Original Post from SC Magazine
Author: Doug Olenick
Even as the
technology industry continues to scramble to protect personal computers,
datacenters and other traditional IT systems from increasingly sophisticated
cyberattacks, a new attack target has emerged â the Internet of Things (IoT).
To protect their IoT applications from attack, organizations are working to
adopt for the IoT the same cybersecurity strategy which has proven to be highly
effective for traditional IT infrastructure â Defense in Depth. A Defense in Depth
strategy leverages edge device, network and cloud security capabilities, along
with end-to-end encryption, to create layers of protection that make it harder
for an attacker to effect an IoT application, and easier to detect, isolate and
remediate successful attacks. Implementing an IoT security Defense in Depth
strategy is complicated, and often requires the creation of a large, dedicated
IoT security team to effectively execute. However, a security orchestration
approach to IoT security can simplify the implementation of a Defense in Depth
strategy, and addresses the cost, complexity and other problems that have made
it difficult and expensive for companies to build robust end-to-end security
into their IoT applications.
The Unique Challenges Involved in IoT
Security
IoT applications
can be attractive targets for cyberattacks for a wide variety of reasons. An
attacker may want to penetrate the application to steal data or disrupt
operations in ways that either subtle (to make minor adjustments to sensor data
to mislead business intelligence systems relying on that data) or overt (to disable
the entire application with ransomware). They may want to penetrate the
application in order to leverage the aggregate processing horsepower or
internet bandwidth of a large number of IoT devices to mine cryptocurrencies or
to operate mercenary âDDoS for hireâ botnets. Or they may want to leverage an
insecure edge device to launch a âpivot attackâ on the network to which that
device is attached. For example, in 2018 Darktrace reported an incident they
investigated where a casino network was compromised and its high-roller
database was extracted through an internet-connected thermostat used in the
casinoâs lobby aquarium. There are almost as many reasons to hack into IoT
applications as there are IoT applications themselves.
Securing IoT
applications against these myriad forms of attack is also more complicated than
for traditional IT systems. First, the edge devices used for IoT applications
are often low cost and easily obtainable, making it relatively easy to perform
âtear downsâ to identify exploitable vulnerabilities. Second, these edge devices
are often deployed in accessible, unsupervised locations, which makes it easier
to tamper with them without being detected. And third, IoT application edge devices
are often deployed in large numbers with tight constraints on their bandwidth
and battery power, making it more difficult to deploy security updates in a
timely fashion.
Benefits of Defense in Depth
A Defense in
Depth cybersecurity strategy can address many of the unique challenges related
to IoT application security. Such as strategy strives to slow down and dramatically
increase the cost of an attack by forcing the attacker to circumvent multiple
security mechanisms in order to gain access to the target. This discourages
most attackers who donât have a specific interest in the IoT application. For
example, crypto-miners and DDoS botnet operators will in general move along to
easier targets if they are frustrated by an attack. At the same time, Defense
in Depth also slows down more persistent attackers, while also providing the
IoT application owner with more opportunities to detect their efforts and
deploy countermeasures before the attackers can achieve their goals.
Defense in
Depth takes many forms, and IoT application designers should strive to deploy
as many of them as possible. For example, designers should ensure their Defense
in Depth strategy forces an attacker attempting to intercept communications
from an edge device to the cloud to compromise a cellular carrier firewall to
access a private APN, then a VPN tunnel between the device and the cloud, and
then penetrate application-layer encryption to get at the actual data.
No system
can be made perfectly secure, but like medieval castles, IoT Defense in Depth mechanisms
like those described above complement each security mechanism (moat, castle
wall, keep) with another, making it much more difficult for an attacker to
fully penetrate the application. When properly executed, such a strategy will
frustrate attackers and cause them to give up, and also increase the
probability that an attack is detected before it can succeed or cause
significant damage.
Large,
Dedicated IoT Security Teams â Effective, But Resource-Intensive
However,
implementing an IoT Defense in Depth security strategy is complicated, as
companies need to manage security on different types of devices, multiple
connectivity service providers and various cloud service providers. They need
to ensure all these security mechanisms are kept in synch and work smoothly
together. The entire process is both difficult and time-consuming â much more
so than web or other types of applications.
