IoT software security is the thing

Guillaume Rager, CAST Software

This year ‘car hacking’ stories went mainstream. The most frightening was the Jeep Cherokee exploit which made consumers and businesses worry about the safety of our future ‘connected world’.

Analysts at IDC predict spending on Internet of Things (IoT), will exceed US$7.3 trillion by 2017. However, without proper software assurance as instituted from the onset, this won’t be a growth trend, it will be a disaster, says Guillaume Rager, product manager, CAST Software.

Smart hardware is only as good as its underlying software. Manufacturers have known for a long time that putting ‘glitchy’ software onboard devices is asking for trouble. Poorly written software is one of the greatest safety issues today.  We’ve seen countless examples of when violations of good coding and architectural practices cause an application to be less reliable and less secure.

In the IoT, this can be downright dangerous. If the smart device is a light switch that turns on when you enter the room, badly written code might result in a stubbed toe. But if it’s a ‘smart’ smoke alarm, fire sprinkler system, or a pacemaker (which can typically contain up to 100,000 lines of code), human lives may be on the line.

IoT is not really creating new problems. Rather, it is exposing developers to problems and capabilities that are already well known, at least in some circles. For example, enterprise and web developers are very familiar with the need for robust security against local and remote attacks by checking or validating data.

The notion of input validation, as the first line of defense, is well accepted in connected systems today. However, IoT development expands the scope of those concerns. Embedded, device, and mobile developers need to start considering security challenges such as input validation during development. It will be too costly to redesign onboard systems to include these defenses after they have been shipped.

14714119_For editorial use only Road Record Jeep Grand Cherokee S-Limited
Jeep Cherokee

In the IoT ecosystem, first to market is often the market leader and developers are therefore under further pressure to get products released. However, this could mean sacrificing quality and dependability for speed – already an issue in many software-intensive environments today.

Despite developers’ best intentions, management is always looking for short cuts. Third-party components help offload some of the burden, but in the IoT, with more complexities and upkeep, components need to be maintained and updated to address problems, like security vulnerabilities, much faster.

One way to meet such demands and ensure the security and software quality of IoT devices is to adopt best practice around software quality, including:

  • Management needs to take responsibility for software assurance – Any manufacturer that doesn’t have a set of analytics to track their software risk – be it reliability, security or performance – will be negligent in their responsibility to customers.
  • Proper code review and repeat testing is a top priority – Manufacturers must communicate this message to development teams and call for stricter software quality measures.
  • Continuous deployment in the connected world becoming business-as-usual – With updates occurring non-stop, often multiple times a day, the software assurance burden on the software that interacts with IoT devices will be higher than ever. If the software isn’t continuously monitored and the code evaluated, this almost certainly guarantees failure.

In addition to measurement and analytics, education needs to be front and centre. We need to communicate with our peers about the direct link between software quality and security. Security vulnerabilities caused by poor coding or system architectural decisions can be some of the most expensive to correct.

By its nature, size, and complexity, software is almost impossible to completely protect from disruptions and breaches. In the IoT, those complexities expand. Understanding the importance of a secure architecture foundation and insisting that developers comply with industry standards will be the first line of defense. CAST can help, so they are not on their own.

The author of this blog is Guillaume Rager, product manager, CAST Software.

Comment on this article below or via Twitter: @M2MNow OR @jcm2m


9 IoT applications that will change everything

Posted on: September 1, 2021

Whether you are a future-minded CEO, tech-driven CEO or IT leader, you’ve come across the term IoT before. It’s often used alongside superlatives regarding how it will revolutionize the way you work, play, and live. But is it just another buzzword, or is it the as-promised technological holy grail? The truth is that Internet of

Read more

Which IoT Platform 2021? IoT Now Enterprise Buyers’ Guide

Posted on: August 30, 2021

There are several different parts in a complete IoT solution, all of which must work together to get the result needed, write IoT Now Enterprise Buyers’ Guide – Which IoT Platform 2021? authors Robin Duke-Woolley, the CEO and Bill Ingle, a senior analyst, at Beecham Research. Figure 1 shows these parts and, although not all

Read more

CAT-M1 vs NB-IoT – examining the real differences

Posted on: June 21, 2021

As industry players look to provide the next generation of IoT connectivity, two different standards have emerged under release 13 of 3GPP – CAT-M1 and NB-IoT.

Read more

IoT and home automation: What does the future hold?

Posted on: June 10, 2020

Once a dream, iot home automation is slowly but steadily becoming a part of daily lives around the world. In fact, it is believed that the global market for smart home automation will reach $40 billion by 2020.

Read more

ICP DAS partners with IoT software provider Exosite to introduce “ExoWISE” solution

Posted on: January 18, 2022

Taipei Taiwan. Jan. 16, 2022 – ICP DAS, a  manufacturer of industrial automation equipment, is pleased to announce the new ExoWISE solution. The creation of ExoWISE is the result of a new partnership with Exosite, an enterprise software company and a provider in the Industrial Internet of Things (IIoT) platform market.

Read more

A busy time in the world of telco IoT

Posted on: January 17, 2022

It’s been a busy period for IoT (Internet of Things) market developments that affect the evolving 5G space for telcos. Global freelance business technology journalist, Antony Savvas looks at how IoT movers and shakers could help to further evolve mobile data processing and security.

Read more