Security is one of the most significant barriers to IoT deployment, together with funding, interoperability and the business model. In a study conducted recently in APAC, two-thirds of respondents admitted they have little or no ability to protect their “things” from attacks.
Fraud is growing in this area, and industry leaders across the ecosystem agree that securing the IoT application is the only way to fully develop its business potential. The good news is that the vast majority of attacks can be prevented, and the resilience of any IoT deployment significantly improved, with measures that are simple and cost-effective to implement.
Complex ecosystem needs security to start at its core
IoT fraud is a difficult area for many organisations because the ecosystem is not a simple, linear one. Most IoT projects today are based on ecosystems involving numerous players and covering a range of use cases, across multiple access technologies. As a result of this diverse ecosystem, project managers responsible for designing security around a deployment can find themselves asking “where do I start?”.
The most effective way is to start with the heart of any deployment: connectivity.
For a connected device like a car or watch to become ‘smart’ and respond to the environment, exchange of data between the device and an application, typically located in a data centre, is critical. As a result, connectivity must be placed at the centre of IoT security as well.
However, connectivity in an IoT deployment is multi-layered, including radio access and internet connectivity at the most basic level. Project managers looking to secure an IoT deployment need to take into account the following considerations.
Cellular is the most secure over-the-air technology
The first step is to select the right radio access technology, through which devices communicate over-the-air. Mobile technologies (2G/3G/4G/LTE-M/NB-IoT) hold a clear advantage for IoT from a security perspective.
A SIM card is one of the hardest identifiers in the world to spoof, ensuring high-quality authentication. This is complemented by the fact that mobile networks’ radio communications are encrypted with technology that has been guaranteeing the integrity of communications globally for more than 25 years.
After choosing the radio access technology for the device, the next step is to deploy a smart platform, which manages the device and traffic coming in and out of it: for example, when a location tracker embedded within a logistics shipment keeps track of its location and condition.
Intelligence must be set up inside this platform to protect against attack through rules such as detection of abnormal behaviour patterns (maybe it has become too hot), geofencing (it has diverted from its predefined route), deep packet inspection (the messages it is sending are corrupted), and more.
Protect data in transit over the network
The next area where protection must be put in place is when data is in transit, often across national and network borders. Here again, mobile networks have a strong advantage. For international transport, mobile data traffic uses a highly secure infrastructure called GRX/IPX, which is carried securely on a private network to the platform managing the communications from the device. Enterprises seeking added security can supplement this with a private network to the data centre.
In past years multiple cases of network attacks have emerged: Denial of Service is one such example, where the network gets flooded with so fake traffic that it collapses under the strain. To protect their core infrastructure and IoT devices subscribers from activities of this type, enterprises must assess network protection on regular basis and implement technical solutions, such as signalling firewalls, to proactively detect and block attacks.
For international projects, at least two mobile operator partners are needed in every country, and alternative routes must be preset in case outages occur.
Cost optimisation is an essential part of security management. For a number of IoT use cases, it is possible to differentiate the data traffic into two parts: non-critical (for example web surfing) and critical (for example, all the device, application, and customer management data). In the case of a self-driving car for example, non-critical traffic might include on-board entertainment while critical traffic might include location and navigation.
By using intelligent network policies that route non-critical traffic out to the public internet, while critical data traffic is routed over the leased line or private IPX, enterprises can optimise budget, while ensuring a high level of security for their critical applications.
As the number of deployments soars, IoT security has never been more critical. With every innovation comes the opportunity for a more sophisticated means of capitalising on its weakness. Sat at the heart of each IoT deployment, connectivity plays a central role in protection.
By working with mobile operators or mobile virtual network enablers, enterprises can leverage a global, robust and secure infrastructure already in place, complete with ever-improving industry-standard security processes and best practice at every stage.
