IoT Related Risks

IoT technology is increasingly prevalent in our day to day lives, and as a result, the proliferation of IoT devices is accelerating.

In order to reap the positive benefits, IoT ecosystems must be trusted by safeguarding them against malicious activity and inconsistent performance. There are real risks that need to be mitigated.

Allegro Software has created a White Paper “Best Practices for Managing IoT Related Risks“. There are five key IoT risk areas cited in the White Paper.

Device Integrity

IoT devices must be “upstanding members” of IoT communities and operate in such a way that they do not pose a risk to the integrity of the IoT ecosystem.

Some of the characteristics IoT devices must exhibit to ensure integrity are:

• Operating with the latest versions of software
• Can be identified, verified and trusted
• Secure and monitored for irregular activity
• Using the appropriate keys to safeguard against intrusion
• Sends data in an appropriate way

Data Security

Securing data is crucial to maintaining trust in an IoT ecosystem. End to end data communications (Data in Motion) requires end to end data security. Data that is stored (Data at Rest) must be secured against potential breaches.

Once data is created, it must be encrypted as soon as possible and decrypted as late as possible to eliminate opportunities for the data to be compromised.

Operating at Scale

IoT devices tested in a controlled lab environment are easy to manage. However, in a real world environment, the conditions change dramatically.

Examples of factors that must be considered before IoT devices are rolled out at scale:

• Are the devices going to be reliable in the field environment?
• Can the communications network handle the data volumes?
• Can the back end key management system handle all the devices?
• Is the data clean, secure?

Regulatory and Compliance Issues

IoT devices and ecosystems must meet or exceed minimum security standards and regulations. When minimum standards and regulations are not met, it creates a false sense of security which can ultimately erode trust.

Data must be communicated and stored in appropriate ways using independently validated methods. As an example, has the cryptography gone through an independent testing process such as FIPS Validation to ensure the algorithms operate as intended?

Monitoring and Remediation

IoT devices, communication networks and data storage systems must continually be monitored to ensure data is always secure and that expected service levels are being maintained. Suspicious events and malfunctions must be identified and flagged.

Once problems are detected, they must be rectified immediately to minimize disruption or damage caused by potential security breaches. Wherever possible, remediation should be automated to handle problem resolution at scale and in a timely way.

Technologies such as Security Information and Event Management (SIEM) and End Point Detection and Response (EDR) should be deployed for monitoring and problem resolution within IoT ecosystems in order to maximize performance and integrity.