IoT Security Reference Architecture - Cdn2.hubspot

IoT Security Reference Architecture for the EnterpriseIt would be difficult to comprehensively list the threats posed to an IoTecosystem; however, some of the most notorious and notable risksinclude: malware (e.g. Mirai, Satori, Brickerbot, and VPNFilter), exploitkits (e.g. RIG), advanced persistent threats (e.g. Stuxnet), weakauthentication mechanisms, poor password standards, weakcryptography that enables man-in-the middle attacks, session hijacking,and protocol hijacking. Cybercriminals and state-sponsored actors alsopose threats as they seek to exploit IoT devices in order to eavesdrop,collate information, steal sensitive data, extort, or instill operational orreputational damage by causing service interruptions.For the purpose of illustrating the IoT threat landscape, we are using theMicrosoft’s threat model, STRIDE and the IoT threat model as defined byMicrosoft4:Spoofing: A spoofing attack occurs when an attacker pretends to besomeone they're not. An attacker may extract cryptographic key materialfrom a device, either at the software or hardware level, and subsequentlyaccess the system with a different physical or virtual device under theidentity of the device the key material has been taken from. A goodillustration is a remote control that can turn on any TV. This also involvesidentity theft to authenticate user accesses.Denial of Service: Denial of service threats occur when an attacker candegrade or deny service to users. A device can be rendered incapable offunctioning or communicating by interfering with radio frequencies orcutting wires. For example, a surveillance camera that had its power ornetwork connection intentionally knocked out cannot report data at all.And, as we saw with Mirai, a network of those same network-connectedcameras and other poorly-secured IoT devices can be compromised andserve as the source of an Internet-scale denial of service attack.Tampering: An attacker may partially or wholly replace the softwarerunning on the device, potentially allowing the replaced software toleverage the genuine identity of the device if the key material or thecryptographic facilities holding key materials were available to the illicitprogram. For example, an attacker may leverage extracted key materialto intercept and suppress data from the device on the communicationpath and replace it with false data that is authenticated with the stolen49 KUDELSKI -fundamentals/iot-security-architecture 2018 Kudelski Group / All rights reserved

IoT Security Reference Architecture for the Enterprisekey material. This also involves manipulation of data in servers andclients.Repudiation: This occurs when someone performs an action and thenclaims that they did not actually do it. It primarily shows up on operationslike credit card transactions. A user purchases something and thenclaims that they didn’t actually make the purchase. Email is anotherexample. If I receive an email from you, you can claim that you neversent it.Information Disclosure: If the device is running manipulated software, itcould potentially leak data to unauthorized parties. For example, anattacker may leverage extracted key material to inject itself into thecommunication path between the device and a controller, field gateway,or cloud gateway to siphon off information.Elevation of Privilege: This happens when a device that has a specificfunction can be forced to do something else. For example, a valve that isprogrammed to open half way can be tricked to open all the way.Theft: This involves physically stealing the device, intellectual property,or stealing data while in transit or at rest through eavesdropping.ImpactsTo grasp the full extent of IoT threat landscape, the table below (IoTThreat Landscape) illustrates the threats associated at each layer of anIoT Architecture and its corresponding impact on enterprises.Understanding what needs to be secured and from which threats, is thefirst step in developing comprehensive security measures to protect anIoT ecosystem and, hence, the enterprise as a whole.LayerProcess LayerCloud Platform LayerCommunication LayerDevice Layer10 KUDELSKI SECURITYThreatsTheft, RepudiationTampering, Information Disclosure,Elevation of Privilege, Theft, Denial ofServiceTampering, Information Disclosure,Denial of Service, SpoofingSpoofing, Denial of Service, Tampering,Information Disclosure, Elevation ofPrivilege, Theft, RepudiationIoT Threat LandscapeImpactIntellectual Property theft, Lawsuits,Reputational DamageData Breach, Extortion, ServiceInterruption, Privacy Violation, ReputationaldamageData Breach, Service Interruption, PrivacyViolation, Reputational damage, FraudFraud, Service Interruption, Data Breach,Privacy Violation, Fraud, Extortion,Reputational damage 2018 Kudelski Group / All rights reserved

