The IoT is expected to comprise 20.8 billion devices by 2020, with Gartner estimating that 5.5 million new ‘things’ went online daily during 2016. Nevertheless, robust IoT security remains mired in the creation phase along with nascent interoperability standards. As more and more ‘things’ connect to the Internet, the danger of nefarious attackers exploiting unsecured devices looms ever larger.
It is therefore important for the industry to be cognizant of the very real threat posed by vulnerable IoT devices. Once infected with malware, IoT devices are often hijacked and instructed to join botnets. In addition, vulnerable IoT devices introduce risks that include malicious actors manipulating the flow of information to and from network-connected devices or tampering with devices themselves, which can lead to the theft of sensitive data and loss of consumer privacy, interruption of business operations and potential disruptions to critical infrastructure.
From our perspective, life-cycle management, which includes over-the-air (OTA) updates and vulnerability management, is essential to maintaining the continued security of IoT devices. Specifically, life-cycle management should be implemented via a secure hardware root-of-trust to ensure secure updates of firmware and cryptographic keys. A hardware root-of-trust with a unique cryptographic identifier also allows each IoT device to be uniquely and cryptographically verified to determine if it is authorized to connect to a specific cloud service. Spoofed or unauthorized devices are easily identified by the service and denied access.
This secure connectivity paradigm helps mitigate the effectiveness (and damage) of DDoS attacks against the IoT service itself, while ensuring the integrity and protection of collected data. Preventing malicious actors from manipulating the flow of information to and from network-connected devices is the cornerstone of establishing a secure IoT network.
Download the whitepaper by completing the form on the right.