Io t security defense in depth charles li v1 20180425c
- 1. IoT Security Defense in Depth Dr. Charles Li IBM GBS
- 2. • The Cuckoo's Egg: Tracking a Spy Through the Maze of Computer Espionage • A true story about an astronomer-turned-sysadmin at Berkeley in the 1980s who decides to track down a 75 cent accounting discrepancy in server usage, and turns into a year-long hunt to track down a sneaky computer spy operating for the KGB. • Covers several severe holes in Unix security, but emphasizes that the weakest link in security is almost always from human operators A Story in 1980s Where is the Defense in Depth? Where are the endpoints? Where are the perimeter and network defense? That was in 1980s.
- 3. 1McAfeeLabsThreat Report, December 2017 https://www.mcafee.com/us/resources/reports/rp-quarterly-threats-dec-2017.pdf;; 2SymantecInternet Security Threat Report 2017, volume22: https://www.symantec.com/security- center/threat-report.; 3From Q2 2017 to Q3 2017; 4From 2016 to 2017; Note: Averagenumber per breach, M = million Fraud Hacking Ransom- ware Cyber- espionage Targeted attacks Theft / loss Insider (malicious, accidental) 1.1B identitiesexposed 2016 due to data breach2 increasein mobile malware samples1 in one year4 190%57.6M new malware samples1 in a single quarter3 445new threats per minute, or 7.5 per second1 The Era of Aggressive, Relentless Threats
- 4. Expanding Endpoints and Attack Surfaces Human attack surface Server attack surface Network and application attack surface Workstation attack surface Mobile, IoT attack surface Database attack surface Complex Virtual Defense Perimeter Cloud, mobile and IoT proliferation Fragments Defense Perimeter
- 5. Industrial Security Incidents - What’s Being Published Information Technology(IT) attacks Data loss Operation Technology(OT) attacks Human & environmental harm Process interruption Process manipulation
- 6. Information Technology (IT), Operation Technology (OT) & Internet of Things (IoT)
- 7. IoT = Industrial Domain+ Consumer Domain Source: electronicdesign.com
- 8. Information Technology Operation Technology Internet of Things Different looks - Different security
- 9. IoT – Increased Interconnection Source: TU München, Prof. Dr. Alfons Kemper
- 10. IoT Security Requires Both IT and OT Security IT Security OT Security IoT Security Energy, Environment & Utility, Transportation, Oil & Gas, (Waste-) Water, Manufacturing, Chemical & Pharmac, Medical Instruments, Mining • IT Security is for the Corporate network, e.g. Web- and Email-Server, desktops/laptops, network components • OT Security is for Operational Technology (OT) networks, e.g. SCADA, HMI, PLC, RTU, machines, … • In OT, all Hardware and Software form an entity – no part can be change without vendor certification • The IT-OT represents Security measures that can be used in IT and OT. These have to passive components which can’t disrupt the industrial process • IoT Security requires understanding of both IT and OT Security
- 11. Key IT-OT Differences Summary Operational Technology (OT) ▪ Mission critical ▪ Security focus on Safety & Reliability ▪ Maximum attack impact on humans: Life threatening ▪ Security priorities: A -> I -> C ▪ Interruption due to security measures: Not accepted ▪ Communication behavior: Defined and predictable ▪ Change Management: If possible only at maintenance ▪ Penetration tests: Only passive whitebox* ▪ Equipment life cycle: > 15 years ▪ Usual investments: >100M ▪ Processing requirements: milliseconds to seconds ▪ Low response time requirement ▪ Individual architecture (changing) Information Technology (IT) ▪ Business critical ▪ Security focus on Data Confidentially ▪ Maximum attack impact on humans: Annoyance ▪ Security priorities: C -> I -> A ▪ Interruption due to security measure: Accepted ▪ Communication behavior: Complex, s/t unpredictable ▪ Change Management: Anytime, whenever needed ▪ Penetration tests: Active Backbox* and whitebox* types ▪ Equipment life cycle: 3-5 years ▪ Usual investments: 50k – 20M ▪ Processing requirements: minutes to days ▪ High throughput required ▪ Standardized architecture
- 12. IoT Platform and Security
- 13. Data Applications Connectivity to more users, devices, and data than ever before Web Applications Systems Applications APIs Mobile Applications Infrastructure and Devices Datacenters PCs Mobile Cloud Services IoT On Premises Off PremisesUnstructuredStructured Users Auditors Suppliers Consultants Contractors Employees Partners Customers Systems Applications Partners Structured Laptops It’s time to expand from infrastructure to information-centric security Employees Unstructured APIs Off Premises Customers Mobile Applications
- 14. • Development and deployment of applications • Interaction between devices (Things) and cloud applications • Remote data collection and analysis • Provide secure connectivity • Monitor, manage and control connected devices and infrastructure • Integration with 3rd party systems An IoT Platform: An Integrated Suite of Components
- 15. IoT Platform Reference Framework Devices / Sensors / Network / Things / Applications Connectivity Data Integration / Ingestion Storage, Analytics, and Query Visualization Security Lots of technologies, vendors, and approaches for each component Source: Rouge Group LLC.
