Privacy and Security By Design: What IoT Manufacturers Need To Know

Product manufacturers have not, in the past, worried too much about the cybersecurity of their devices. Even as devices have become increasingly connected, it has been more usual to offer security patches after the fact. But with the rapid proliferation of connected devices, and the prevalence of hacking, security breaches and cyber threats, to avoid major breaches or even public harm, products and tools need to have cybersecurity built in from the very beginning. From conception through to delivery, it should be a fundamental aspect of any IoT system/device. It is now of utmost importance that device security is prioritized as part of the very design of a product. This is what is meant by security by design.

Why We Need To Enact Security By Design

It is estimated that by 2020, there will be 20 billion IoT-connected devices in operation. This vast number equates to an enormous attack surface, particularly in regard to threats such as DDoS attacks, which can use vulnerabilities in consumer (and other) IoT products to target organizations, companies, and even governments. Equally, the growth of connected devices in people’s homes and vehicles means that attack risks can become physical. Outside of the consumer realm, the industrial sector frequently uses connected devices and systems (known as IIoT, or the Industrial Internet of Things) for business- and safety-critical applications. A weakness or an opening in the security of production lines or ICS systems could have serious consequences; it is vital that security is built into these devices from conception.

All parties involved in the development of connected machines must build security into not just the products, but the components and the services the products run.

Device manufacturers and IoT service providers should consider the principle of least privilege as a cornerstone of their security by design strategy. This involves precautions such as:

• Ensuring unused ports remain closed
• Hardware should avoid exposing access unnecessarily
• Unused services must be rendered unavailable
• Code functionality should operate at the minimal level necessary for the device to operate
• Administration must be limited to the fewest user accounts possible

In addition, enforcing administrative policies like password strength and rotation requirements, or even simply requiring users to create a password to replace the default is of importance. We have seen worrying examples of products such as nannycams being hacked because of password vulnerabilities like this.

In fact, the exploitation of IoT devices is a launching point for many cyberthreat techniques and is even at the root of spam email. Hackers infiltrate connected objects and build botnets out of the most innocuous-seeming connected devices, which are then used as a base from which to send billions of emails via millions of devices. The owner of the device will rarely be aware that their fridge, washing machine, or security cameras are being used in this way.

In short, software for these devices should be integrated with security controls built into their basic functionality, and administrative access to these systems and tools must be well-controlled and monitored to ensure any unauthorized access is prevented and caught.

Privacy by Design

It is not just the security of devices themselves that is a major concern to be addressed. We are all now acutely aware, as private citizens and customers, of the need to protect our personal data from cyberattacks. This also goes for organizations and enterprises, whose sensitive corporate or industrial data (e.g. that generated by utilities companies), could cause devastation in myriad ways if it passes into the wrong hands.

Meaningful policies and procedures to control how private citizens’ data is collected, stored and used, are quickly becoming legislated, as exemplified by the EU’s GDPR, which came into force in 2018. Therefore, it’s now a matter of regulatory compliance for manufacturers and software providers of IoT devices to prioritize data governance in their systems for the safety and security of consumers. With OT and IT systems converging in the digital era, sensitive data has never been so vulnerable.

One of the biggest threats is posed by unmanaged access to systems and devices. IT teams in industrial and enterprise organizations are quickly becoming cognizant of the importance of securing network access.

Enter Privileged Access Management…

Privileged Access Management (PAM) is essential to the process of ensuring that IoT networks are secured against hacks. But the unique factors involved in IoT or ICS security require a more sophisticated approach than is offered by ‘traditional’ PAM systems.

The vast majority of major hacks can be attributed to privileged account access, and with a large number of potential access points to consider, the PAM solution must offer a robust system and policy for securing the credentials of privileged accounts. Real-time logs of account activity and automated monitoring (and termination) of sessions further help to prevent breaches and to pinpoint the moment when risk is detected. Not only is this vital for keeping the devices (and the networks they connect to) secure, but it is also crucial in order to meet compliance requirements.

Security by design may seem like an ongoing effort for manufacturers and users alike. However, it is an effort that nobody can afford to bypass. The time and resources required to make the necessary changes may seem like an obstacle to manufacturers, with a potential cost they are not willing to spend, but by not doing so, they are putting not only their users and themselves but potentially swathes of the internet in jeopardy. Possibly even jeopardizing human lives if connected devices like traffic signals or production lines are interfered with. Attacks are becoming ever-more-frequent and the consequences more far-reaching. It is time for everybody to prioritize in-built security precautions in connected devices, regardless of their applications.

WALLIX Bastion incorporates security by design at an intrinsic level, controlling privileged user connections to systems and equipment. To find out more about how we can help you to optimize your security, get in touch.