IEEE Spectrum - North American - March 2015 - 53

iNfiLtratiNg the iNterNet of thiNgs (or IoT, for short) doesn't nec-

essarily require a dedicated computer coder gone bad, willing to
devote long hours to finding a vulnerability. These days, an amateur hacker can download existing tools and use them to conduct
a basic attack. On the other end of sophistication, organized crime
and nation states have entered the hacking game.
Unlike business computers, which for decades have been
sheltered behind corporate firewalls and intrusion detection
and prevention systems (IDPS), the products now being linked
to the Internet are frequently on their own. A Columbia University study that ran a set of attacks against business systems and
embedded systems in such consumer products as home entertainment systems, webcams, and Wi-Fi access points found problems
in just 2.46 percent of the business products-and a whopping
41.62 percent of the consumer products. Even in those products
that do have shields, the protections are often not enabled or are
undermined by the use of default or weak passwords.
Too many manufacturers worry more about getting a product
to market quickly than securing it. In some cases, a manufacturer
has taken an apparatus designed for use in a private network
and simply connected it to the Internet without building in any
protection to speak of. It's also true that the devices themselves
are often so small that it's hard to build in the right protection.
And most IoT products, even if secured, have no way to automatically update their security software when vulnerabilities
are discovered. As things now stand, bad actors can exploit any
vulnerability they find for as long as the 10 or even 20 years the
devices remain in use.
The situation has got to change. Product makers-and the people who use these gadgets-have to protect against hacking. And
it is possible to do it.
haCkers who attaCk aLL these systems-home, car, and health-
are typically trying to do one of three things: take control of the
apparatus, steal information, or disrupt service.
Taking control of the apparatus means somehow logging in
as an authorized user, perhaps by figuring out the password,
finding a backdoor, or compromising the authentication mechanism. Strong authentication methods-such as randomly generated passwords; secure, token-based authentication; biometric
authentication; and certificate-based authentication-can make
this much more difficult.
Stealing information can mean eavesdropping or getting into
the systems and collecting data, such as patient information
from a medical device or credit card numbers from a TV used
for home shopping. It can also mean using a product like a phone
system, printer, or video camera to collect and transmit data.
Disrupting service usually means flooding a system, such as a
home-security or vehicle-control system, with messages in order
to make it unable to function.
The simplest way to stop all these attacks is by preventing
hackers from communicating with the gadgets they are trying
to hack. And that means using a firewall and an IDPS.
A firewall acts as a gatekeeper, blocking traffic that should not
be permitted to pass through. An IDPS monitors the computer

emergiNg staNDarDs
for iot seCurity

ecurity standards for IoT products are
evolving. Most of the current standards
came out of a specific industry or
application-for example, the North
American Electric Reliability Corp. has
set critical infrastructure protection (CIP) standards
to secure the electric grid, the U.S. Food and Drug
Administration has a set of guidelines to help product
makers better protect patient health and information,
and the National Institute of Standards and Technology
has created the somewhat broader Cybersecurity
Framework to help the financial, energy, and healthcare industries. Some relate peripherally to the Internet
of Things. But new standards specifically targeted at
the IoT are beginning to emerge. These include:
* the industrial internet Consortium: The
Industrial Internet describes a world in which physical
manufacturing and other machinery connects with
sensors and software that gather data, analyze it,
and use it to adjust the machinery-essentially, the
nonconsumer IoT. The IIC was created to make sure
that products from different companies can easily
share data; its members will be building security
protections into its reference architectures.
* the open interconnect Consortium: This
group of technology companies, such as Cisco, Intel,
and Samsung, is developing interoperability standards
for the IoT and will consider security as it does so.
* the international standards organization's
(iso) special working group on the internet of
things: This group is assessing existing standards
that might apply to the IoT along with current efforts
to develop standards; it plans to help guide their
evolution to better account for security. For example,
this may mean that the world's most widely adopted
family of information technology security standards,
ISO 27000, gets an update that will make it able to
work better with the IoT.
* ieC 62443/isa99, industrial automation
and Control system security Committee: This
committee develops security standards and technical
reports that define procedures for implementing
secure industrial automation and control systems.
* a number of ieee standards address
elements of security that can be applied to the
internet of things, including IEEE P1363, a standard
for public-key cryptography; IEEE P1619, which
addresses encryption of data on storage devices;
IEEE P2600, a standard that addresses the security
of printers and copiers; and IEEE 802.1AE and IEEE
802.1X, which address media access control security.
SPectrUm.ieee.orG

north american

mar 2015

http://SPectrUm.ieee.orG

Table of Contents for the Digital Edition of IEEE Spectrum - North American - March 2015