Byline: IoT is Everywhere – Your Security Should Be Too

Over a million new IoT devices are being connected to the internet daily. Experts predict that as many as 25 to 50 billon IoT devices and sensors will be deployed by 2020, for an average of 4.3 internet-connected devices for every man, woman and child on the planet.

Consumer IoT devices such as smart cars, phones, entertainment systems, appliances, watches and clothing are now available. Commercial IoT provides new inventory controls, device trackers and supply chain management. Medical IoT includes medicinal pumps, infusers and health monitors. And industrial IoT is delivering connected meters, flow gauges, pipeline monitors, sanitation systems, manufacturing robots and other types of connected industrial controls.

These devices aren’t isolated. They are being woven into our local, national and global infrastructures, creating a highly meshed and hyper-connected world that collects and shares data to allow devices to make semi-autonomous and autonomous decisions. Combined with cloud computing, ubiquitous broadband and data analytics, IoT has created a new digital economy, and its rapid innovation, new business models and emerging markets are driving explosive productivity gains and economic growth.

In smart cities, IoT solutions are being used to create hyper-connected environments of transportation systems, water, energy, emergency systems and communications, to improve public sector engagement and better, more efficient service delivery and resource allocation. Smart cars monitor road conditions, share positioning and traffic information, monitor internal functions and make split-second autonomous and semi-autonomous decisions. And healthcare, refineries, agriculture, manufacturers, chemical plants, defense, and local and national government agencies have integrated IoT devices to track, monitor, coordinate and respond to events, often without human intervention. Across these industries, data is being used to optimize processes for greater efficiency, safety and quality.

Redesigning the Network

To keep up with the volume of data, transactions and orchestrated interactivity, network ecosystems are being redesigned. Software-defined networks automate the physical network to reduce configuration errors and management overhead, allowing data and resources to be accessed, moved and orchestrated on demand. And as the focus of IT becomes more outcome-based, new intent-based networks will automatically recognize and respond to changing business needs and user requirements, and translate business language into automated policy configurations. Infrastructure is becoming both highly flexible and temporary, allowing connectivity to be created on demand using owned, rented and even borrowed network resources, while innovation and automation is being accelerated by advanced data analytics and correlation.

It’s all very exciting. But how do you secure something like this?

Security Challenges

Where does the firewall go? How do you protect dynamically provisioned workflows, temporary infrastructures, and data that are automatically shuffled between cloud domains? How do you span security across such a wide-ranging and constantly changing threat landscape? And how do you secure IoT devices that were never designed with security in mind?

IoT security challenges include weak authentication and authorization protocols, insecure software, firmware with hard-coded backdoors, poorly designed connectivity and communications, and little to no configurability. Many devices were developed around chunks of commonly available and largely untested code, compounding security vulnerabilities across thousands of devices sold through dozens of manufacturers. And to make matters worse, IoT devices are often “headless,” with limited power and processing capabilities. This not only means they can’t have security clients installed on them, but most can’t even be patched or updated.

One solution is to buy IoT-focused security. Security vendors have begun promoting authentication, key and credential management, access, posture assessment and monitors, trackers and orchestration tools to help organizations see and secure their IoT.

Unfortunately, the IT teams being asked to consume and integrate these new security tools already have dozens of devices from a variety of manufacturers deployed in their networks. New security tools need to be tested, integrated with the network architecture, updated, managed and monitored. Visibility and control is hampered by such challenges as separate management consoles and having to manually correlate threat intelligence between devices.

Redesigning Security

Like the networks being protected, security needs to be redesigned. It needs broad visibility to see what is happening across IT, OT and IoT networks, remote and mobile devices, and public and private cloud networks. And this needs to happen through a single console, in real time, so devices can be identified, risk levels assessed, traffic segmented and policies assigned.

Security also needs to operate at machine speed. By 2020, each of us will generate from one to three terabytes of data per day. When decisions involving such massive amounts of data need to be made instantly, security cannot get in the way. And soon, organizations will need intent-based network security that can automatically recognize network changes, anticipate threats, interpret and implement business language commands and respond to threats.

To do this, IoT has to be viewed in the context of your organization’s total digital transformation and risk management strategy. As IoT devices and data are woven into your hyper-connected network, isolating your IoT security strategy will increase your security overhead and complexity, and reduce visibility and control.

Weaving the Fabric of Security

A security fabric framework approach, however, enables a layered and collaborative defense for your distributed ecosystem. It provides visibility, detection and automated response to sophisticated threats and complex compliance requirements, adapts to distributed and changing networks, and provides the power needed to keep up with growing data and user demands. Open API integration standards combine next-generation detection and response systems, enable intelligent network segmentation and weave single-pane-of-glass management into a unified framework to synchronize threat intelligence and automate responses to security events in real time. 

Such an approach also ensures that you are properly securing access, authenticating devices, assigning risk profiles, moving traffic to appropriate network segments or cloud environments and effectively monitoring traffic as a single, seamless stream of events.

And more importantly, a holistic risk management approach integrates with your larger IT and OT infrastructures to provide complete visibility and unprecedented span of control, allowing you to develop and deploy a critical, hyper-connected IoT infrastructure without compromising the security or integrity of your extended network.