As the Internet Of Things (IoT) gains a higher rate of adoption, ensuring the security and data privacy of these complex solutions will be the biggest challenge. These intelligent systems take action with minimal human intervention, which calls for a very robust security validation process. Although IoT has multiple definitions, I view it as a set of technologies that collects data from a variety of sources to intelligently drive context-aware actions in near real-time.The solution comprises of four different subsystems:

• Network of uniquely identifiable “things” that create an ecosystem of sensors through which data is collected

• Data processing platform that makes intelligent, context-aware decisions by processing the sensor data along with the external data

• Applications that deliver the actions based on the decision by the data processing engine; these applications can collocate with the things or work independently

• The heart of the solution is the “communication” infrastructure, which carries the data across the solution and is comprised of both private and public network infrastructures

These uniquely identifiable things, which are expected to grow to 26 billion units by 2020 according to Gartner, increase the security challenges associated with handling the volume, variety, veracity, and velocity of data. Privacy challenges will also increase, primarily due to the lack of IoT standards and the fact that product development teams are not typically aware of the privacy considerations where the product is deployed. 

Sensor Network Security

Ensuring the security certification of an IoT solution requires that its subsystems be developed with a focus on authentication, authorization, storage data security, and encryption. These solutions utilize the sensor networks that are built with embedded technologies and adopt a self-provisioning, plug-and-play model. Sensors that collect the required data, temporarily store it, and push it to the platform for further actions introduce two major concerns:

• Secure authentication of these sensors

• Security of the data stored in the sensors

These authentication issues can be resolved to a certain degree by implementing strong M2M authentication, where a unique digital certificate is embedded in the device used for authentication purposes. The data storage issue can be resolved by encrypting the data stored on the device, apart from setting the maximum data storage time on the device.

Data Platform Security

Data processing platforms are designed to process and store high volumes of data in a distributed architecture. These platforms are usually deployed in the cloud and communicate with the resources and applications using web services. There are two major security concerns associated with the platform:

• Infrastructure related

• Data privacy, availability, and integrity related

The data privacy issue can be addressed by encrypting the whole or a part of the data stored on the cloud. The data availability issue can be addressed by making the system resilient to DDoS and similar attacks. Data integrity can be achieved by implementing the right architecture solution to ensure eventual -- if not strong -- consistency.

Application Platform Security

Applications are the interfaces through which the end user interacts with the system. These applications are typically Web, Mobile, or Actuators. Applications are one of the common intrusion channels through which hackers gain access to data. Major security concerns are:

• Authentication, authorization,and accounting 

• User role mappings

• Code modifications using XSS or CSRF

• Using applications to affect platform functionality

• Other OWASP Top 10 vulnerabilities for web and mobile applications

Most application-related vulnerabilities can be avoided by properly implementing the industry-accepted systems development life cycle (SDLC) model, and by performing the appropriate product security testing of at each step of the SDLC. The rest of the security issues can be avoided by making developers aware of the various vulnerabilities and common mistakes that lead to the threat, such as allowing special characters in URL (which leads to XSS attacks) or allowing SQL queries in usernames and passwords.

Network Security

Typically, a communication protocol is based on the type of network, such as the WAN, LAN, or PAN. Hackers can use the network to compromise the IoT solution without attacking the subsystems. Major security concerns associated with communication are:

• Illegitimate access to the network nodes

• Insecure communication over networks

• Health assessment of the nodes

The illegitimate access issue can be resolved by using a good authentication mechanism among the network nodes. The insecure communication issue can be addressed by using encrypted communication protocols, which include TLS-based HTTPS or MQTT over TLS. Assessing the health of nodes can be addressed by using SNMPv3.

Conclusion

IoT offers many interesting opportunities but needs to be developed responsibly. Although there is no silver bullet that can ensure a completely secure system, using a development process that takes into account the need for security and addresses potential issues across each relevant stage is the most important strategy in developing a secure IoT solution. GlobalLogic’s Secure Development Life Cycle is designed to address this need and enables us to develop IoT systems and components with the best possible level of security.