Creating secure devices for the Internet of Things

The Internet of Things (IoT) and subsequent explosion of connected devices have created a world of opportunities we might never have anticipated. But have these new capabilities and associated connectivity come at the expense of security? We often hear how insecure embedded devices around us are and with sensors communicating from the most seemingly benign of devices – watches, thermostats, kettles and even garden equipment – what are the key challenges for organisations in making IoT devices that are safer by design? What are the design constraints that lead to these devices being insecure?

Gartner has predicted there will be 20.8 billion devices connected to the internet by 2020, with Cisco believing there will be as many as 50 billion by that same year. Regardless of which figure is most accurate, it’s safe to say the growth of connected devices doesn’t appear to be slowing. Since the first devices were given ‘smart’ capabilities, the limits of their security have been tested to highlight the potential security vulnerabilities. Only last year, researchers were able to successfully hack a Jeep Cherokee via the Internet, gaining control of the car through vulnerabilities in the entertainment system software.

Unique IoT design challenges: Creating secure devices

Designing for the IoT comes with a unique set of challenges where implementing traditional security controls is not always an option. However, security incidents such as car hacking will become commonplace unless software is designed securely.

To understand how to overcome these challenges, we need to consider some of the design constraints inherent to IoT devices:

• Low cost and quick route to market: Many IoT devices have little to no security because it increases the short term costs and time to market.
• Limited user interface: Users interact differently with IoT devices because the interfaces themselves are limited. End users are not typically IT staff and the systems are not supported the same as they would be in an enterprise. In fact, most users don’t regularly update their devices which places added strain on the system manufacturer.
• Limited resources: To minimise cost, IoT devices typically have minimal memory, storage and processing power. When systems are designed with low cost components, the addition of security features may compromise system performance.

What can organisations and developers do?

Overcoming these challenges is possible if organisations and developers build security into the devices at the earliest development stages; security needs to be a primary concern alongside cost, reliability and usability. Even when adding security at a later stage is possible, it can throw up challenges related to performance and usability. Executive leadership support is also crucial to ensure security isn’t neglected in favour of lower costs and a shorter time to market.

In addition to building in security from the start, two other key areas to focus on during development include removing unnecessary functionality and ensuring a secure update mechanism is in place. Removing extraneous functionality reduces the attack surface whilst an update mechanism with the proper cryptographic controls means organisations can respond to any vulnerabilities discovered once a system is released.

The Internet of Things offers many possibilities for improving our day-to-day lives and we have become increasingly reliant on IoT devices for both personal and professional purposes. As such, manufacturers and developers should ensure their deployed systems are secure enough to prevent them from becoming the exploitable ‘weak link’.

Dan Lyon, Principal Consultant, Cigital, contributed to this article.