IoT Single-Point of Failure

Despite all the excitement—and the clear monetisation opportunities—around IoT and machine/sensor blockchain over the past few years, one major concern keeps coming up.

From my experience working on IoT projects as a lead evangelist architect, a key high-risk area—discussed both publicly and behind closed doors—is end-to-end data security throughout the entire data journey, in both states: data at rest and data in motion.

While data and communication protocols at the machine–human interface are steadily maturing and becoming more streamlined, there still isn’t a widely adopted standard or clear strategy for ensuring true end-to-end security. Figure 1 below provides a visual overview of the risk landscape, highlighting potential unauthorised access points within an IoT solution architecture.

For everyone working in the analytics space, security has to be front and centre in every solution we build. That means designing for security by default, and carrying out continuous, regular security assessments across the full, end-to-end data journey. It shouldn’t be a one-off, point-in-time “dipstick” security and vulnerability review followed by a quick band-aid fix. Instead, we need clear, project- and solution-specific security policies, along with strong governance to implement and manage the relevant security frameworks.

Below are some well-known IoT security breaches (some are real incidents, while others were hacking demonstrations) that threatened the integrity of entire IoT systems:

• STUXNET: In 2014, a malicious computer worm called Stuxnet caused substantial damage to Iran’s nuclear programme—one of the clearest examples of an IoT-related security incident.

• MIRAI BOTNET: Mirai malware targeted Linux-based devices connected to networks and turned them into remotely controlled bots. According to a white-hat malware research group, it was one of the largest attacks and led to a widespread distributed denial-of-service (DDoS) event.

• Connected cardiac devices (IoT hacking risk): In 2017, the FDA acknowledged that certain St. Jude Medical implantable cardiac devices (pacemakers and defibrillators) could be hacked.

• Connected car hacking demonstration: In July 2015, two researchers demonstrated a vulnerability in the digital network of a connected Chrysler vehicle to WIRED.

• Hackable sniper rifles: At the Black Hat conference in 2015, security researchers showed how a wirelessly connected sniper rifle made by TrackPoint could be hacked.

In this “catch me if you can” world—where security by design still isn’t the norm—we, as an IoT community, need to stay vigilant 24/7/365. The bad actors may be lone wolves or state-sponsored, and they don’t follow any rules. Hackers only have to get lucky once; we have to get it right every time.

As a starting point, any IoT project should make formal provisions for the following aspects of data security:

1. Physical (hardware) platform

2. Network (MPLS)

3. Enterprise data stores

4. Data encryption

5. Data integrity

6. Origin authentication

7. Device, network, and data penetration testing

   
   

Concluding statement: Adoption of IoT—by both consumers and organisations—ultimately comes down to trust. Trust in how data is secured, stored, and used. That’s why it’s on us to lead the way by thinking about security first, and by implementing it thoroughly and consistently.