ENSURING A SECURED INTERNET OF THINGS: AN EMBEDDED SYSTEMS SECURITY APPRAOCH.
Department of Computer Science and Technology
University of Bedfordshire
At the rapid rate at which the internet of things is rising, the expertise networks of today are supporting devices that are hitherto not meant to have internet connectivity. Devices such as smart TVs, medical equipment, refrigerators, printers, HVAC and even smart buildings are all becoming smarter owing to the introduction of embedded chips and internet connectivity in these devices. An area of concern however, is the issue of the security of these devices as continually exposed by researchers. This paper points out the leakages and gaps in the communication channels and embedded systems of these devices. Then it proffers some solutions as to how these devices can be better secured for the future.
Keywords Used - Internet of things (IoT); embedded systems; Privacy; Threats; Security.
The internet of things is here upon us and it requires a significant change in organizations’ perception of security. Protecting sensitive data is of high importance, but the growth in the number of connected devices poses a new security concern – trusting the true identity of these devices. Owing to the rise of the internet of things, organisations and enterprises must begin to change their perception that online security is all about protecting data, but must begin to think in the direction of verifying and protecting the identity the devices that connects to their environments. The proliferation of connected devices avails criminals’ access to bigger and different opportunities to extort, steal, manipulate, and thereby making them wreck even more havoc and life-endangering crimes than the present day malware (such as Crypt locker) - that can hold data to ransom - can ever do.
Such attacks won’t merely disrupt enterprises, but also critical national infrastructures like electricity grids and power generating sources that have been brought online. This infrastructure, then become potentially vulnerable to terrorist or hostile nations. Imagine the potential havoc of an attack on a critical infrastructure control system. In order to avert the treats that come with the internet of things, organizations must be confident that the devices that connect to their networks are actually the devices they claim to be
To prevent criminal from gaining access and subsequently control of a company’s network, it is key, to establish the true identity of any machine/device that is connected to its network. Any unprotected device connected to the internet is in danger of being compromised and can avail a pool of valuable data to criminals. For example, a member of staff of a company can be tracked or targeted leading to theft or blackmail
In this paper, the survey looks at several security and privacy concerns associated with the Internet of things (IoTs) and proffers some intrinsic solutions as to how to tackle them. Section one (1) gives an overview on the internet of things (IoTs). Section two (2) examines the drawbacks and security issues posed by IoT connected devices and how to address them
IOT OVERVIEW AND BACKGROUND
What Is IoT- The internet of things, is referred to indifferent terms by different bodies, but all meaning the same thing. The National Institute of Standards and Technology (NIST) uses the term “Cyber- Physical Systems” while other vendors use the term “Internet of Everything”. However, the most commonly used term is the Internet of Things.
According to SANS Institute, they define and categorize the Internet of things in to four waves as;
“The internet that enables any to any connectivity. Physical security technologies, smart buildings and HVAC are now connected, so are handheld smart devices and others in its kind. The recent wave of ‘things’ that are connected to businesses, users and other ‘things’ alike making use of either wired or wireless connectivity or both, including things like airplanes, medical machines and devices, automobiles and SCADA systems - (like environmental sensors, hydro systems, windmills, natural gas extraction and so on) SANS also defines four waves of devices that make up the internet of things (IoT) as;
1. servers, PCs, routers, switches and other devices of like type, procured as IT devices people in the IT enterprise, that mainly uses wired connection
2. SCADA systems, process control systems, medical machines and devices, kiosks and their kind procured as appliances people in the operational technology (OT) enterprise, which mainly uses wired connection.
3. Tablets and Smart phones bought as it devices by users and that uses wireless connectivity often in multiple forms.
4. Single – purpose devices, procured by IT and OT people alike, which uses wireless connectivity exclusively in a single form.”
Interestingly, the fourth wave is what most people refer to when they think or talk about IoT . However, according to a survey conducted by SANS in 2014 about securing the internet of things; it shows that those in the security industry recognise that they are currently dealing with the security issues that concern the first three waves and are beginning to see the leading edge of the fourth wave.
One important thing with the fourth wave is the huge growth of embedded computing and communication capabilities into almost everything nowadays ranging from electric meters, automobiles and trains to vending machines . These devices have embedded software and processors in them but more importantly, mobile internet connectivity is being added to them thereby ushering them into the IoT. The cause of problems for enterprise vulnerability assessment and configuration management process is the embedded nature of the software.
THE EVOLUTION OF NETWORK SECURITY
According to Windriver - a global leader in the area of embedded software for intelligent connected systems- in a white paper titled ‘Security in the Internet of Things’; “Data protection has always been an issue since the inception of computers, where two or more computers could connect to themselves.” As the internet became commercialized, security issues broadened to cover areas like financial transactions, cyber theft and personal privacy. Security and safety are inseparable when it comes to IoT. Be it malicious or accidental, interfering the control of a car, nuclear reactor, or a pacemaker portends a threat to human life.