Some larger
companies have succeeded in implementing IoT Defense in Depth strategies by
creating dedicated teams of experts versed in the security of the key elements
of an IoT application (edge device, network connectivity and cloud management).
These experts implement a Defense in Depth strategy by ensuring each element of
the application has the most up-to-date security possible, while also
coordinating to protect the points where each element integrates with the others.
This approach can be effective, especially as the resulting Defense in Depth
strategy is specifically designed to address the vulnerabilities of the
companyâs particular IoT applications. However, this approach is complicated,
and requires the investment of extensive time and resources.
For example,
an IoT security team still has to manually configure their VPN for different
devices, different network connectivity service providers and different cloud
service providers. All the edge device and network firewalls must be kept in
sync, with trusted hosts added to white lists, along with new ports and
protocols. This approach, using different interfaces to adjust the security of
each element of an IoT application, also increases the chance of human error,
leaving open a vulnerability that an attacker could exploit. In addition, the
costs and difficulties involved in recruiting, hiring, retaining and
coordinating large teams of dedicated IoT security experts make this approach
difficult, if not impossible, for small and medium-sized firms, preventing them
from implementing strong IoT security Defense in Depth strategies.
Security Orchestration: A Different
Way to Easily and Cost-Effectively Implement IoT Defense in Depth
Increasingly,
companies are considering an alternative approach for implementing an IoT
application Defense in Depth strategy â security orchestration. For most
companies, a security orchestration approach allows them to implement a robust
Defense in Depth strategy with a much smaller dedicated security team, and thus
lower initial and ongoing costs.
A security
orchestration approach simplifies the implementation of an IoT Defense in Depth
strategy by providing companies with a solution to orchestrate the deployment
and management of layers of protection around all elements of the IoT
application â edge device, network connectivity and cloud. Security
orchestration solutions not only provide multiple layers of protection for the
IoT application, but also simplify security management by allowing the IoT
applicationâs owner to define a high-level security plan, and then apply and
manage this plan from a single âpane of glass.â Using this single interface,
users can configure and update security provisioning on all their devices,
connectivity providers and clouds, and easily designate who their edge devices
can and cannot communicate with (using whitelists and blacklists) and how they
communicate (ports and protocols).
Key Considerations When
Adopting a Security Orchestration Approach for Your IoT Application
For a security orchestration approach to be effective, the security
orchestration solution needs to be built and maintained by a company with its
own experts in all elements of IoT security â edge device, network connectivity
and cloud. In addition, security orchestration does require IoT application
owners to use a single solution (compromising devices, network connectivity and
cloud management software) for their applications, limiting their flexibility
when it comes to âmixing-and-matchingâ elements from different providers in
their applications.
However,
such an adjustment is well worth the benefits of a more cost-effective and
robust Defense in Depth IoT security strategy, especially for small and
medium-sized firms where investment in a large, dedicated IoT security team is
cost-prohibitive. In a world where IoT applications are playing an increasingly
important role in companiesâ digital transformation strategies and the number
of cyberattacks continues to grow, security orchestration offers companies an
opportunity to implement a simple, affordable end-to-end IoT Defense in Depth
strategy that allows them to better protect their IoT data from being stolen,
altered or lost.
The post Using security orchestration to simplify IoT defense in depth appeared first on SC Media.
#gallery-0-6 { margin: auto; } #gallery-0-6 .gallery-item { float: left; margin-top: 10px; text-align: center; width: 33%; } #gallery-0-6 img { border: 2px solid #cfcfcf; } #gallery-0-6 .gallery-caption { margin-left: 0; } /* see gallery_shortcode() in wp-includes/media.php */
Go to Source
Author: Doug Olenick Using security orchestration to simplify IoT defense in depth Original Post from SC Magazine Author: Doug Olenick Even as the technology industry continues to scramble to protect personal computers,
