We use cookies to provide you with a better experience. By continuing to browse the site you are agreeing to our use of cookies in accordance with our Cookie Policy.
  • INDUSTRY PRESS ROOM
  • SUBMISSIONS
  • MEDIA FILE
  • Create Account
  • Sign In
  • Sign Out
  • My Account
Free Newsletters
  • MAGAZINE
    • Current Issue
    • Archives
    • Digital Edition
    • Subscribe
    • Newsletters
  • STRATEGY
  • GLOBAL
  • LOGISTICS
  • MANUFACTURING
  • PROCUREMENT
  • VIDEO
    • News & Exclusives
    • Viewer Contributed
    • CSCMP EDGE 2022 Startup Alley
    • Upload your video
  • PODCAST ETC
    • Podcast
    • White Papers
    • Webcasts
    • Events
    • Blogs
      • Reflections
      • SCQ Forum
    • Mobile Apps
  • MAGAZINE
    • Current Issue
    • Archives
    • Digital Edition
    • Subscribe
    • Newsletters
  • STRATEGY
  • GLOBAL
  • LOGISTICS
  • MANUFACTURING
  • PROCUREMENT
  • VIDEO
    • News & Exclusives
    • Viewer Contributed
    • CSCMP EDGE 2022 Startup Alley
    • Upload your video
  • PODCAST ETC
    • Podcast
    • White Papers
    • Webcasts
    • Events
    • Blogs
      • Reflections
      • SCQ Forum
    • Mobile Apps
Home » How secure is your IoT solution?

How secure is your IoT solution?

July 23, 2018
Dagny Dukach
No Comments

Internet of Things (IoT) solutions are becoming increasingly common for both consumers and businesses. While consumers explore Internet-connected refrigerators and webcams, in the business world IoT solutions include:

  • Asset tracking: IoT tools that help companies identify the location of key assets such as trucks or IT equipment;
  • Smart buildings: IoT tools that use distributed sensors to improve environmental quality and lower the costs of heating, ventilation, and air conditioning (HVAC) systems;
  • Supply chain monitoring: IoT tools that help managers predict and avoid delays and damages of in-transit goods;
  • Equipment monitoring: IoT tools that monitor capital equipment to enable preventative maintenance.

While these IoT solutions offer real benefits, they also introduce new security risks, like the risk of data being intercepted or compromised. Companies need to recognize these potential threats and make informed security decisions regarding an IoT solution for their organization. To accomplish this, it's helpful to think in terms of a "threat model." In security parlance, a threat model summarizes: 1) potential attack objectives, 2) the ways in which a system might be compromised, and 3) security countermeasures. Supply chain leaders need to take each of these considerations into account as they build an accurate threat model for their particular IoT solution and environment, since different IoT solutions and environments have different threat models.

Attack Objectives

As you begin to develop a threat model for your IoT application, start by identifying plausible attack objectives. An attacker may have many objectives, but the following are some of the most common worth considering:

  • Physical harm: If your IoT system controls the physical activity of piece of equipment (for example, an industrial automation system), an attack could take control of that activity and do damage to your equipment or the facility.
  • Data corruption: An attacker could send false data (or block data from being sent), causing you to make the wrong decision but without harming any equipment directly.
  • Data destruction: Removing data either directly from the device or from the data-recording or storage system could help an attacker cover up some other malicious activity.
  • Espionage: An attacker could tap into the monitoring capabilities of your IoT system to "snoop" on sensitive data, without tampering with it.

Once you have identified the objective for a potential attack, it is helpful to prioritize which ones you should focus on preventing. For each potential attack scenario, it is useful to ask yourself, "What are the consequences?" to determine the severity of the attack and prioritize concerns. For example, the threat of losing IoT data for one hour due to a bad actor jamming a communications signal is probably less serious than the risk of damage to a facility. Next, consider what reasons an attacker might have to pursue the potential attack goals you've outlined. A scenario with a clear benefit to the attacker is often a bigger concern than one without any clear motivation to act on it. Prioritize threats with a known or conceivable motivation.

Potential Weaknesses

Once you've considered what could happen, next ask, "How likely is it to occur?" Consider potential attack pathways and the security weaknesses that might enable them. IoT vulnerabilities might include configuration errors (for example, neglecting to change a default password) or misuse of access privileges (for example, if a user copies and exports data).

Another key consideration is the potential avenue of attack presented by your IoT device's communications network protocol. This will vary widely based on the network you use:

  • Wired: Wired solutions use a physical connection, such as Ethernet or DSL, to transmit data. These solutions tend to avoid many of the security risks of Wi-Fi and Bluetooth solutions, but they are severely limited in scalability and mobility. As this article explains, wired solutions are generally not a great fit for many common IoT applications because they require so much infrastructure.1 It is often preferable to rely on a wireless technology for a modern IoT implementation.
  • Bluetooth: Bluetooth supports a number of security mechanisms for different versions of the protocol.2 While the simplest security setting offers little protection from nearby eavesdroppers, other settings offer authentication and encryption mechanisms that improve security. That said, these security mechanisms often come at the cost of ease of deployment and maintenance.
  • Wi-Fi: Security for Wi-Fi-connected IoT devices is best summarized by the article "Wi-Fi access for the Internet of Things can be complicated."3 While the original Wi-Fi protocol is not well-suited for mobile IoT devices, there are mechanisms being introduced that should improve security. However, as with most wireless protocols, security improvements often have negative repercussions on operational costs, ease of setup, and compatibility with other existing systems.
  • Cellular: IoT devices that use cellular communication come with a fair amount of built-in security, as outlined in this paper from the cellular standards group GSMA.4 Security researchers have demonstrated ways of intercepting a cell signal with specialized equipment, but these attacks generally require the attacker to be in close proximity to the targeted device. As such, security risks with cellular-based IoT solutions are generally fairly limited.

