The Internet of Things has been one of the fastest developing technology trends in recent years. However, increasing security concerns make many potential adopters refrain from using IoT devices. This article covers the challenges of Internet of Things security and possible ways to ensure the security of IoT systems. It’s written for developers of IoT products who want to ensure proper safety.
The Internet of Things, or IoT, is a network of smart devices that connect to each other in order to exchange data via the internet without human intervention. Devices in IoT systems range from simple sensors to DNA analysis devices and refrigerators. IoT technology requires several smart devices that interact closely with each other. The architecture for IoT systems requires wireless networks and a cloud database for communication.
IoT devices can perform different functions, but their main purpose is collecting, storing, and processing data about the environment through sensors in order to pass along this data to other devices.
To ensure data processing, IoT systems include the following components:
- Smart devices with embedded processors
- Gateways with edge processors (smartphones, hubs, or servers)
- Cloud or data centers with remote servers that exchange data through wireless connections
Internet of Things technologies are used in nearly all spheres: in homes, manufacturing, the automotive industry, healthcare, energy, agriculture, and building automation.
While IoT devices make our lives easier and more comfortable, they also face risks of cyber attacks. The security of IoT systems remains a blind spot in most enterprises and households, but it’s naive to underestimate the possible threats from these devices being compromised.
In 2014, Hewlett Packard sponsored a survey which revealed that seven of ten popular smart devices were vulnerable to potential attacks. Most of the security risks identified were connected with unencrypted data, collection of personal data, vulnerable user interfaces, and unsafe communications.
While the market for IoT devices is rapidly growing, the risks of possible attacks are also increasing. According to Gartner, the Internet of Things will include 26 billion connected devices and reach $840.5 million of IoT security spendings by 2020. At the same time, more than 25 percent of identified attacks on enterprises will involve IoT systems, stimulating companies to increase their budgets for IoT security.
Meanwhile, the ways in which hackers can use IoT systems to compromise sensitive information are growing. For instance, some IoT baby monitors contain vulnerabilities allowing unauthorized monitoring, while smartwatches can inform hackers about your location, health data, and even what you’re typing.
Needless to say, since some IoT devices are used for healthcare or human protection, their security can be crucial for people’s lives.
The main challenge with ensuring the security of IoT systems is that most traditional IoT devices are resource-constrained and have limited features, so they can’t run traditional security functions. Here’s a list of other common challenges in IoT security:
Many IoT devices become vulnerable to cyber attacks because their firmware isn’t updated. Even if firmware is attack-resistant when the device first goes online, vulnerabilities may be discovered over time. Thus, devices become less secure without constant firmware updates.
Automatic updates should be enabled by default; even if new firmware updates are issued, not all consumers implement them manually.
Most existing security functions were initially designed for desktop computers and are difficult to implement on resource-constrained IoT devices. Thus, such security vulnerabilities as data leaks and unencrypted data are still common among IoT devices.
Hackers can easily perform man-in-the-middle attacks to compromise an update procedure and take control of your device if it doesn’t use encryption and authentication mechanisms. Attackers can even install malware or change a device’s functionality. Moreover, cleartext messages sent by your device can be captured by other devices and become available to attackers.
Additionally, connected devices that aren’t isolated are susceptible to attacks from each other. For instance, if attackers gain access to one device in your home network, they can carry out malicious activity to compromise other devices.
IoT Toys: A New Vector for Cyber Attacks
By capturing unencrypted messages from your product, hackers can get access to information about your location, bank accounts, health, and more. However, insecure communication isn’t the only way in which attackers can gather personal information about users. All data is transferred via the cloud, and cloud-hosted services can also experience external attacks. Thus, data leaks are possible both from devices themselves and in the cloud.
IoT devices are vulnerable to malware that can be used by attackers to change functions, collect personal data, and launch other attacks. Moreover, devices can come infected with viruses out of the box if manufacturers don’t ensure adequate security of the supplied software. And by the time consumers begin using an IoT device, new vulnerabilities in the firmware may already have been discovered, requiring an update to make the device secure again. Vulnerabilities such as weak authentication or unused and unsecured ports that are open by default may also expose a device to abuse.
One of the security challenges with IoT devices is the risk of service interruption caused either by physical damage or the loss of network connectivity or cloud support.
There’s a risk that a device may be stolen, compromised, or even physically damaged. Moreover, its connection to the network may be interrupted because of Wi-Fi or radio interference or a power outage. As for cloud connections, there are many reasons why your device may lose its link to the cloud. There can be errors in cloud software, loss of internet connection, or simply a decision by a user to stop using a cloud-based application.
Inoperable or damaged products may lead to improper operation of the local network, property damage, and intrusions.
Because of their security vulnerabilities, IoT systems can be susceptible to various cyber attacks. Here’s a list of the most common types of attacks on IoT devices.
- Denial-of-service attacks. IoT devices have limited processing power, making them highly vulnerable to denial-of-service attacks. During a DoS attack, a device’s ability to respond to legitimate requests is compromised due to a flood of fake traffic.
- Denial-of-sleep attacks. Sensors connected to a wireless network should continuously monitor the environment, so they’re often powered by batteries that don’t require frequent charging. Capacity is preserved by keeping the device in sleep mode most of the time. Sleep and awake times are controlled according to the communication needs of different protocols, such as MAC. Attackers may exploit vulnerabilities of the MAC protocol to carry out a denial-of-sleep attack. This type of attack drains battery power and thus disables the sensor.
