7 steps to enhance IoT security

Securing the IoT is a multi-faceted effort that requires big moves as well as small adjustments to ensure networks, systems, data and devices are protected. Here are 7 security practices you might not have considered.

One of the biggest concerns with the Internet of Things (IoT) is making sure networks, data, and devices are secure. IoT-related security incidents have already occurred, and the worries among IT, security and networking managers that similar events will take place are justified.

“In all but the most restrictive environments, you’re going to have IoT devices in your midst,” says Jason Taule, vice president of standards and CISO at security standards and assurance company HITRUST. "The question then isn’t if, but how you are going to allow such devices to connect to and interact with your networks, systems and data.”

What can organizations do to enhance IoT security? There are plenty of options—including a number of practices that might not be so obvious.

IoT security: start by thinking small

To build better security into IoT, organizations should start with the smallest component in their network infrastructure—the code, says Laura DiDio, principal at research and consulting firm ITIC.

“The majority of IoT devices are very small,” DiDio says. “Therefore, the source code tends to be written in the ‘common tongue’—C or C++ and C# languages which frequently fall victim to common problems like memory leaks and buffer-overflow vulnerabilities. These issues are the network equivalent of the common cold.”

And like the common cold, they are pesky and persistent, DiDio says. “In IoT environments, they can proliferate and become a big and often overlooked security problem,” she says. “The best defense here is to test, test and re-test.” There are a variety of well-regarded testing tools on the market that have been used for IoT devices, DiDio says.

Security and IT administrators can also use stack cookies, DiDio says. These are randomized data strings that applications are coded to write into the stack just before the Instruction Pointer Register, to which data overflows if a buffer overflow occurs. “In the event a buffer overflow does occur, the stack cookie gets overwritten,” she says. The application will be further coded to verify that the stack cookie string will continue to match how the code was initially written. If the stack cookie doesn't match, the application terminates.

Deploy context-aware access controls

Controlling access within an IoT environment is one of the bigger security challenges companies face when connecting assets, products and devices. That includes controlling network access for the connected objects themselves.

Organizations should first identify the behaviors and activities that are deemed acceptable by connected things within the IoT environment, and then put in place controls that account for this but at the same time don’t hinder processes, says John Pironti, president of consulting firm IP Architects and an expert on IoT security.

“Instead of using a separate VLAN [virtual LAN] or network segment which can be restrictive and debilitating for IoT devices, implement context-aware access controls throughout your network to allow appropriate actions and behaviors, not just at the connection level but also at the command and data transfer levels,” Pironti says.

This will ensure that devices can operate as planned while also limiting their ability to conduct malicious or unauthorized activities, Pironti says. “This process can also establish a baseline of expected behavior that can then be logged and monitored to identify anomalies or activities that fall outside of expected behaviors at acceptable thresholds,” he says.

Hold vendors accountable for their IoT equipment

Organizations as a matter of course hire all kinds of service providers, and in some cases those services are provided through equipment that’s placed on the customer’s premises. In the age of IoT, there’s a good chance the machinery will be connected and therefore vulnerable to hacking and other intrusions.

It’s up to the customer to ensure that there is accountability in place if something goes wrong.

“One place to start is within contracting,” says Brian Haugli, a partner at security consulting firm SideChannelSec and a former security executive at insurer Hanover Insurance Group. “Are your vendors pushing an IoT into your enterprise as part of their services or solutions? If so, you must know about it and see that it's part of the contracting/procurement.”

Make sure it's clear who's responsible for updates and the lifecycle of the equipment, as well as if you'll have access to it in case of an incident, Haugli says. “I've seen HVAC [heating, ventilation, and air conditioning] and printer companies not give up access that led to a stalled response effort,” he says. “Those same vendors would push back on routine patching responsibilities or upgrades” to operating systems.

In some cases, a contract might not specify when the customer would warrant a new piece of equipment with a supporting operating system, and the vendor might be unwilling to take on the cost, Haugli says. As a result, an unsupported and vulnerable device could be allowed to sit on the network far longer than it should.

“If we aren’t articulating our requirements to our vendors, don’t take steps to confirm compliance and aren’t holding them accountable, what basis do we have for expecting these issues to be addressed?” Taule says. “In the same way that hardware OEMs and software companies now all expect to be held accountable to identify and quickly resolve weaknesses in their products, so too should the companies that provide us the IP cameras, medical devices, printers, wireless access points, refrigerators, environmental controls and the untold number of other IoT app devices upon which we increasingly rely.”

Companies should apply the controls outlined in common security frameworks to IoT devices, Taule says. For example, include security functional requirements in your contracts; request recent vulnerability scans or assert the right to scan them yourself; obligate the vendors to provide timely updates to address identified weaknesses; and rescan the devices after any firmware updates to ensure that identified issues have been resolved and that no new issues have been introduced.

Read More…….

Source: 7 steps to enhance IoT security