This year ‘car hacking’ stories went mainstream. The most frightening was the Jeep Cherokee exploit which made consumers and businesses worry about the safety of our future ‘connected world’.
Analysts at IDC predict spending on Internet of Things (IoT), will exceed US$7.3 trillion by 2017. However, without proper software assurance as instituted from the onset, this won’t be a growth trend, it will be a disaster, says Guillaume Rager, product manager, CAST Software.
Smart hardware is only as good as its underlying software. Manufacturers have known for a long time that putting ‘glitchy’ software onboard devices is asking for trouble. Poorly written software is one of the greatest safety issues today. We’ve seen countless examples of when violations of good coding and architectural practices cause an application to be less reliable and less secure.
In the IoT, this can be downright dangerous. If the smart device is a light switch that turns on when you enter the room, badly written code might result in a stubbed toe. But if it’s a ‘smart’ smoke alarm, fire sprinkler system, or a pacemaker (which can typically contain up to 100,000 lines of code), human lives may be on the line.
IoT is not really creating new problems. Rather, it is exposing developers to problems and capabilities that are already well known, at least in some circles. For example, enterprise and web developers are very familiar with the need for robust security against local and remote attacks by checking or validating data.
The notion of input validation, as the first line of defense, is well accepted in connected systems today. However, IoT development expands the scope of those concerns. Embedded, device, and mobile developers need to start considering security challenges such as input validation during development. It will be too costly to redesign onboard systems to include these defenses after they have been shipped.
In the IoT ecosystem, first to market is often the market leader and developers are therefore under further pressure to get products released. However, this could mean sacrificing quality and dependability for speed – already an issue in many software-intensive environments today.
Despite developers’ best intentions, management is always looking for short cuts. Third-party components help offload some of the burden, but in the IoT, with more complexities and upkeep, components need to be maintained and updated to address problems, like security vulnerabilities, much faster.
One way to meet such demands and ensure the security and software quality of IoT devices is to adopt best practice around software quality, including:
- Management needs to take responsibility for software assurance – Any manufacturer that doesn’t have a set of analytics to track their software risk – be it reliability, security or performance – will be negligent in their responsibility to customers.
- Proper code review and repeat testing is a top priority – Manufacturers must communicate this message to development teams and call for stricter software quality measures.
- Continuous deployment in the connected world becoming business-as-usual – With updates occurring non-stop, often multiple times a day, the software assurance burden on the software that interacts with IoT devices will be higher than ever. If the software isn’t continuously monitored and the code evaluated, this almost certainly guarantees failure.
In addition to measurement and analytics, education needs to be front and centre. We need to communicate with our peers about the direct link between software quality and security. Security vulnerabilities caused by poor coding or system architectural decisions can be some of the most expensive to correct.
By its nature, size, and complexity, software is almost impossible to completely protect from disruptions and breaches. In the IoT, those complexities expand. Understanding the importance of a secure architecture foundation and insisting that developers comply with industry standards will be the first line of defense. CAST can help, so they are not on their own.
The author of this blog is Guillaume Rager, product manager, CAST Software.
Comment on this article below or via Twitter: @M2MNow OR @jcm2m
