Device Security: The Achilles Heel of the Internet of Things

Two or more hosts can communicate securely because the communication cannot be monitored (sniffed) by untrusted hosts. 

Message Integrity and Replay Protection—The message transported must not be tampered with or altered. A message has integrity when the payload sent is the same as the payload received. Messages that are encrypted remain vulnerable if someone can capture them and replay them later. For example, a street lighting solution without replay protection could allow a hacker who obtains unprotected messages for "on/off" functions to compromise municipal lighting. Without message integrity and replay protection, the message could be manipulated to control the timing of the illumination, thus creating an expensive and even hazardous situation.

Mutual Authentication—This guarantees that everybody knows everyone else in a data exchange. With mutual authentication, the device knows the network is real and the network knows the device is what it says it is. If a stranger enters and tries to get into the devices’ team huddle, mutual authentication keeps them out.

Device Anonymity—Devices have unique identities that keep them distinguishable from other devices. It’s important that their secret identity never be revealed.

Secure Multicasts—Secure multicasts guarantee that even when many devices are receiving messages, like a host of street lights beings asked to turn on or off simultaneously, they are all protected. There must be source authenticity for the transmitted data.

Authentic Firmware Upgrades—Being able to download firmware updates is a critical capability in virtually all IoT applications. Protection against the hacks, viruses, and worms is absolutely necessary, as evidenced by the mayhem wrought on millions of PCs and servers connected to the internet with recent attacks. Consider the Mirai botnet, which last year wreaked havoc on domain name servers by compromising routers, connected video players, and other hardware. Patches were developed after they were detected, but required that users download and install them. But what happens when people fail to download the patches?  Their PCs and IoT devices make an entire IoT network vulnerable. 

Firmware upgrades should be required, including device security upgrades, as the firmware upgrades can include important patches that address key security vulnerabilities. Firmware upgrades that apply to specific devices allow firmware design to be propagated to specific devices, allowing for improvements in security, as well as other areas, such as battery life and sensor performance. This allows solution providers and their customers to increase the value of their IoT investments, and gives business leaders peace of mind by keeping devices secure and adaptable to ever-changing cyber security conditions.

In all of these security practices, the goal is to to ensure IoT networks are protected at the device level and all the way up. By 2020, the number of active, connected devices will exceed 40 billion, which means every facet of people's personal and professional lives will be impacted. While the security emphasis tends to be on servers, clients, and data, it should extend to the sensors and devices that connect "things" in IoT networks. Cybercrime could cost businesses more than $2 trillion by 2019, so a comprehensive and proactive approach to security is the best way to ensure IoT networks, and hence customers, are protected. In all of these security practices, the goal is to to ensure IoT networks are protected at the device level and all the way up.