As the Internet of Things unfolds, there will clearly be a clash of cultures when it comes to security. People who manage operational systems such as power plants are used to being able to lock everything down. After all, more often than not, lives can be at stake should the security of a particular system become compromised. The Internet, by contrast, was developed with the assumption that there was a level of trust among the parties accessing it. We've been layering security on top of the Internet ever since -- with mixed success.
As we prepare to connect millions of devices to the Internet, the time has clearly come to rethink the security models being applied across the Internet. Rather than focusing on setting up perimeters that offer little protection once breached, we need to shift the focus toward identifying the real nature of any given threat and containing threats as quickly as possible.
"We need to move to a threat-centric security model," Chris Young, senior vice president of the security group for Cisco, told us. "You need to assume you're going to be attacked and have procedures in place for what to do before, during, and after an attack." What's needed is a closed-loop approach where analytics are used, not only to identify threats, but also to determine how lethal those threats may be. Should any of those threats compromise a system's integrity, the tools need to be in place to isolate that breach as quickly as possible and then remediate it.
However, that may turn out to be a lot easier said than done in a world where machine-to-machine (M2M) connections are getting more complicated by the day. James Brehm, principal analyst for James Brehm & Associates, told us multiple endpoints will be connected to a backend datacenter, and many of them will be in constant communication with one another. In fact, security is likely to give a lot of organizations cause for pause when it comes to anything to do with IoT. "The move to IoT is neither going to be quick or pretty."
For example, Java is a dominant language in enterprise IT applications, and Oracle wants to extend it out to IoT systems. However, a recent Cisco report makes it clear that Java has a lot security issues.
At the recent Machine-2-Machine Evolution conference held as part of an ITEXPO event in Miami, Jeff Smith, CTO for Numerex, a provider of M2M services delivered via the cloud, said that, because the IoT relies on the same protocols as other Internet services, it is subject to the same general vulnerabilities as any other set of web applications. "In terms of the evolution of M2M security, we're still at the knuckles dragging on the ground stage."
A big part of the issue, Smith said, is that a lot of the endpoints used in an IoT deployment are based on commodity processors that cost about $4 apiece. There's not much margin to increase the cost of those endpoints by adding layers of security. Nevertheless, he warned that another Stuxnet-type event that compromised industrial control systems would slow down the growth of the IoT tremendously.
Unfortunately, Susan Peterson, senior software business architect for GE, said at the same ITEXPO event that IT security and operational control people tasked with managing M2M systems speak different languages, and most operational controls people don't even want to talk to the IT department.
"It's really not so much an issue of the technology. It's the culture," Peterson said. "People need to understand the risk versus reward ratio of providing a software update. There needs to be a candid discussion about responsibility." A big element of that culture is the simple fact that many M2M systems have lifespans of 20 years or more.
Obviously, there's still much security work to be done across the IoT landscape before many of these systems should be allowed to become operational. Alas, by the looks of things, the rush to create innovative applications is once again moving well ahead of our collective ability to keep pace from a security perspective. That would suggest that, rather than being well prepared for the almost inevitable breach, many organizations will find themselves cleaning up a mess for the want of a few preventive measures that could have prevented the issue altogether or, at worst, made it easier to contain.