Network evolution and security controls have both evolved side by side, dating back to the late 1980’s when the first packet – filtering firewalls was invented, to the present days of intrusion detection and prevention systems (IDS/IPS), sophisticated application and protocol aware firewalls and security incident and event management solutions (SIEM). All these controls are geared towards preventing malicious activities from cooperate networks and detecting them in the case where they eventually gain access. In the event that a malware breached the network firewall, an antivirus takes effect by identifying and fixing the issue, using a signature based matching technique referred to as blacklisting.
Eventually, the world of malware expanded causing an advancement in prevention and detection – a technique called whitelisting – and it replace blacklisting. In a like manner, access controls are developed as a result of increasing number of devices on cooperate networks that ire aimed at authenticating such devices as ill as their users and giving or denying them access to specific actions.
In recent times, software authenticity and intellectual property protection became a matter of concern, giving rise to tested boots – a software verification technique. Overall, data confidentiality is and has always been a primary concern. This was the necessity that bourn the development of controls like the physical media encryption and the virtual private network (VPN) so as to ensure that data in motion is secured
SECURITY AND PRIVACY CONCERNS
According to Patel, D et al (2014); a substantial amount of engineering is required in order to address the issues with devices if the same practices in the world of IoT are to be applied. A typical example is the case of blacklisting – where too much disk space is needed if it is to be implemented practically in IoT applications . Looking at embedded devices, they are manufactured to consume low power with little silicon factor and their connectivity is limited. They are also often designed to carry only the needed processing capacity and memory for their task. But more worthy of note is the fact that they operate without head – meaning they are operated without the guidance of a human being, who can input and verify authentication credentials or decide the authenticity of application. They have to make judgements on accepting and executing commands.
Since IoT applications are dynamic, so also are its security challenges. Some of its examples include;
• Nuclear reactor control systems are normally attached to infrastructure. The issue is; how can its software update and security patches be received on time and devout of functional safety impediment or incurring huge recertification costs in the case where a patch is released and needs to be updated?
• In like manner, in the automation on factory floor, PLCs – Programmable Logic Controllers that is embedded within and controls robotic systems are normally integrated with the enterprise IT infrastructure . The issue here is, how to protect these PLCs from human interference and also secure the investment made on the IT infrastructure at the same time and to also leverage on the available security control.
• Recently, Smart meters have the ability of not just reading energy usage data, but also sending it to the utility operator for real time optimization of power grid . The concern with these smart meters is their ability to protect information from unauthorised persons in order to avoid unauthorised usage, else a burglar or anyone with malicious intent could make use of such information .For example if power usage of an apartment drops, indicates that the apartment has no occupant and that could be a good clue for a burglar.
HOW TO BETTER SECURE THE IoT
THE BOTTOM – UP APPROACH TO BUILDING SECURITY
It is good knowledge that no single control can adequately protect a device, so the question is how the experiences of about 25 years can aid us in implementing real security in different scenarios. Windriver proffers an answer; the answer to this is by implementing a multi- layered approach in securing our devices and network . This starts right from that moment the power button goes on. This ensures the establishment of a trusted computing baseline and that trust is anchored on an unalterable quality.
Starting from the initial design to the operational environment and throughout the lifecycle of the device, the issue of security must be all addressed.
1. Secure booting: once a device is powered on, the software integrity is verified using its digital signature generated by crypto graphical means – as in the case of signing a document/cheque. This ensures that only authorised software is loaded and ran on that device. By this process, the foundation of trust has been established. The next step towards achieving security is to shield the device from runtime threats and malicious intruder/listeners.
2. Access Control: resources must be secured by introducing various forms of access control. These controls (either role-based or mandatory) must be integrated into the operating system in order to assign limited privileges to users, each according to what they need to perform their duties optimally. In the case where a component is compromised, access controls will ensure that the intruder is confined only to that component and does not gain access to other components/ parts of the system. In comparison, device based mechanism for access control are analogous as compared to network based access control like Microsoft Active Directory. So in the case where an intruder steals corporate credentials and gains access to a network, the information that is compromised would be restricted to the network areas that are unauthorised by those users in particular. This principle is called; the principle of Least Privileges.
3. Device Authentication: before data is transmitted or received, a device should authenticate itself first, when plugged into a network. Since embedded systems have no human users to do the authentication of credential required for network access. Here, the issue is how to ensure the true identity and proper identification before granting authorization. Since username and passwords are used as credentials in accessing cooperate network, so also machines can allow access to a similar network using the devices’ similar set of credentials that are stored in a safe database.
