IoT Security Use-case: Part 2 – IoT Security Fundamentals

In the previously posted An IoT Security Use-Case: Part 1 – The Challenge, we highlighted the IoT environment and the challenges associated with securing such a platform.  In this Part 2, we will outline the various security fundamentals necessary to properly and sustainably secure a distributed and mobile platform that is made of various disparate and vastly different technologies.  Moreover, many of these technologies that make up the platform lack the resources required for robust IoT security.

With traditional security models, each type of technology in the platform winds up with a different level of security.  This inconsistency in the application of security lessens security effectiveness more than any other factor. Uniform and consistent security across all distributed platform components is essential to effective IoT security.

To implement effective IoT security, let’s break down the functional components necessary for the entire platform. By the entire platform, we refer to all applications, clouds, IoT, vendors and associated relevant components. Today, protecting even a single component of an overall platform such as an application means piecing together a number of disparate functions and technologies for each and every individual platform component.  These include:

Control – The ability to trigger on some attribute with a defined action that will allow or deny the communication. Control falls into the following three sub-categories.

Access Control – Tools with the mechanism to allow specific sources to talk to specific destinations via specific communication channels.

Application Control – Mechanism to allow sources to talk to destination using specific application programs such as outlook, Oracle, Gmail and the like.

Content Control – Functionality that allows looking beyond the communication’s attributes like channels or programs to peek at the content. For example, looking for credit cards, social security numbers or any other type of content. Another example is identification and control of site categories such as Adult or Pharma.

Threat Management – This function scans all communications on an ongoing basis and determines if the communication is well or Mal-intended. Threat management comes in two forms – Signature Threat Management and Behavioral Threat Management.

Signature Threat Management – Compares communications to a data base of known exploits. If and when a communication pattern that matches known exploits the threat management system immediately mitigates the malicious communication.

Behavioral Threat Management – This function is focused on identifying unknown attacks and exploits by creating a sandbox environment that assesses the impact of the communication. By measuring the impact of the communication on the sandbox, the system determines the intent of the communication.

Privacy – Privacy is tightly bound to encryption. Encryption prevents content from being seen and recognized by anyone not authorized. Many often call encryption security – it is not! Encryption is privacy and does nothing to implement controls or manage threat.

Identity – Allows the validation of a specific or group of devices and users and is used in conjunction with the various control mechanisms.

The above functions are foundational to IoT security and must exist in in order to achieve a minimum standard of security. In today’s market, the above functions are not provided by any single tool nor are the many tools necessary protect the full spectrum of any distributed platform. Multiple tools must be combined to deliver on the security functions required.  Furthermore, the combined tools only protect one component of the platform such as individual cloud application. Second or third cloud applications, data center applications, offices, or distributed IoTs each require yet another set of multiple combined tool sets. Building one-off security for each platform technology means piecing together a number of different technologies, often from different vendors, to satisfy the various security functions for each.  On average anywhere between 6 to 12 different products are needed, especially when device redundancy is necessary to properly secure each platform component type.

Each of these products have to be evaluated, acquired, implemented, integrated, operationalized, managed, monitored, troubleshot, and refreshed every 3 – 5 years. Furthermore, each of these products require hard to come by and expensive expertise. Different types and levels of expertise are required for each of the installation process, ongoing management, and on-demand troubleshooting. This makes for a very expensive and burdensome process – that is if you can find adequate expertise at all!

Using traditional security models to try and implement effective IoT security – for highly distributed, diverse and resource challenged platforms – is a non-starter in every sense from security effectiveness, cost, and operations to sustainability.

Check out Part 3 – IoT Dependency Computing…

 

About Acreto

Acreto is the first cloud-delivered, end-to-end connectivity and security platform that can connect and protect any technology, on any network, anywhere. Acreto SASE +Plus delivers Secure Access Service Edge (SASE) functionalities for access technologies such as devices, networks, IoT / OT and third-parties; while Acreto Secure Application and Data Interconnect (SADI) connects and protects application delivery infrastructure such as clouds, SaaS, data centers and co-locations. Acreto SASE +Plus is SASE plus SADI — one platform with one interface from one provider for all of your technologies around the world. Learn more at https://acreto.io or @acretoio.

An IoT Security Use-case: Part 1 – The Challenge

How Out-of-the-Box Thinking on Security Enabled Business Agility and Growth

Managing budgets is a significant part of any organization’s security efforts. The most immediate and natural reaction to any security effort today is – more money. More money is needed for more security tools, more consultants and more operators. But does more money, more security tools and more people really buy you better security? Let’s dive into this real-life IoT security use-case.

So, what’s involved in protecting a single IoT application platform with today’s security technologies? For example – a bank ATM network. To do this we will first identify the various functions, tools and processes that need to make up the entire IoT security system.

For the next couple of weeks we will be using this ATM network as a use-case for our discussion. Interestingly enough, this is a real-life use-case problem that Acreto has addressed. So bear in mind that the elements, factors and challenges defined here are not hypothetical. They are very real challenges that a financial organization faced as part of their business expansion efforts.

