Everyone who has been a part of IoT (Internet of Things) , starting at device manufacturers, network service providers and implementers to customers, makes very important contributions to the security or lack thereof in enterprise IoT, attendees at Security of Things World were told.
“A special point to all (IoT devices) is that they are networked,” Jamison Utter, senior business development manager at Palo Alto Networks told a group at the conference.
“It’s not just a single thing sitting on the counter like my toaster, it participates with the network because it provides value back to business.”
“I think the media focuses a lot on consumer, because people reading their articles and watching the news … think about it, but they’re not thinking about the impact of the factory that built that consumer device, that has 10,000 or 20,000 robots and sensors that are all IoT and made this happen.”
Fact is IoT has security issues is well-known – Utter likens it to the case of Windows 95, which suffered from infamous security problems in large part because it wasn’t designed from the ground up to be secure.
“What we have is simplistic operating systems, running on simplistic hardware, that were not designed for security – just like Windows 95,”
Responsibility Sharing for Security
IoT security isn’t qualitatively different than securing any other broad category of computing device, said Utter – it’s just the scale of the device pool and their computing limitations that makes the task challenging.
At the device, network, data and in the cloud, a patchwork of security implementations will be at play. “That’s why we have to design our security as holistically as possible, rather than trying to pass it off and saying, ‘You guys take care of it.
“Would you accept the same level of security on a car as on a sensor that opens the door? It’s just not appropriate, right? The asset is not as valuable. So what we have to accept is that endpoints will have varying levels of security.”
The network, Utter said, is the key battleground for future IoT security, largely because of economics – some endpoints simply aren’t able to be secured sufficiently without an unreasonable investment of money. If shipping crates with highly secure IoT endpoints attached to them cost too much, for example, that throws off a company’s entire business model.
Visibility, Analysis, Automation, Repeatability
According to Utter, there are four pillars of security for IoT. The first is visibility, which needs to go beyond “which devices are on the network” and delve more deeply into questions like “what are these devices actually doing” and “who is receiving the data they’re sending?”
“I can’t have blindness to what’s happening on my network,”
The second is analysis – and since smart companies are already doing this in the name of business value, it shouldn’t be a major stretch to extend that analysis to security. Following naturally from that, automation to decrease the human workload of managing IoT networks can be implemented.