Strengthening IoT security

1 April 2018 Editor's Choice, Information Security, Industrial (Industry)

In January 2018, a new international standard on ‘Security capabilities supporting safety of the Internet of Things’ (Recommendation ITU-T Y.4806) officially came into play. Recommendation ITU-T Y.4806 was developed by Study Group 20 ‘Internet of things (IoT) and smart cities and communities’ of ITU’s Telecommunication Standardization Sector (ITU-T). This new standard classifies security issues for IoT, examines possible threats for security systems, and clears out the safe execution of IoT cyber-physical systems ­supported by security capabilities. Kaspersky Lab, as a member of ITU-T Study Group 20, was one of the contributors to the development of Recommendation ITU-T Y.4806.

Kaspersky Lab researchers have shown that non-computing connected devices’ incidents are among the top-3 – incidents with the most severe financial impact1, for both SMB and enterprise organisations, and are going to increase2. In the wake of the recent TRITON attack, targeting industrial control systems, it became obvious that attacks on cyber-physical systems can affect not only the information aspects, but also functional safety. Therefore, in response to today’s growing prevalence of IoT threats and elaboration on crucial industry standards, Kaspersky Lab ICS CERT experts actively contributed to the development of Recommendation ITU-T Y.4806 ‘Security capabilities supporting safety of the Internet of things’3 in order to determine which security capabilities specified in Recommendation ITU-T Y.4401/Y.2068 ‘Functional framework and capabilities of the Internet of things’ support safe execution of IoT.

The experts provided up-to-date specific recommendations for IoT framework security. Recommendation ITU-T Y.4806 is mostly applicable to safety-critical Internet of Things (IoT) systems, such as industrial automation, automotive systems, transportation, smart cities, and wearable and standalone medical devices. Additionally, Recommendation ITU-T Y.4806 considers how the joint analysis of threats and security capabilities mentioned therein may be used to establish security requirements for the different applications of the Internet of things.

“In the wake of the recent TRITON attack targeting industrial safety systems, it became obvious that attacks on cyber-physical systems can affect not only the information aspects, but also the functional safety. Our aim was not only to plant the flag on the idea of high probability of security breach attacks, but also to determine the methodology for developing specific requirements. We believe that our contribution to ITU-T’s IoT security standard (Recommendation ITU-T Y. 4806) will help organisations develop more efficient cybersecurity strategies to fully face up to modern cyber threats,” added Andrey Doukhvalov, head of Future Techs, Kaspersky Lab.

According to Kaspersky Lab ICS CERT experts, the most common cyber-physical system vulnerabilities include:

• Insufficient protection of embedded web servers (web applications).

• Self-made, poorly implemented cryptography.

• Built-in credentials, which are stored in firmware of programmable logic controller and allow remote hidden access with high privileges.

• Execution of arbitrary code.

• Escalation of privileges.

To counter the above vulnerabilities, and other less frequent IoT security challenges, recommendations developed by Kaspersky Lab ICS CERT experts describe how to proceed from consideration of the types of impact on the cyber-physical system, to the analysis and modelling of threats to functional safety, and then to the development of recommendations on security measures, illustrating the described method with concrete examples.

To avoid attacks such as TRITON and, as per Recommendation ITU-T Y.4806 which summarises the data necessary to establish the requirements for industrial control systems to resist security threats that could affect safety, Kaspersky Lab experts strongly recommend the following:

• To implement reliable and resistant to attacks communication infrastructure and monitoring mechanisms, as well as mutual authentication and authorisation for management and control.

• To implement the audit of management and control procedures and attack detection mechanisms.

• To implement the mechanism to monitor the load on equipment and communication channels, including the detection of both unintentional overload and denial of service attacks.

The full method and list of advice for the protection of IoT critical infrastructures can be found in Recommendation ITU-T Y.4806 (securitysa.com/*itu1).

To find out more about Kaspersky Lab’s Industrial Cybersecurity expertise, visit https://ics-cert.kaspersky.com

References:

1 https://www.kaspersky.com/about/press-releases/2017_third-party-cybersecurity-failures-cost-businesses-the-most (short URL: securitysa.com/*kas2)

2 https://ics-cert.kaspersky.com/reports/2017/11/30/industrial-enterprise-and-iot-security-threats-forecast-for-2018/ (short URL: securitysa.com/*kas1)

3 https://www.itu.int/ITU-T/recommendations/rec.aspx?id=13391&lang=en (short URL: securitysa.com/*itu1)





Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

2024 Southern Africa OSPAs winners announced
Editor's Choice
The 2024 Southern Africa Outstanding Security Performance Awards (OSPAs) winners were revealed on Tuesday, June 11th, at the Securex South Africa Seminar Theatre hosted by SMART Security Solutions.

Read more...
AI and ransomware: cutting through the hype
AI & Data Analytics Information Security
It might be the great paradox of 2024: artificial intelligence (AI). Everyone is bored of hearing it, but we cannot stop talking about it. It is not going away, so we had better get used to it.

Read more...
Local manufacturing is still on the rise
Hissco Editor's Choice News & Events Security Services & Risk Management
HISSCO International, Africa's largest manufacturer of security X-ray products, has recently secured a multi-continental contract to supply over 55 baggage X-ray screening systems in 10 countries.

Read more...
NEC XON shares lessons learned from ransomware attacks
NEC XON Editor's Choice Information Security
NEC XON has handled many ransomware attacks. We've distilled key insights and listed them in this article to better equip companies and individuals for scenarios like this, which many will say are an inevitable reality in today’s environment.

Read more...
The future of digital identity in South Africa
Editor's Choice Access Control & Identity Management
When it comes to accessing essential services, such as national medical care, grants and the ability to vote in elections to shape national policy, a valid identity document is critical.

Read more...
Do you need a virtual CIO?
Editor's Choice News & Events Infrastructure
If you have a CIO, rest assured that your competitors have noticed and will come knocking on their door sooner or later. A Virtual CIO service is a compelling solution for businesses navigating tough economic conditions.

Read more...
AI-enabled tools reducing time to value and enhancing application security
Editor's Choice
Next-generation AI tools are adding new layers of intelligent testing, audit, security, and assurance to the application development lifecycle, reducing risk, and improving time to value while augmenting the overall security posture.

Read more...
Perspectives on personal care monitoring and smart surveillance
Leaderware Editor's Choice Surveillance Smart Home Automation IoT & Automation
Dr Craig Donald believes smart surveillance offers a range of options for monitoring loved ones, but making the right choice is not always as simple as selecting the latest technology.

Read more...
AI enables security solutions to define business strategies
Regal Distributors SA Editor's Choice
While allowing technologies to do exactly what they should do with even more efficiency and precision, AI is also empowering these same technologies to break through their traditional boundaries and create an ecosystem where one interface delivers outcomes across highly segmented verticals.

Read more...
Putting cyber into surveillance
Dallmeier Electronic Southern Africa Cathexis Technologies Technews Publishing Editor's Choice
Cybersecurity has become an essential part of the physical security industry. However, unlike other IoT technologies, of which security products are a part, surveillance technologies have more to protect.

Read more...