In addition to the potential attack pathway, there are a number of other factors that you need to take into account in order to determine whether or not your IoT solution is secure. Consider, for example, whether an attacker needs physical access to the IoT device, and if so, how secure those devices are. A device on the outside of a building in a remote area may be more of a risk than a device inside a locked container, for example. Also consider the device itself—what skill set, tools, and time are required to tamper with it, and would the ends justify the means? Finally, consider whether attackers might achieve their objectives by abusing access granted to an authorized individual. What capabilities would the attacker have in this scenario? What safeguards should be established to counter this risk?

Evaluating the ways in which different IoT systems can be compromised will help you to build an accurate threat model of your particular environment. In turn, this careful consideration and evaluation will help you to determine the appropriate IoT solution for a given application.

What countermeasures can you employ?

After identifying the potential attack scenarios, consider the countermeasures that are built in to protect the IoT solution. One level is physical countermeasures—things that prevent or mitigate direct access to the device. Is the device easily accessible? Does the device have ethernet or USB ports that can be used to access the firmware? Is the firmware secured? Consider options for "hardening" the IoT device itself.

Second, consider the communications network (as discussed above). Weigh the tradeoffs of cost, ease, and security to make sure the method you've chosen meets your needs. Make sure that you are employing the safeguards available with your chosen technology.

IoT systems can also employ active countermeasures, such as scanning for unauthorized or unusual access and alerting administrators or security staff, similar to other enterprise systems. Finally, user accounts can be restricted to limit misuse, and the system as a whole can be built to maintain security even if a specific sensor has been compromised.

Making the final call

IoT is creating amazing opportunities for organizations to process data and automate environmental interactions in new ways. But as with all advances, IoT comes with risks. By applying a threat model framework and analyzing the possible attack objectives, security weaknesses, and possible countermeasures, organizations can apply a familiar security framework to this new technology. Organizations that are clear-eyed about evaluating these risks will find and deploy IoT solutions to derive enormous value while maintaining appropriate security.

Notes:

1. For more on the limitations of wired solutions, see Bryan Hughes' article, "Building Real-World IoT Solutions," IOT Agenda (Feb. 7, 2018), https://internetofthingsagenda.techtarget.com/blog/IoT-Agenda/Building-real-world-IoT-systems-Using-SMS-to-connect-sensors-in-the-wild

2. Parikshit Joshi, "Introduction to BLE security for IoT," Simform LLC (July 4, 2017), https://www.simform.com/iot-bluetooth-security-vulnerabilities/

3. For greater detail on these complications, see Peter Thornycroft, "Wi-Fi Access for the Internet of Things Can Be Complicated," Network World (March 21, 2016),  https://www.networkworld.com/article/3046132/internet-of-things/wi-fi-access-for-the-internet-of-things-can-be-complicated.html

4. See, for example, "GSMA Security Guidelines and Assessment," GSMA (Groupe Speciale Mobile Association), https://www.gsma.com/iot/iot-security/iot-security-guidelines/

Technology
Dagny Dukach (team@tive.co) is the marketing manager at Tive Inc. (www.tive.co), a provider of IoT-powered supply chain visibility solutions.
You must login or register in order to post a comment.

Report Abusive Comment

Most Popular Articles

  • Forecasts call for freight rate slumps in 2023

  • Projected U.S. recession in early 2023 will soften freight market

  • Inflation drops again as interest rate hikes hit home, NRF says

  • How to avoid the next crisis: A new approach to supply chain agility

  • New Jersey truck fleet says Freightliner tractors will deliver safety as well as freight

Featured Video

20221107korber large vs

Enhancing Customer Experience with Your Supply Chain Strategy

Viewer Contributed
With the rise of e-commerce, many businesses have had to transform their warehouses to handle online orders in addition to regularly scheduled inventory shipments. This means warehouses need more information than ever before to ensure they can meet customers' needs. As a result, companies need to select warehouse...

FEATURED WHITE PAPERS

  • Guide to Pallet Rack Safety

  • 3PLs: Complete Orders Faster with Flexible Automation

  • A shipper's guide to navigating post-pandemic holiday freight

  • THE NEW WAY TO WAREHOUSE: 4 Innovations in Automation & Robotics to Boost Warehouse Productivity

View More

Subscribe to Supply Chain Quarterly

Get Your Subscription
  • SUBSCRIBE
  • E-NEWSLETTERS
  • ADVERTISING
  • CUSTOMER CARE
  • CONTACT
  • ABOUT
  • STAFF
  • PRIVACY POLICY

Copyright ©2023. All Rights ReservedDesign, CMS, Hosting & Web Development :: ePublishing