Internet of things (IoT) essentially is about connecting devices and applications together through the fabric of the internet. Although it isn’t exactly a new technology, recent advancements in sensors, batteries, and motors have enabled development of more smart devices. Cisco estimates the number IoT connected devices in the world to increase to as much as 50 billion devices by the year 2020. With the rapid growth of IoT each year and more business adopting IoT technologies, it is imperative to analyze and address security issues that affect IoT.
IoT security deals with ensuring the safety of devices and networks interconnected under the fabric of IoT. We can divide the security issues into five broad categories:
1. Device/physical security
Devices are at the core of IOT and are responsible for collecting data and interacting with other devices/humans. Since devices gather data, they are most vulnerable to physical security concerns. Even in existence of a robust network, unauthorised physical access to IoT devices can lead to catastrophic system failure. A device is often not the particular target rather is used as a Trojan horse to acquire backdoor access into the system to either plant malware or crash the system cluster as a whole.
Some ways to ensure physical security are:
- Limiting physical access to the device
- Ensuring proper security measures in the operating system to prevent unauthorised access
2. Network security
Networks have been prone to hacks long before the advent of IoT and with the sheer volume of IoT devices, it is essential to have a robust and secure network. Many security analyses argue network being the weakest link in the chain of processes the data has to flow through before reaching its final destination. Network shortcomings are usually the first to be exploited by hackers as it can be done remotely without the need to access the IoT device physically.
One way to deter network compromise is to use Virtual Private Networks or VPN‘s. VPN secure the network by encrypting the data traffic that flows through them. In many ways, they are the ultimate network security compromise deterrents. VPN’s, however, are doing not ensure absolute security. VPN’s are still susceptible to man in the middle (MITM) attacks.
3. Data security
Data in IoT can be broadly classified it into two categories; stored data (data at rest) and data in the process of transmission (data in flight).High-level encryption of both the data types is essential to maintain data integrity. The problem of scale again comes into play. With a large variety of devices and varying hardware specifications, it is impossible to create a one size fits all standard data encryption process. Data that is highly sensitive to bank account details, usernames, passwords need to encrypt with two or more factor authentication processes to ensure security.
4. Operating system security
Operating systems are often a prime target for hackers. Gaining access to the operating system of an IoT cluster, or even a single device, can allow hackers to exploit compromises in the system code to essentially own a system . Recovering from an Operating system security breaches are costly as they can lead to partial or complete data loss and a lot of time is required to restore the operating system to full efficiency.
Backups of the system can be periodically created to minimise the cost of recovering from an operating system hack, however since it is impossible to accurately detect the date of a hack, it is impossible to know the point from which the system needs to be restored.
With the increasing size and complexity of IoT, a more robust IoT security analytics process will be required to identify and neutralise IoT specific security breaches.
5. Server security
A big part of IoT is smart devices interacting with cloud servers. DOS or denial of service attack is one of the most common hacks that afflicts servers in which hackers use a large number of proxy devices to generate fake requests to the server making the server unable to attend to requests of real users and eventually crippling down the system due to the sheer overhead created.
Steps to be taken to protect server security include limiting the number of open ports and exposed services. Security configurability needs to be a primary concern when an IoT system is being developed to allow systems to be updated remotely with proper encryption and validation of update files.
A large amount of data produced by even the smallest of IoT systems make it a challenge for all software testing services provider to provide proper security to all aspects of a system while. With IoT security analytics, remote monitoring systems, automated patching procedures we can secure IoT systems. However with no limit to the extent IoT can go to, security challenges to developing IoT systems will only grow in number and complexity requiring due diligence to create new and update existing security countermeasures to safeguard the advance of IoT technologies.