- 16. • Initial design was for private communication network then moved to IP network and later on the Internet • Firmware updates are hard or nearly impossible after installations • Started with basic security then found the security flaws and attached more complex security requirements later • Low security devices from early design are still out there and used in compatible fall-back mode IoT Security Challenges
- 17. Many Aspects of IoT Security Silicon IoT Devices Networks Solution & Applications Cloud End-end IoT security Gateways Leverage in silicon security & trusted modules Mutual identity validation device- cloud: Secure tokens or client-side certificates Secure communications: TLS v1.2, HTTPS Encrypted data Application access control & user management Visibility of threats: Security dashboard Incident response: policies Solution or industry specific security Authentication Authorization Access Control Data encryption Firewall ISO27k compliance Physically Secure datacenters Operational controls Edge security: Trusted gateways Auto device registration
- 18. A Secure IoT Platform - IBM Watson IoT Platform Authentication Identity & Credentials Authorization Privileges Access Control Application resource access Data isolation Data Security Encryption at rest Encryption in-flight Authenticated by IBM ID With Access governed by Roles Flexibility of trusted gateways providing limited device management and registration capabilities Secured Connectivity: • MQTT over TLS or • HTTPS over TLS Watson IoT Platform Console Secured by security authorisation token or certificates User/operators REST and Real-time APIs 10101 01010 10101 Authenticated by IBM ID With Access governed by Roles Flexibility of trusted gateways providing limited device management and registration capabilities Data encryption Secured by API key IoT Device AIoT Device AIoT Devices IoT Device AIoT Device AApplications IoT Device AIoT Device AIoT Gateway IoT Device A Other examples – AWS IoT, Microsoft Azure IoT, Google Cloud Platform, ThingWorx IoT Platform, CISCO IoT Cloud Connect, HPE Universal of Things (IoT) Platform
- 19. IT-OT Convergence For Security Operations Prioritized incidents Embedded Intelligence DATA SOURCES INCL. INDUSTRIAL PROTOCOLS Operation Network: Control Systems/ SCADA, Historian, HMI, PLC. Field level: PLC, sensors, analog protocols Corporate IT: Security data on networks, hosts.
- 20. Risk and Security Threats in IoT vs IT Information Technology (IT) Attacks on data-center hosted data and services • Exposure to IT networks from OT networks • Human error or sabotage of operations systems • Unprotected (or under protected) components in network • DDoS or mis-information attack • Attack from mobile-based remote maintenance apps • Technical malfunctions of components Operational Technology (OT) Damage to plant, equipment, quality and output • Loss of production • Loss of intellectual property • Capital Loss • Triggering safety procedures or interfering with safety systems • Deterioration of product quality IoTSecuritylayers. Alargeattacksurface
- 21. IoT Rising Threats: Diligent and Persistent with Defense in Depth
- 23. Rises of Threats Target IoT Devices https://securelist.com/honeypots-and-the-internet-of-things/78751/
- 24. • The Mirai Botnet (aka Dyn Attack) • The Hackable Cardiac Devices from St. Jude • The Owlet WiFi Baby Heart Monitor Vulnerabilities • The TRENDnet Webcam Hack • The Jeep Hack The 5 Worst Examples of IoT Hacking and Vulnerabilities in Recorded History https://www.iotforall.com/5-worst-iot-hacking-vulnerabilities/
- 25. IoT Security: Defense in Depth Network Host Application Gateway Controllers Data/Devices IT Security IoT Security Network Host Application Data Physical – Technical – Administrative Security Controls
- 26. Questions or Discussions? Dr. Charles Li Charles.Li@ibm.com, 202 330 1009 Lead of Integration and Innovation IBM GBS Cybersecurity and Biometrics
- 27. #1 – Authorization: IoT device or server has proper authorization to send or receive that stream of data #2 – Open Ports; An IoT device is dangoursly vulnerable when it’s sitting and listening to an open port out to the internet #4 – Encryption: You need end to end encryption between devices and servers IoT Basic Security Measures