a><\/span><\/span><\/p>\n

\n