- Man-in-the-middle attacks. Unencrypted communications or poorly protected IoT networks can be exploited by attackers who insert traffic between devices and cloud-based applications.
- Device spoofing. This is possible when a device has improperly implemented digital signatures and encryption. For instance, a poor public key infrastructure (PKI) may be exploited by hackers to “spoof” a network device and disrupt IoT deployments.
- Malware. Given a lack of software updates, attackers can install malware on a device and use it to perform malicious activity. Such devices as broadband routers, point-of-sale systems, and health devices are susceptible to malicious software.
- Physical intrusion. Though most attacks are performed remotely, physical intrusion of a device is also possible if it’s stolen. Attackers can tamper with device components to make them operate in an unintended way.
- Application-based attacks. These types of attacks are possible when there are security vulnerabilities in device firmware or software used on embedded systems or weaknesses in cloud servers or backend applications.
The main problem with ensuring security of IoT systems is that traditional security technologies aren’t designed for power-constrained devices, low-bandwidth networks, and resource-limited platforms. Moreover, security functions of IoT products may also increase their cost and development time, which is definitely not a driver of business.
IoT security best practices seek to increase the security of three main components of IoT systems: devices, networks, and data.
- Tamper-resistant hardware. IoT devices may be stolen by attackers in order to tamp with them or access sensitive data. To prevent this, it’s necessary to make your product tamper-proof. You can ensure physical security by using port locks or camera covers as well as by applying strong boot-level passwords or taking other approaches that will disable the product in case of tampering.
- Provide patches and updates. While manufacturers are compensated only at the moment of sale, ongoing maintenance of devices requires additional costs. However, the proper security of your products can be ensured only with constant updates and patches. It’s best to establish automatic and mandatory security updates that require no actions from consumers. Inform consumers about the timespan during which you’ll support the product and tell users what they should do after the end of this period.
- Penetration testing and dynamic code analysis. Penetration testing is your main tool for finding vulnerabilities in firmware and software of IoT products and reducing the attack surface as much as possible. Static code analysis is initially used to find the most obvious flaws, but to dig up well-hidden vulnerabilities you’ll need to use dynamic testing. Dynamic testing is performed over compiled code that runs as it would during normal operation, allowing you to test code in situations close to real-life use cases. Since IoT devices extensively interact with their environment and communicate with other devices, the use of dynamic code analysis within penetration testing is extremely important.
- Data protection. IoT devices should also ensure data safety during performance and after the exploitation of your product. Make sure that cryptographic keys are stored in nonvolatile device memory. Additionally, you can offer to dispose of used products or provide a way to discard them without exposing sensitive data.
- Performance requirements. The performance of processors and microcontrollers in IoT devices should meet certain requirements in order to ensure proper usability. For example, they should use little power but offer high processing capability. Moreover, devices should ensure authorization, data encryption, and wireless connections. Whenever possible, your IoT product should also be able to perform its functions even if its connection to the internet is temporarily disrupted.
- Strong authentication. This can be achieved by using unique default credentials. When naming or addressing your products, use the latest protocols to ensure their functionality for a long time. If possible, provide your product with two-factor authentication – for instance, using a sophisticated password and a security code.
- Encryption and secure protocols. Communication between devices also requires security protection. However, cryptographic algorithms should be adapted to the limited capacities of IoT devices. Transport Layer Security (TLS) or Lightweight Cryptography (LWC) can be applied for these purposes. An IoT architecture allows you to use wireless or wired technologies such as RFID, Bluetooth, Cellular, ZigBee, Z-Wave, Thread, and Ethernet. Moreover, you can ensure network security with optimized protocols such as IPsec and SSL.
- Minimize device bandwidth. Limit network traffic to the amount necessary for functioning of the IoT device. If possible, program the device to limit hardware and kernel-level bandwidth and reveal suspicious traffic. This will protect your product from possible DoS attacks. The product should also be programmed to reboot and clear code in case malware is detected, since malware can be used to hijack the device and use it as part of a botnet to perform DDoS attacks.
- Divide networks into segments. Implement next-generation firewall security by separating big networks into several smaller ones. For this purpose, use ranges of IP addresses or VLANs. For secure internet connections, implement a VPN in your IoT system.
- Protect sensitive information. Install unique default passwords for each product or require immediate password updates on first use of the device. Use authentication to ensure that only authorized users have access to data. Moreover, install a reset mechanism to allow clearing of sensitive data and configuration settings if the user decides to return or resell the product.
- Collect only necessary data. Ensure that your IoT product collects only data necessary for its operation. This will reduce the risk of data leakage and protect consumers’ privacy.
- Secure custom network communication. For better security, restrict your product’s communication. Don’t rely entirely on the network firewall, and ensure secure communication by making your product invisible via inbound connections by default. Moreover, use encryption methods and protocols optimized to the needs of IoT systems.
Developers of IoT devices should think about the security of their products starting from the development stage. However, it’s hard to find experienced professionals who can adopt security technologies to the needs of IoT devices. Developing secure IoT products requires the skills of hardware security engineers, engineers with a lot of experience designing secure software, and quality assurance specialists with a lot of experience in penetration testing. Our Apriorit team provides kernel and driver development for Linux as well as services to ensure digital security and software quality. We would be glad to become your long-term partner in IoT development.