Striving for Secure IoT

Review the history and experiences with security in PCs and it doesn't look good. In fact, it appears that everyone got excited about PC applications and avoided, ignored, or didn't care about security with the products and applications that were produced. The same thing is about to happen with the Internet of Things (IoT).

But the history of security with PCs can serve as an example -- we can take lessons learned and apply those to IoT to better ensure that the IoT solutions being produced are secure and successful.

The Internet of Things Global Summit

I attended the recent 5th Annual Internet of Things Global Summit in Washington DC. The opinion of many of the speakers is that security has the potential to impede the success of IoT devices, applications, and services. Everyone talks about how may devices are going to be connected; however, if you look at those devices, many of them have little or no embedded security features. It is really easy to create botnets using refrigerators for example.

Steve Zipperstein of Blackberry presented a keynote and discussed the results of the 451 Research Advisory "Securing the Enterprise of Things." One of the graphics he shared from the advisory highlighted the importance of security for IoT.

The Cybersecurity Act

Another one of the sessions at the conference was titled, "Raising the Bar for Federal IoT Security – The Internet of Things Cybersecurity Improvement Act." Congressman Jim Langevin (D-RI) was the keynote for this session, followed by a panel discussion led by Dan Caprio of the Providence Group, with Jeff Voas of NIST, Beau Woods of the Atlantic Council, and John Marinho of CTIA.

The Internet of Things Cybersecurity Improvement Act of 2017 was introduced by Senator Mark Warner of Virginia in August 2017 and a bipartisan group. The act is in response to the continuing attacks created using infected IoT devices. The bill is an attempt to establish minimum security requirements for federal procurement of IoT devices. It addresses the security challenges produced by the implementation of IoT devices. The bill is designed to investigate clarifications that may be needed, while examining the challenges and opportunities.

It should be of interest to anyone dealing with IoT. Products and services sold to the government that meet the requirements will influence products and services sold to everyone else. Those implementing the act will investigate the extent of how well the objectives can be achieved and how to secure the digital technologies.

What the Act Means

Vendors who supply IoT devices to the federal government would have to ensure that their devices do not include hard-coded passwords that can't be changed, are securely patchable, and are free of known security vulnerabilities, plus other requirements. The bill was drafted with technology and security experts from institutions including the Atlantic Council and the Berklett Cybersecurity Project of the Berkman Klein Center for Internet & Society at Harvard University. The Internet Society also promotes security research through the adoption of vulnerability disclosure policies by federal contractors. It provides legal protections to security researchers who conform to those policies.

The bill:

• Directs the Office of Management and Budget to develop network-level security requirements for devices limited when it comes to data processing and software functionality
• Directs the Department of Homeland Security's National Protection and Programs Directorate to develop and issue cybersecurity guidelines and vulnerability disclosure policies that contractors must adhere to when providing connected devices to the U.S. government
• Will exempt cybersecurity researchers engaging in research from liability under the Computer Fraud and Abuse Act and the Digital Millennium Copyright Act that are engaged in research who follow the coordinated vulnerability disclosure guidelines
• Requires each executive agency to inventory IoT devices in use by the agency. (This can be difficult since some of the IoT devices will be embedded in common systems such as environmental controls, safety devices, electrical systems, etc.)

What Is So Important about IoT Security?

Throughout the summit, speakers brought up many points about IoT security and its market success. One comment involved was about connected vehicles. If the security is not good enough, insurance companies will not insure the vehicles and their owners. Would the car manufacturer be just as liable as the owner? Without any statistics, how does the insurance company even determine the insurance rates?

It may be that vendors will not honor warrantees unless the IoT function is enabled. What is the buyer's responsibility if the security is breached? What is the buyer's responsibility if the IoT function is used to harm other organizations?

Another speaker said if security is not embedded in IoT devices and some drastic occurrence is perpetrated, will that impede or possibly reduce the IoT market because people are afraid to buy the products or services due to inadequate IoT security? Such a backlash could have lasting effects and reduce the market even though there are tangible benefits. IoT users would avoid its connection to the Internet because of security vulnerabilities.

What this means is that dealing poorly with security and privacy in IoT can have wide-ranging ramifications. If security is not properly executed, it could impede, delay, and reduce the market for IoT devices and postpone the available benefits.