The IoT Security Use-Case

The organization’s traditional branch model was expensive, complex and created many ownership and agility challenges. The lack of agility posed the greatest obstacle for the organization. Their traditional growth strategy involved acquiring real-estate with very specific attributes in very specific locations. This required either a long-term lease or outright purchase of the building. This process took time – and if after much effort, the right building, with the right attributes, was not available in the right location, they had to make some tough decisions. Depending on the importance and priority of the area they either moved on to the next area or went through a resource and time consuming build out.

The organization’s chief strategy officer had a plan to address the burdens of their current slow and tedious approach to business and IoTs factored heavily into it. They would use a combination of ATMs and Interactive Teller Machines (ITM) as well as mobile banks to augment their web site and branch portfolio.

Bank Security Strategy

Their strategy was to continue the personal experience using ITMs that are capable of interactive video conferencing with a 24×7 centralized teller community. The teller community is able to support a very broad, geographically distributed network of ITMs that each function as a mini-bank. Customers can also receive live personalized service by tellers in the mobile banking units.

This approach meant that they could expand at a significantly more rapid pace while still supporting their entire product line. They were able to deploy their ATMs and ITMs in a matter of a few weeks rather than many months. They could also accomplish this at a much lower cost, avoiding construction, legal, compliance and security costs, as well as long-term lease commitments or acquisition costs.

Moreover, with their mobile banks, the organization would be able to go to their customers to provide services rather than be inconvenienced by having them come to a branch. On weekday mornings the mobile bank could be situated at major commercial and industrial areas. On weekend mornings, the mobile banks will be at the beach. Weekend afternoons servicing patrons at sporting events or the park and on Saturday night, concert and nightlife hot spots.

There are many benefits to this approach that include agility, coverage and adaptability to customer demands at a much lower cost. However there was one major obstacle – SECURITY!

These units would be located in a variety of locations including office buildings, airports, train stations, stadiums, hotels, courtyards and even operate curbside. The ATMs, ITMs, Mobile Banks and web site all used untrusted networks. Mobile network LTE and Satellite connections for roaming units as well as WiFi, and Ethernet networks provided by the building facilities for the others. In many instances they use some combination of connections for redundancy and availability.

Though it may seem common sense that ATM and ITMs have hardened cyber-security protection baked in as part of a larger bank security strategy, the actuality is shockingly the opposite. These units are purpose-built IoTs designed to serve a very specific purpose and many do not have much by way of cyber-security protections. It was both surprising and concerning to everyone!

This concern was borne out when the Acreto team was able to remotely access a test ATM via the Internet and successfully issue commands to it. This was a show-stopper for the organization.

In this series we will break down this IoT security use-case and discuss the security fundamentals necessary to protect platform of this type. As well we will breakdown the components of the platform, that range from clouds, SaaS, external vendors and IoTs. Finally, we outline how the Acreto platform was used to deliver simple, uniform and consistent protection for the entire ecosystem.

 

About Acreto

Acreto is the first cloud-delivered, end-to-end connectivity and security platform that can connect and protect any technology, on any network, anywhere. Acreto SASE +Plus delivers Secure Access Service Edge (SASE) functionalities for access technologies such as devices, networks, IoT / OT and third-parties; while Acreto Secure Application and Data Interconnect (SADI) connects and protects application delivery infrastructure such as clouds, SaaS, data centers and co-locations. Acreto SASE +Plus is SASE plus SADI — one platform with one interface from one provider for all of your technologies around the world. Learn more at https://acreto.io or @acretoio.

IoT Security v. Enterprise Security Showdown

For the last 30 years, enterprise technologies have represented the pinnacle of capability, scale and complexity in the IT space. Anyone remotely connected to the enterprise space has heard the term “Enterprise-Grade”, and technology companies work hard to earn the elite product label, “Enterprise-Grade”. However, IT operating models have changed dramatically, and as they continue to evolve, many “enterprise” product offerings have just not adapted. IoT Security is one such area.

The first round of changes were driven by the transition to the cloud, where platforms, users and data operate in a distributed fashion and are remote to one-another. Today, it’s not uncommon for teams from across the planet to talk, collaborate or share data, just as easily as they would if they were in the same office.

The industry’s response has been to tweak existing options to make them cloud-ready. But these tweaks are like whittling away at square pegs to force-fit them into round holes. It’s not pretty, it’s not smooth, and at the end of the day – it’s still a mangled square peg.

This has never been more true than with Cyber-Security tools and technologies. Since the industry came to be in the late 1980s, there have been two security tool options: on-device or gateway.

On-device is marred by limited function and capabilities, while Gateway suffers from its lack of mobility. These options were acceptable with traditional enterprises, but they fell flat with highly distributed and diversified enterprises known as the New Enterprise.

Both on-device and gateway security approaches, when employed for the New Enterprise, make things very complex for two reasons:

  1. Many disparate security technologies have to be acquired, implemented, integrated, operationalized, managed, troubleshot and refreshed every 3-5 years.
  2. Different batches of disparate security technologies are needed for each compute silo, such as Clouds, SaaS, Offices, Data Centers, Remote Users, and Mobile Devices.