IoT Security Reference Architecture for the EnterpriseIoT Security Impact: A Case Study – Unleashing MiraiMirai is the infamous IoT botnet that took down major websites via amassive distributed denial-of-service attack using hundreds of thousandsof compromised IoT devices. Mirai's first big wave of attacks came inSeptember 2016 against the Krebs on Security website, followed by anattack on the French hosting provider, OVH. Simultaneously, the authorof the malware leaked the code of the malware online, resulting incopycats attacking the Dyn DNS provider (an attack that crippled majorwebsites like Amazon, Twitter, and PayPal) and Deutsche Telekom, aGerman Internet provider (affecting more than 900,000 of its customers).Investigation into these attacks uncovered 49,657 unique IP addresses,assigned mostly to CCTV cameras, in more than 164 countries.5The Impact: The Mirai botnet attack took managed DNS services fromNew Hampshire-based Dyn offline in October 2016, causing short-livedpain for Internet users trying to reach popular web sites like PayPal,Twitter, Reddit, Amazon, Netflix, and Spotify. However, the attacks hadmore lasting implications for Dyn and other Internet companies like it. Areport from BitSight found that around eight percent of the web domainsrelying on Dyn’s managed DNS service dropped the service in theimmediate aftermath of the attack, and approximately 14,500 webdomains that used Dyn’s managed DNS services prior to the Mirai attackalso stopped using them immediately following the attack.6In a highly competitive market, network or website service availability iscrucial to maintaining customer trust and satisfaction and to acquiringnew customers. Hence, the botnet attack impacted companies thatexclusively used Dyn’s services the most severely. Additionally,enterprises who lay victim to a successful DDoS attack can now expect afinancial impact of 2.5 million per attack. Even the mere threat of aDDoS attack can cause businesses to sweat, handing over big money tocybercriminals who threaten a company with a future attack unless theypay protection fees.711 KUDELSKI 2-5m/ 2018 Kudelski Group / All rights reserved

IoT Security Reference Architecture for the EnterpriseSecurity ChallengesWith familiar attacks to manage, securing the IoT ecosystem seems likea no brainer for enterprises. However, security teams face somesignificant challenges in making this happen.The IoT ecosystem is complex. An IoT ecosystem is an amalgamationof diverse, dynamic, independent, and legacy devices that intertwinecommunication protocols, interfaces, and people. At first glance, theenvironment may resemble that of a traditional IT ecosystem, but thesheer quantity and diversity of IoT devices magnifies the attack surfaceand stifles the efforts to integrate security.The complexity of the ecosystem hampers the ability of IT securityprofessionals to exercise basic cyber hygiene, such as keeping aninventory of hardware and software components on the companynetwork, identifying and disabling vulnerable applications that are nolonger in use, consistently backing up data and keeping multiple copies,patching all applications immediately and regularly (unpatched systemsare one of the biggest risk factors for most enterprises), and upgradingaging infrastructure and systems.The variability of risks associated with every deployed IoT system furthercreates new challenges for IT security professionals who have beentasked with addressing those risks. Conflicting viewpoints andrequirements from involved stakeholders also make securing the IoTecosystem a formidable task.IoT ecosystems are difficult to monitor and manage. The morecomplex an environment is, the more likely it is that IT administratorslack visibility, access, and control over one or more of its components.Deployment of IoT devices on legacy infrastructures and non-IP baseddevices also exacerbate the IT administrators’ inability to monitor andcontrol these devices.Additionally, IoT systems can be inflexible and opaque, which creates alack of basic management functionalities that are available in traditionalIT systems. For instance, a system administrator cannot directly accessan IoT system’s operating system and reconfigure it to disableunwarranted hardware and software capabilities. This action couldcompletely break an IoT device or hinder its intended functionality.IT administrators are also challenged by employees who do not exercise12 KUDELSKI SECURITY 2018 Kudelski Group / All rights reserved

IoT Security Reference Architecture for the Enterprisebasic security practices, such as not connecting personal IoT devices tothe IT network, not visiting malicious websites while on the companynetwork, or not keeping their devices up-to-date.IoT ecosystems can be inherently insecure. Multiple factors – lack ofThe Curse of the Minimum ViableProductsecurity-by-design expertise, paucity of incentives to develop securitySecurity researcher David Tentlertold Ars Technica UK that webcammanufacturers are in a race to thebottom, developing products withthe required functionality whiletrading-off security measures toslash costs and maximize theirprofit. Many webcams now sell foras little as 15 or 20 with no aptsecurity functionalities.defenseless against cyberattacks. IoT devices are known to have little tocontrols, or poor implementation – render IoT devices vulnerable andno encryption for securing the data at rest or in transit. They lackmechanisms to ensure that the software they host is protected frommalicious modifications. They have poor or no authenticationmechanisms, poor and insecure update mechanisms, and substandardphysical security mechanisms, all of which work in favor of an attacker.Furthermore, legacy devices are inflexible to change or are no longersupported by manufacturers, making them all the more vulnerable tocyberattacks.IoT standards and regulations are obscure. A lack of mature securityframeworks as well as a breadth of security considerations are bigbarriers for the improvement of IoT security. Currently, there is nocommon approach to cybersecurity in IoT, nor is there a common multistakeholder model on cybersecurity. Therefore, most companies andmanufacturers are taking their own approach when implementingsecurity for IoT, resulting in undeveloped or underdeveloped standardsto guide adoption of IoT security measures and best practices.Fragmentation of regulations also pose a barrier to security, becausethere is no regulation that forces security measures and protocols ateach of the levels of an IoT architecture, including the devices, thenetwork, etc.Unclear liabilities are another significant problem. There is a barrier ofnon-responsibility among the stakeholders involved, both moral andlegal, in the event of a security incident. Lack of opportunity to enforce aperfect isolation between the different elements of an IoT ecosystemunavoidably results in condemnation of different parties involved in theecosystem. In this context, there is a need to clarify the liability of eachactor in case of a security event.There is a lack of IoT security awareness and knowledge. There isan overall lack of awareness when it comes to security of IoT devices.Even more worrisome is the lack of knowledge regarding the threats they13 KUDELSKI SECURITY 2018 Kudelski Group / All rights reserved

