IoT security – A barrier to deployment?

Security takes priority when it comes to the development and deployment of the Internet of Things (IoT), with Gartner predicting that by 2020, IoT security will make up 20% of annual security budgets.

According to Nick Sacke, head of Product and IoT, Comms365, as a potential inhibitor, analysts, vendors and stakeholders alike are concerned about the potentially significant security risks associated with IoT deployments.

These concerns are playing a role in decision-making and end user confidence in deploying IoT services, particularly when it comes to utilising existing networks that are known to be vulnerable, for example, Wi-Fi, and those that are new and operate in the unlicensed spectrum, such as LoRaWAN and Sigfox. Standardisation, or lack of, within the IoT industry is also acting as a barrier to deployment, with older and newer networks deploying IoT, more standardisation regarding security policies is urgently required.

Lack of information

One issue undermining user confidence is the lack of information regarding the security arrangements already in place for networks underpinning IoT, both the licensed and unlicensed variants. Low Power WAN (LPWAN) technology platforms such as LoRaWAN and Sigfox use unlicensed spectrum to deploy IoT sensors at scale and it’s been heavily reported that such network types lack the traditional security mechanisms of cellular networks, with carriers talking about a cellular based IoT network being ‘more secure’ as traffic on these network types is within the control of the respective carrier.

To tackle the argument, it is important to make the distinction between the types of sensor traffic that is passed over these networks, and how security can be applied at various points in the network. For example, all the traffic that runs through a LoRaWAN network of sensors is non-IP protocol based, has business grade 128-bit encryption, and requires decryption via an application server that sits in a private cloud environment.

This contrasts favourably with Wi-Fi based sensor networks that may be interfacing to public internet connections, that require very stringent security requirements locally at site. Ideally, public networks, their providers and the device manufacturers need to look at every element of their design and deployment to ensure maximum security at every level, and to promote these arrangements to users.

Despite these security concerns, it’s important to note that not all IoT networks are as prone to security breaches as others, from a security perspective, the recent networks that are being deployed on LoRaWAN have inherent built in security from the design, which is paramount.

So, who’s ultimately responsible for keeping IoT secure? Should network providers be supplying a super secure network? Does some of the responsibility lie with the user to secure their local area network? Is it up to the IoT device manufacturers to integrate security directly into the device from the off? The answer is yes to all three scenarios.

In order to make IoT secure from development to deployment, down to using the connected IoT device, a co-ordinated joint effort will need to be made by all parties involved. Dependant on the choice of network access technology, there may be inherent security features built-in already, such as those in Cellular LPWAN,but there’s no reason you can’t have similar arrangements for unlicensed spectrum IoT networks , through the creation of a private network type that has layered security end-to-end.

How one city did it

Nick Sacke

The Milton Keynes smart city project deployed a LoRaWAN network towards the end of last year, to provide coverage across city central areas for a variety of use cases including energy, parking and environmental, amongst others.

Data collected from the several thousand LoRa-based IoT sensors is collected securely over the low power wide area network (LPWAN) and deposited in a purpose-built IoT data hub, which allows analytics to be conducted by a variety of stakeholders in a secure monitored way, that is compliant with data protection legal frameworks.

These types of projects undoubtedly hold security as a top priority due to the volume of the deployment and the population numbers that will use the network and the devices connected to it.

Consumers need to have confidence that the security arrangements put in place are robust, not just for the software, but also the physical environment. There are already initiatives to provide much deeper security through blockchain and other platforms, to make even public network traffic more secure. Perhaps the most critical part is the site where the devices are actually deployed and making sure they can’t be hacked into locally.

If someone is able to access and interfere with the device locally, it won’t matter what’s happening on the rest of the path of the sensor data because it’s already been compromised. Tamper-proofing is therefore a key feature when monitoring the health of an IoT sensor deployment, from a simple accelerometer through to temperature changes, the analytics can show or project potential tampering and minimise device interference.

The uncertainty for enterprises around security appears to be a barrier for deployment, but it needn’t be. There are a number of potential areas to secure within an IoT deployment, especially for legacy infrastructure and older networks, but by applying security at each point; device, edge, WAN and cloud, there is a much better chance of mitigating against potential incursion.

Manufacturers have the ability to incorporate certain security features into their devices from the off and that’s something that the semiconductor industry is looking at already. But again, it’s the general lack of standards that stands in the way. There are already a number of security standards in place for the software, but what about the hardware in terms of chips and other parts of the semiconductor package, within the IoT device?

Fragmentation is still an issue as manufacturers are in a way, doing their own thing, but it’s cross coordination between them that will make the most difference. There’s a strong case that deployment and security should not be a concern, provided you’re picking the right system of partners. There are substantial developments and enhancements to security in all types of IoT coming, to give customers comfort that they can deploy with intensity and scale.

The author is of this blog is Nick Sacke, head of Product and IoT, Comms365

Comment on this article below or via Twitter: @IoTNow_OR @jcIoTnow

FEATURED IoT STORIES

9 IoT applications that will change everything

Posted on: September 1, 2021

Whether you are a future-minded CEO, tech-driven CEO or IT leader, you’ve come across the term IoT before. It’s often used alongside superlatives regarding how it will revolutionize the way you work, play, and live. But is it just another buzzword, or is it the as-promised technological holy grail? The truth is that Internet of

Read more

Which IoT Platform 2021? IoT Now Enterprise Buyers’ Guide

Posted on: August 30, 2021

There are several different parts in a complete IoT solution, all of which must work together to get the result needed, write IoT Now Enterprise Buyers’ Guide – Which IoT Platform 2021? authors Robin Duke-Woolley, the CEO and Bill Ingle, a senior analyst, at Beecham Research. Figure 1 shows these parts and, although not all

Read more

CAT-M1 vs NB-IoT – examining the real differences

Posted on: June 21, 2021

As industry players look to provide the next generation of IoT connectivity, two different standards have emerged under release 13 of 3GPP – CAT-M1 and NB-IoT.

Read more

IoT and home automation: What does the future hold?

Posted on: June 10, 2020

Once a dream, iot home automation is slowly but steadily becoming a part of daily lives around the world. In fact, it is believed that the global market for smart home automation will reach $40 billion by 2020.

Read more
RECENT ARTICLES

Infineon and Rainforest Connection create real-time monitoring system to detect wildfires

Posted on: October 22, 2021

Munich and San Jose, California, 21 October, 2021 – Infineon Technologies AG a provider of semiconductors for mobility, energy efficiency and the IoT, announced a collaboration with Rainforest Connection (RFCx), a non-profit organisation that uses acoustic technology, Big Data and Artificial Intelligence / Machine Learning to save the rainforests and monitor biodiversity.

Read more

Infineon simplifies secure IoT device-to-cloud authentication with CIRRENT Cloud ID service

Posted on: October 21, 2021

Munich, Germany. 21 October 2021 – Infineon Technologies AG launched CIRRENT Cloud ID, a service that automates cloud certificate provisioning and IoT device-to-cloud authentication. The easy-to-use service extends the chain of trust and makes tasks easier and more secure from chip-to-cloud, while lowering companies’ total cost of ownership. Cloud ID is ideal for cloud-connected product companies

Read more