IoT security
- 2. Security from Begining of design ●Security at design phase not at the end phase ● Many of of the security issues overlooked at beginning are forgotten at the end ● Many of the startups doesn’t give priority to security but just feature complete. Even product owner are unaware about the depth of security to be implemented. ● Though we can count security implementation in IoT in 1-2-3 but having it in place is not so simple if not well thought at the beginning. Even lot of investment may to on toss. ● There are many ways to bring it in based on budget, volume, and product life. Abhishek Dwivedi
- 3. Hardware Security ●Make use of secured memory for sensitive data, such as ARM trustZone ●Make use of security chip for holding TSL private keys ●Use only secure boot enabled embedded processors for having a tamper proof SBC. ● Remove debug port/interfaces in production devices Abhishek Dwivedi
- 4. Network Security ●Keep communication secured by cryptography. TLS is a common for this purpose. ●Know the identity of the end node and edge. ●Where ever more threats are possible, keep the identity trusted. Instead of having only TLS, have certificates as well in place. X.509 is being adopted widely. ●Don’t connect to unsecure or loosely secured WiFi. High risk of man in middle attack. Such as over WPA2. Abhishek Dwivedi
- 5. Security at software ●Sandbox apps running on OS. Such as flatpack, snappy. ●Keep kernel level security enabled and enforced on Linux based OS. MAC and DAC enabled. Limit the access by right policy, don’t overlook while writing the access policy configuration. ●Regular patch, specially security patches. ●Wherever possible have OTA in place for immediately resolve found issues. Abhishek Dwivedi
- 6. Identity and Role based administration ●Have bookkeeping of identity of edge/node type and specific role. ●Implement device activity analytics service at device and cloud. ●Blacklisting of suspicious activity on immediate and analyze after from secure admin tunnel at the highest priority. Abhishek Dwivedi
- 7. Proven examples of security breaches ●Remote code execution and having root level privilege in device. ●DirtyCOW, a very much famous bug in kernel got fixed in recent in Kernel. ●In SSH, race condition letting root access. Abhishek Dwivedi
- 8. Thank you!! This is just brief. Each topic has options and details. Abhishek Dwivedi