IoT Security Reference Architecture for the Enterpriseare exposed to. Most IoT consumers do not have a basic understandingof their IoT devices and the impact on their network environment. Thismay result in devices not being updated and a subsequent breach ofsecurity.IoT Security Reference ArchitectureThe IoT Security Reference Architecture details the best practices andsecurity controls for mitigating the threats, vulnerabilities, and risksidentified in an IoT environment. The recommendations include people,policies, and processes that IoT enterprises should have in place as wellas more specific technical measures.The reference architecture considers numerous security guidelines andstandards, with the two primary sources of inspiration being ENISA’sBaseline Security Recommendations for IoT in the context of CriticalInformation Infrastructures and the Industrial Internet Consortium’sIndustrial Internet of Things Volume G4: Security Framework.14 KUDELSKI SECURITY 2018 Kudelski Group / All rights reserved

IoT Security Reference Architecture for the EnterpriseAdditionally, NIST’s Framework for Improving Critical Infrastructure,Cybersecurity also provided guidance for “aligning and prioritizingenterprise cybersecurity activities with its business/mission requirements,risk tolerances, and resources.” The CIP 003-3 provision in the NorthAmerican Electric Reliability Corporation (NERC)’s cyber-securityspecifications for power systems in US electrical supply was alsorelevant in determining the security controls.8 For a robust list ofguideline and standard references, refer to Appendix C.These recommendations are intended for enterprises that have alreadydeployed IoT devices in their environment. Enterprises can compare therecommendations with their current security posture to identify securitygaps and other complementary technology solutions that would enhancetheir security efforts. For those considering greenfield or next-generationIoT device implementations, it is advisable to take the “security bydesign” approach detailed in Appendix A.People, Policy, and ProceduresLayers CoveredKudelski SecurityTechnologyRecommendationsThreats AddressedNIST CSFAllIdentify, Detect, Respond,Protect, RecoverPeople, Policy, and ProceduresAllBecause people are the weakest link in any cybersecurity effort, it isparamount to establish comprehensive and consistent policies andprocedures for secure IoT deployment. These are guiding principles forgood IoT security practices that also recognize that -review15 KUDELSKI SECURITY 2018 Kudelski Group / All rights reserved

IoT Security Reference Architecture for the Enterpriseexpertise does not necessarily equate to security expertise.Kudelski Security’s Advisory Services recognizes this, and guidesCommon IoT Security AdministrativeQuestionsorganizations to define policies and procedures in key areas of IoTsecurity, including change management, business continuity,Is there a person or role, typicallya board-level executive, who takesownership of and is responsiblefor product, service and businesslevel security?Is there a person or role who takesownership for adherence to acompliance checklist process?Is there a documented businessprocess in place for security?Is there a security policy that hasbeen established for addressingchanges such as vulnerabilitiesthat could impact security?Is there a process in place forconsistent briefing of seniorexecutives in the event of theidentification of a vulnerability or asecurity breach, especially thosewho may deal with the media ormake public announcements?compliance, and data governance. Nonetheless, enterprises that deployIoT solutions, at the core, need to employ the following securitymanagement practices.Risk Identification, Management, and Assessment(NIST CSF: Identify)Enterprises must adjust their existing risk management strategies andprocesses, including risk assessment and supply chain risk managementprocesses, to take IoT into account. Enterprises can use frameworksprovided by NIST (RMF), ISO/IEC 27000, Octave, and NCSC to plan,manage, review, and document their existing security practices.A periodic risk assessment is core to providing an accurate picture of theevolving IoT threat landscape and an opportunity to work closely withstakeholders across lines of business, operati

The fundamentals of an IoT architecture are quite similar to that of traditional IT architecture with multiple endpoints. The main difference is the scale and diversity of the IoT endpoints. Enterprises cannot always guarantee the security of the IoT device, and therefore, understanding and properly setting up each of the four layers in the IoT .