IoT Security Use-case – Part 2 – IoT Security Fundamentals


In the previously posted An IoT Security Use-Case: Part 1 – The Challenge, we highlighted the IoT environment and the challenges associated with securing such a platform.  In this Part 2, we will outline the various security functions necessary to properly and sustainably secure a distributed and mobile platform that is made of various disparate and vastly different technologies.  Moreover, many of these technologies that make up the platform lack the resources required for robust IoT security.

With traditional security models, each type of technology in the platform winds up with a different level of security.  This inconsistency in the application of security lessens security effectiveness more than any other factor. Uniform and consistent security across all distributed platform components is essential to effective IoT security.

To implement effective IoT security, let’s break down the functional components necessary for the entire platform. By the entire platform, we refer to all applications, clouds, IoT, vendors and associated relevant components. Today, protecting even a single component of an overall platform such as an application means piecing together a number of disparate functions and technologies for each and every individual platform component.  These include:

Control – The ability to trigger on some attribute with a defined action that will allow or deny the communication. Control falls into the following three sub-categories.

Access Control – Tools with the mechanism to allow specific sources to talk to specific destinations via specific communication channels.

Application Control – Mechanism to allow sources to talk to destination using specific application programs such as outlook, Oracle, Gmail and the like.

Content Control – Functionality that allows looking beyond the communication’s attributes like channels or programs to peek at the content. For example, looking for credit cards, social security numbers or any other type of content. Another example is identification and control of site categories such as Adult or Pharma.

Threat Management – This function scans all communications on an ongoing basis and determines if the communication is well or Mal-intended. Threat management comes in two forms – Signature Threat Management and Behavioral Threat Management.

Signature Threat Management – Compares communications to a data base of known exploits. If and when a communication pattern that matches known exploits the threat management system immediately mitigates the malicious communication.

Behavioral Threat Management – This function is focused on identifying unknown attacks and exploits by creating a sandbox environment that assesses the impact of the communication. By measuring the impact of the communication on the sandbox, the system determines the intent of the communication.

Privacy – Privacy is tightly bound to encryption. Encryption prevents content from being seen and recognized by anyone not authorized. Many often call encryption security – it is not! Encryption is privacy and does nothing to implement controls or manage threat.

Identity – Allows the validation of a specific or group of devices and users and is used in conjunction with the various control mechanisms.

The above functions are foundational to IoT security and must exist in in order to achieve a minimum standard of security. In today’s market, the above functions are not provided by any single tool nor are the many tools necessary protect the full spectrum of any distributed platform. Multiple tools must be combined to deliver on the security functions required.  Furthermore, the combined tools only protect one component of the platform such as individual cloud application. Second or third cloud applications, data center applications, offices, or distributed IoTs each require yet another set of multiple combined tool sets. Building one-off security for each platform technology means piecing together a number of different technologies, often from different vendors, to satisfy the various security functions for each.  On average anywhere between 6 to 12 different products are needed, especially when device redundancy is necessary to properly secure each platform component type.

Each of these products have to be evaluated, acquired, implemented, integrated, operationalized, managed, monitored, troubleshot, and refreshed every 3 – 5 years. Furthermore, each of these products require hard to come by and expensive expertise. Different types and levels of expertise are required for each of the installation process, ongoing management, and on-demand troubleshooting. This makes for a very expensive and burdensome process – that is if you can find adequate expertise at all!

Using traditional security models to try and implement effective IoT security – for highly distributed, diverse and resource challenged platforms – is a non-starter in every sense from security effectiveness, cost, and operations to sustainability.

Check out Part 3 – IoT Dependency Computing…

About Acreto IoT Security
Acreto IoT Security delivers advanced security for IoT Ecosystems, from the cloud. IoTs are slated to grow to 50 Billion by 2021. Acreto’s Ecosystem security protects all Clouds, users, applications, and purpose-built IoTs that are unable to defend themselves in-the-wild. The Acreto platform offers simplicity and agility, and is guaranteed to protect IoTs for their entire 8-20 year lifespan. The company is founded and led by an experienced management team, with multiple successful cloud security innovations. Learn more by visiting Acreto IoT Security on the web at or on Twitter @acretoio.

Babak Pasdar
Babak Pasdar
Babak Pasdar is an ethical hacker and a globally-recognized expert in Cyber-Security, Cloud, and Crypto-currency. He has a reputation for developing innovative approaches and methodologies for the industry’s most complex security problems. Before Acreto, Pasdar brought the first proxy-in-the-cloud platform to market, even before the word “cloud” was coined. He called it security in the "Grid". Named one of New York’s Top Ten Startup Founders over 40, he has built and successfully exited two Cyber-Security technology companies and his innovations have been widely adopted by the industry.

Watch Video