What It Takes to Secure the Coming Flood of IoT Devices

Connected devices are already here in huge numbers. Ian Hall, Client Success Manager for APAC at the Synopsys Software Integrity Group, notes that Gartner expects 25 billion IoT devices by 2021, and that other analysts and industry sources put the figure higher still. Forecasts of record growth are everywhere, he says, but work on securing this wave of devices has barely started.

Because the Internet of Things is still fairly new, no regulations yet require it to be secure. The scope for abuse is enormous, and it could cause serious embarrassment, or worse, for companies and consumers alike. Hall lists what has already happened: connected devices have been used for large DDoS attacks on websites, home security cameras have been hacked to spy on their owners, and sensitive consumer data has been exposed. In his view, testing and securing IoT promptly is an urgent need.

Four challenges that set IoT apart

IoT systems, the Industrial Internet of Things (IIoT) and connected machinery included, are complicated to secure and present several distinct problems.

• Scale. Traditional web apps run in one place, while IoT software is installed on thousands or even millions of devices that never switch off. Any vulnerability is multiplied across a far larger attack surface.
• Lifespan. Many IoT devices sit inside equipment built to last for years or decades, such as cars, subsea devices and HVAC systems. Patching or upgrading their software regularly is often difficult, so the chance that flaws remain for months or even decades is very high.
• Open-source operating systems. Most IoT devices run open-source operating systems on off-the-shelf hardware and networks. The weaknesses built into open-source software make them easier still to attack.
• 5G. The arrival of 5G is expected to push IoT much further. Its bandwidth and speed will connect everything and keep it permanently online, which raises the likelihood of attack, and a public network is always more exposed.

The attack surfaces testing has to cover

Hall asks readers to think about IoT in settings such as medical devices, automotive equipment and consumer electronics. For security testers, these mixed-technology deployments contain many attack surfaces and technologies, each needing protection:

• Cloud. IoT and cloud computing suit each other well. Only the cloud can supply the capacity and processing that large-scale IoT and its volume of data require. Smart devices will connect by default to edge or central data centres that process and store what they produce, and the cloud can also host security controls for the devices.
• Embedded devices. Every "thing" in IoT is basically a small embedded computer that exchanges data over a network. It has software, a processor, an operating system and limited memory. Like the network it joins, it can be attacked, particularly when it runs old, general-purpose open-source software that is rarely patched.
• Web applications. IoT devices often connect to a web app, and some contain their own web server, so the principles of web app security testing apply to IoT too.
• Custom applications. IoT covers apps for smart cities, cars, agriculture, healthcare and much else. With so many devices, standards and technologies involved, compatibility is poor across the ecosystem, and custom apps are common as a result.
• Network. Most smart devices are connected at all times by default, linked to gateways and back-end systems through a range of protocols. The network is as vulnerable as the cloud, the devices and the web and custom apps.
• Mobile. As 5G spreads, IoT will gain the network speed, device density and data transfer rates needed for billions of mobile IoT devices and the mobile apps that control them. Hall describes network, mobile and cloud as the three pillars of IoT.
• Thick clients. Processing is moving to the edge so that decisions can be made faster. Decentralised thick-client computing at the edge is widespread, especially in devices that sometimes have to work offline.
• Fuzz testing. A device that freezes or misbehaves when fed inconsistent input can disrupt real-world operations. Fuzz testing mimics an attacker by generating a broad range of corrupted input designed to make the application fail.

Many vendors, Hall observes, can deal with one or a handful of these areas. He maintains that Synopsys is the only provider with the tools and expertise to manage all of them in one place with oversight at the systems level.