Internet of things (IoT) is becoming a major driver for the use of PKI (public key infrastructure), as a growing number of organisations become aware that it provides an important core authentication technology for IoT.
In the latest 2019 Global PKI and IoT trends study conducted by Ponemon Institute on behalf of nCipher Security, respondents said IoT (41%), consumer mobile (44%) and cloud-based services (49%) as the most important technology trends driving the deployment of applications using of PKI.
The number of respondents who said IoT is the most important trend driving the deployment of applications using PKI has almost doubled from the 21% recorded in 2015.
The fifth annual study polled 1,884 IT and IT security practitioners in 14 countries, including Australia, Brazil, France, Germany, Hong Kong, and Taiwan, India, Japan, Mexico, Middle East, Russia, South Korea, Indonesia, Malaysia, Philippines, Thailand, Vietnam, the UK and the US.
PKI is the set of hardware, software, policies, processes and procedures required to create, manage, distribute, use, store and revoke digital certificates and public keys. It enables the use of common technologies such as digital signature and encryption.
For many organisations, PKI is a strategic part of their IT backbone, enabling them to embrace new digital initiatives, such as cloud, widespread mobile device usage and IoT.
It is hardly surprising, therefore, that the study predicted that an average 42% of IoT devices in use will rely primarily on digital certificates for identification and authentication.
FutureIoT spoke with Ian Christofis, managing principal consultant, nCipher Security about the use of secure PKI in IoT deployments.
FutureIoT: The study mentioned that organisations in Hong Kong prefer to have their PKI externally hosted and outsourced, any other takeaways?
IC: Yes, it showed Hong Kong has a strong preference for Online Certificate Status Protocol (OCSP) whereas other markets with CRLs (or Certificate Revocation Lists).
When you’ve got a certificate, the device that’s checking that certificate wants to know whether that certificate has been revoked or not. There are two ways to do this. One is the standard default way where the Certification Authority (CA) periodically publishes a CRL, which is just a list of certificate numbers – with no other information, so the privacy is retained – saying these certificates have been revoked and here’s why. This means that if a device is checking whether a certificate is still valid, it can go separately out (i.e. communicate with a separate server containing the CRLs) to check what the latest CRL says.
The other way is that you can query an OCSP responder and ask, “Is this certificate valid?”, and it says “yes” or “no”, and it gives you a signed response. One of the benefits of OSCP is that rather than having to take extra time to obtain the information from the CRL or OCSP responder, the server can send an up-to-date OCSP response at the same time as the certificate.
Say your device is logging onto a website and the website says, “Here is the certificate for the public key”; and the endpoint says “Well, is the certificate is still valid?”, [it needs to] check the latest CRL or ask the OCSP. So, one of the advantages of OCSP is the server, when it’s sending certificate down, can send the OCSP response with it (the certificate): it says “Here’s the certificate. Here’s its current status – it’s valid”
The OCSP makes it more online and more efficient.
PKI has been around a long time, and a lot of the early design thinking around PKI was very offline, and not really up-to-date – where most things are already online all the time. OCSP sort of moves PKI into the modern age by having it online all the time, and also potentially makes it more efficient because there are fewer round-trips resolving DNS (Domain Name Service) and all that sort of stuff.
So, there’s a stronger preference in Hong Kong and Taiwan for OCSP. There are in a lot of other places too, but it’s one of the areas where Hong Kong looks a bit different to some of the other markets.
FutureIoT: Why did nCipher Security decided to have this study commissioned?
IC: Around about half of our HSMs (hardware security modules) are used for PKI. They may be used for other things as well, but PKI is one of the strong use cases for our hardware security devices and the usage is growing.
The use of HSMs with PKI is growing strongly year-on-year. The latest study found that between 2016 and 2019, you can see steady upward climb from 32% to 42% here in the use of HSMs and that’s a very good thing. The problem without an HSM is that a Certification Authority can be quite vulnerable to attack. Anywhere you are only relying on software protections – I’m sure you know that software can be very flakey and so on – so it’s very hard to secure things really well if you don’t have a hardware security device.
As I mentioned before, the CAs are becoming a critical linchpin in all of the security so you really need to protect the keys and signing things by incorporating HSM into the mix.
However, the use of hardware security modules is still sitting below 50% for CAs which we think is terrible. Anyone running a CA without a hardware security module really is just asking for trouble. If the CA is not protecting anything of a particularly strong value that may be acceptable and you may have other controls around it, but almost always PKI is protecting a lot, and once it is in place, they rely more and more on it. So, the value of attack becomes higher all the time and it’s really important that it’s protected properly with hardware.
FutureIoT: So, what is the biggest challenge for organisation in terms of their PKI environment?
IC: The lack of ownership, or rather management not taking ownership, is actually one of our biggest impediments.
A lot of what tends to happen with PKI is that people just build it to solve a problem. They have got things that need some PKI – such as digital certificates – to work. They will just run up a quick certification authority server as a technical solution to solve a technical problem, rather than seeing it (PKI) as a security protection that’s really important.