4. Firewalls and IPS: One thing the devices on the IoT will need a firewalls – which has a deep packet inspection capability, so as to control every network traffic that comes the way of the device. The question one is tempted to ask here is; what is the need for a host – based firewall or an IPS, since network –based appliances are available? The answer is; as derived from an article by Greg Jones of the British computer society on securing the internet of things; deeply embedded devices have protocols that are unique and different from IT protocols. An example is the smart energy grid – which has a different set of protocols that controls how devices communicate on its network. That is the reason why protocol filtering that are specific to industries and have deep packet inspection capabilities are required to identify and fish out malicious payloads that can be hidden in non – IT protocols. The device does not have to bother itself with filtering higher level, common internet traffic. They will be left to the network traffic to deal with. What it needs to do is to filter the data traffic that is targeted at the device and to do it in a manner that will make maximal use of the limited computational resources that is available.
5. Updates and Patches: Software updates and hot patches are sent by the software vendor from time to time when the device is in operation. This is required of every operator and it must be authenticated by devices is such a manner as to no require too much bandwidth or jeopardize the functional safety of the device. Thinks of a situation where apple rolls out its update to all MAC users in an attempt to protect them from those vulnerabilities that that are eventually made public and it is taking long to update, meanwhile these systems are engaged in some critical functions for their organizations. It may impair of the service delivery of these organization and as a result be harmful to the organizations. Therefore, must be delivered in such a matter that ensures that minimal bandwidth consumption and avoidance of intermittent connectivity of these embedded devices are achieved so as to avoid a functional safety compromise.
According to Wind River; It Begins with the OS: Security should not be seen as an added feature to a device, instead it should be seen a needed integral feature to make the device function reliably . At the OS level, software security controls should be introduced. Hardware with security capabilities are now introduced into the market and should be leveraged upon and extended through the device stack in order to continuously maintain a computing base that is trusted . This takes the burden off developers and designers of this systems in configuring systems that will lessen the impact of threats and the production of safe platforms.
Designers and operators of deep embedded OS, should understand, ensure and adhere to functional safety in trusted devices as the deliver software that perform critical tasks in which everyday life depends on. The Intent behind software design - is the only difference between safety and security considerations in software designs. Designers of this systems are responsible for delivering security for the IoT. Their products and solutions ought to support secure booting with hardware roots of trust, different access control mechanisms, packet management and software update that are secure, IPS and firewalls and a network management that integrates with event correlation products.
SECURITY SOLUTIONS: FROM END – TO – END
As proffered by SANS; for a successful operation of IoT, end-to-end security (security at both device and network levels) is critical . The intelligence of devices in performing their tasks must be replicated in recognising and counteracting threats. Fortunately, this approach does not require a revolution, but a continuous sustenance and development of the same measures that have proven successful in IT networks over the years and have adapted to the challenges posed by the IoT and the constraints faced by connected devices. Instead of searching for yet to be realised solutions to securing the IoT, the focus should be on delivering the current IT security controls, with the best performance in order to tackle new and complex embedded applications that drive the IoT.
In conclusion, this survey paper affirms that while the term Internet of things has been overhyped, security professionals have already started to deal with the initial waves of devices or ‘things’ connected to the internet and have started planning for the challenges of the next wave of devices with are expected to be more complex and diverse. However, the internal controls adopted currently are not sufficient in dealing with a lot of the present day IoT devices. As a solution to that, technological advances need to be adopted in order to maintain an effective internal control
This work was made possible by research materials from notable bodies like the British computer society and the SANS Institute and other notable International journals accessed through the University of Bedfordshire library and Learning Resource Centre (LRC)
 Pescatore, J. (2014). Securing the Internet of Things Survey. Available: https://www.sans.org/reading-room/whitepapers/analyst/securing-internet-things-survey-34785. Last accessed 9th Jan 2016.
 Windriver. (2015). SECURITY IN THE INTERNET OF THINGS Lessons from the Past for the Connected Future. Available: http://www.windriver.com/whitepapers/security-in-the-internet-of-things/wr_security-in-the-internet-of-things.pdf. Last accessed 10th Jan 2015.
 Kumar J, and Patel, D. (2014). A Survey on Internet of Things: Security and Privacy Issues. International Journal of Computer Applications (0975 – 8887). Volume 90 (No 11), p20-26.
 Borgohain T, Kumar U, and Sanyal S. (2015). Survey of Security and Privacy Issues of Internet of Things. International Journal of Advanced Networking and Applications. Volume: 6 (Issue: 4), Pages: 2372-2378.
 Jones, G. (2013). Securing the Internet of Things (IoT). Available: http://www.bcs.org/upload/pdf/securing-the-internet-of-things.pdf. Last accessed 10th Jan 2015.
...(download the rest of the essay above)