This has made security for the New Enterprise much more complex and expensive, with far less agility. Complexity is the enemy of security, resulting in less effective security. That is a lot of blood and treasure for marginal results — at best!

IoTs: Molding Enterprise Technologies in their Likeness

Enter the Internet-of-Things (IoT). IoTs will turn the current approach to security on its head. First, let’s take a look at the difference between IoTs and Enterprise technologies.

Unlike standard-based, high-powered enterprise technologies that use only a handful of operating systems, the majority of IoTs cannot function autonomously.  IoTs have even introduced a new application model called dependency computing.  Thanks to their highly distributed, purpose-built nature and limited resources, IoTs are dependent on a supporting application. That application is often remote and cloud-based. And just as the IoT is dependent on the application to perform its function, the application depends on the IoT’s contributions to to fulfill its purpose.

Another standout difference is that IoTs have an 8-20 year lifespan, a significantly expanded lifetime in comparison to their enterprise counterparts’ 3-5 years. Coupled with distributed or mobile implementations, it means that updates and upgrades can be expensive or prohibitive altogether. Any meaningful security needs to be future-proof, providing sustainability over a device’s 20 year life.

Yet another difference is the operating network. Enterprise technologies mainly operate on secured networks the organization owns and controls. IoTs need to operate on a much wider array of networks that often include multiple disparate public and private networks.

So, it is not uncommon for the location, network, IoT and its dependent applications to be owned and operated by completely different and disassociated parties.

Energy-Rich Enterprises Meet Low-Powered IoTs

One of the most impactful challenges for IoTs and IoT security is power consumption. Enterprise tech has unlimited access to power compared to IoTs, many of which are often limited to on-board power systems. Some of these units have embedded batteries intended to power the device for its full life-cycle, which can be as much as 20 years.

Juxtapose that with the power drain that resource-intensive security functions place on the battery. Ongoing and consistent attacks on devices can lead to premature mortality for devices, by way of battery drain. In fact, if enough IoTs are consistently attacked, the power drain could jeopardize application function or availability.

Then the organization has to decide whether to roll out replacements or operate without the out-of-commission IoTs. In some use-cases depending on the IoT replacement or break-fix costs, some may abandon the application altogether.

Death by 50 Billion IoTs

This drives the next point: IoTs have long-term ownership challenges. Touching an IoT for maintenance is an extremely expensive process, if even possible. And of all technology functions the IoTs may be asked to perform, Security requires the most touches in the form of updates and upgrades.

Considering that security tools need to be upgraded every 3 years or so to keep up with a very dynamic threat landscape, rolling out devices today means that they have security for ½ to ¼ the life of the useful life of the IoT. This is further exasperated by the inability to know that in 3 years an enhanced on-device security option will even be available, and the device is capable of being updated and upgraded.

Then there is scale. Slated to top 50 billion devices in the next 3-4 years, IoTs operate at a scale that the technology industry has never experienced. So not only does the solution need to support distributed, fragmented and under-powered tech, but it has to do it for an unprecedented number of devices. The scale issue alone means that many organizations have to re-think their whole technology strategy.

By virtue of the scale, pricing models have to be re-thought. No one can afford to build out disparate security stacks of many different products for each of the clouds, SaaS, Data Centers and Remote users, and another patchwork quilt of IoT security for all the IoTs in their environment. And no one is willing to pay enterprise prices for the massive volume of different IoTs that need to be supported.

Enterprise-Grade Cedes to IoT-Grade

As the industry has started to regain its balance from the invasion of the cloud, IoTs have appeared on the scene to completely disrupt technology standards and operating models all over again. IoT, especially IoT security has started to, and will continue to knock enterprise security down notch after notch, ultimately to replace the term “Enterprise-Grade” with “IoT-Grade”.

It’s fair to think of enterprise as the 800-pound gorilla, however, the collective IoT pool can best be represented by a massive swarm of bees. With the coming of age of the cloud and now the proliferation of IoTs, the old and tired enterprise security model will suffer a death by a thousand stings from IoT’s killer swarm.

 

About Acreto

Acreto is the first cloud-delivered, end-to-end connectivity and security platform that can connect and protect any technology, on any network, anywhere. Acreto SASE +Plus delivers Secure Access Service Edge (SASE) functionalities for access technologies such as devices, networks, IoT / OT and third-parties; while Acreto Secure Application and Data Interconnect (SADI) connects and protects application delivery infrastructure such as clouds, SaaS, data centers and co-locations. Acreto SASE +Plus is SASE plus SADI — one platform with one interface from one provider for all of your technologies around the world. Learn more at https://acreto.io or @acretoio.

Interested in seeing Acreto SASE+Plus in action? Let’s start with some basic information.




    Interested in seeing Acreto SASE+Plus in action? Let’s start with some basic information.




      Interested in seeing Acreto SASE+Plus in action? Let’s start with some basic information.




        Interested in seeing Acreto SASE+Plus in action? Let’s start with some basic information.