If you’ve got PKI, you’ve got a certification authority issuing certificates to lots of different devices; and then lots of other devices are relying on those certificates to communicate with those other endpoints. So, the number of possible endpoint devices, that are either subscribers or relying-parties (that are relying on those certificates), can be very large. What you’ve effectively got is the ability to leverage a little bit of careful effort around the signing keys for the Certification Authority, and really protect that very, very carefully, including with HSMs and very strong processes and approaches and things like that, and use that careful effort around a small amount and spread that careful effort across a mass of stuff that you’re protecting. It’s very cost-effective to protect this little bit really carefully, which protects all of that – all of the endpoint devices/users, and communication between them.
Certainly, with larger organisations, the security team is often taking charge of bringing a whole lot of different bits of the security infrastructure under their central management]. Often though, the PKI is set up just to solve the technical problem – someone sets it up and it is not well-understood, it’s not managed, it’s not very well-secured, so that becomes a juicy target of attack. You are putting a lot of eggs in one basket, and people forget that it not just something you can just put up, it’s something that you have to protect very well to get that security across a massive amount of other things.
If you don’t have good management or ownership and if you don’t have good ownership of security team then you got a potential problem. We have seen this in a lot of organisations.
Not only is there a problem that it might be insecure and be attacked, and therefore all of the devices they depend on it are affected, one of another major problems is that people often don’t manage the certificates. Like the CA is issuing certificates that have a two-year life and the person who sent it up leaves the company and two years after, at some point down the track, the first certificate expires, and things suddenly stop working and because no one was managing it.
It’s really important that people manage it properly. Our most sophisticated customers are controlling that within the security team. The IT security team will own the HSMs and the certification authorities and they will run and manage that and provide those services to a whole range of different business application areas – business owners – within the organisation. By taking careful control, they can do it properly, give it the right level of hardware security modules to secure the keys properly, and put in place proper processes and procedures so that it’s very carefully controlled, and that way that can be consumed by all the different business departments. So that ownership issue is a real concern.
FutureIoT: What’s the role of PKI in IoT deployment?
IC: The main role of PKI is that each device ideally should have its own private keys and certificates that are created when the device is manufactured.
It is happening probably a lot more than people think. If you take a phone, from any of the phone manufacturers, for example, within a phone you would find all the different complements like the screen, the processors, this subsystem, that subsystem, etc. They all were manufactured with their own keys and certificates. Each components of the phone talks to each other, authenticating each other and ultimately subsystems build up and talk to other subsystems and the device itself then have particular keys and certificates that authenticated back to the device manufacturer and to other player. A connected device has roughly 50 different subsystems, each subsystem has its own keys and certificates as part of its manufacturing process.
These private keys and certificates are more prevalent than you think, and increasing with the growth of IoT. There’s more and more processing capability in the IoT devices themselves. If you go some years back the devices were very simple and cheap and they didn’t have the capability of doing that. And if you do have devices like that, then you do have to think of other ways to manage that and keep them secure.
But the gold standard is to have each device manufactured with its own certificate, and they may have subsystems within it, and those certificates are used to control several things. One is that they can be used by the device manufacturer to prevent the subcontracted production lines, which can be another country, in another organisation, from doing over-runs and producing more devices than they should. That’s one way you can get that sort of protection, because any that get produced beyond the production run won’t have a valid certificate that can be enrolled into the ecosystem, right? So that’s one way that can be protected.
Also, then the devices will protect what software they can load on them, so they can do secure boot. Only authorised software will run on the device, which means it can’t get taken over by malware and become a bot attacking things. Like you’ve seen press, I’m sure, of the washing machine and the refrigerator being part of a botnet attacking lots of lots of things. There was the case with the Mirai botnet some years ago. There were millions of devices. It’s some years back now, but that’s classic case in point, where all of these IoT devices were taken over by malware and became major botnets that then being used for DDoS attacks on different organizations.
FutureIoT: What are the things you know in an organisation should take into consideration when doing an IoT deployment and taking PKI onboard?
IC: For an organisation, that’s buying devices. They should be looking to buy devices that are capable of having unique certificates per device. That’s one thing. They should be looking other security controls too like they shouldn’t have default admin passwords, that’s not a PKI thing but there’s a number of other things they should be doing. It’s up to the device manufacturers to lift their game, and they are under price pressure of course, so therefore it comes back on the organisations that are buying the devices to be insisting that the devices are sufficiently secure. If they just buy purely on price and buy a cheap device that’s really insecure, then they are not really helping the market, they should be buying well to drive better security into the device manufacturers.
I think a lot of education still has to happen. There’s still a lot of PKIs that gets created just to solve a technical problem without thinking it properly as a security thing. Everyone is under pressure to get things done, so it’s understandable, but it’s also very dangerous. It’s like building a bit of scaffolding then building a whole 10-storey building on top of it, and forgetting that you didn’t put a proper foundation in place.
