A one-size-fits-all approach won’t secure the IoT

August 2019 News, Cyber Security

Securing the Internet of Things (IoT) is something which cannot be done with a one-size-fits-all approach, and every kind of connected object must be assessed individually, the co-chair of Trusted Computing Group’s (TCG) Embedded Systems Work Group said.

Speaking on the second day of Embedded Technologies Expo and Conference 2019, Steve Hanna highlighted how the growing trend for greater connectivity puts everyday objects at risk of exploitation and makes mission critical systems in businesses and governments more vulnerable to attacks.

And while securing the IoT is often referred to as a singular movement, Hanna emphasised that every device had to be handled according to its individual needs, warning that there would be no single method that could be universally applied to safeguard devices.

“When you consider other security systems, for example a lock, what you would use for a front door is very different to what would be used for a bank or a government building because the scale of an attack would be much greater and more complex in the case of the latter,” he said. “The same is true for computers and embedded systems; when we think about security, we have to think about different levels that correspond to the level of risk.”

Hanna illustrated his point by comparing a baby monitor with a chemical plant – both of which are likely to become connected as standard in the near-future. For the latter, he said, the impact of an attack could be as serious as an explosion which would ultimately endanger human life.

“While it is important to secure things like baby monitors, for example, to avoid the devices being used to eavesdrop on conversations, there is a price point that needs to be met as well – no one is going to spend thousands of dollars on a baby monitor and for the manufacturers, that means the security solution needs to be less expensive,” continued Hanna. “In the case of a chemical plant, the risk is much greater, the level of attack is likely to be more sophisticated and a serious amount of money could have been invested in carrying it out. As a result, the security measures need to be much more stringent.”

He went on to explain that the customised security approach required by the Internet of Things can be easily achieved using technologies that are available today. TCG’s security standards are all based on the concept of Trusted Computing where a Root of Trust forms the foundation of the device and meets the specific requirements of the device or deployment.

“TCG’s wide variety of security options provide the building blocks to create secure systems,” said Hanna. “In the case of a chemical plant, industrial-grade discrete TPM hardware can be built in not just into the plant’s firewall but also into the control system. This will enable these systems to be monitored in real-time and for even sophisticated attacks to be identified and prevented. For devices which are less high-risk, TPM firmware can be created which has the same set of commands but is less rigorously secured and therefore more cost-effective. Finally, for very tiny devices that can’t afford TPM firmware, DICE offers a good alternative.”

The organization offers a number of resources for developers and designers at develop.trustedcomputinggroup.org





Share this article:
Share via emailShare via LinkedInPrint this page



Further reading:

Online fleet management system
Issue 1 2020 , News
Fleet Domain’s online Fleet Management Information System is reducing operating costs and improving safety for South African logistics firms.

Read more...
Digital insurance bundle for assets and devices
Issue 1 2020 , News
My CyberCare is a specialist provider of personal, and SMME online cyber insurance, cyber detection and cyber monitoring solutions for both local and global consumption.

Read more...
IDEMIA to supply Morocco’s national electronic ID cards
Issue 1 2020, IDEMIA , News
IDEMIA will supply Morocco with national electronic ID cards and introduce a secured digital identity online services platform.

Read more...
Rockwell Automation to acquire Avnet
Issue 1 2020, Rockwell Automation , News
Rockwell Automation announced it has signed an agreement to acquire privately held Avnet Data Security, an Israeli-based cybersecurity provider with over 20 years’ experience providing cybersecurity services.

Read more...
Do we really want simplicity?
Issue 1 2020, Technews Publishing , News
Everything today has to be simple, easy and fast. Even access to your bank account has to fit these adjectives and banks spend significant time and money trying to ensure their web and mobile interfaces ...

Read more...
Longse Distribution to become LD Africa
Issue 1 2020, LD Africa , News
Brendon Whelan, sales manager for Longse Distribution, announced that the company officially changed its name to LD Africa as of 20 January 2020.

Read more...
Three expos in one
Issue 1 2020 , News
Looking ahead to 2020 Vision: combined Securex South Africa, A-OSH EXPO and Facilities Management Expo 2020 promises to be even bigger and better.

Read more...
Security events you can’t miss in 2020
Issue 1 2020, Technews Publishing , News
Hi-Tech Security Solutions will host a number of focused events in 2020 to highlight the latest in security technology and the operational benefits they deliver.

Read more...
David Shapiro to chair ESDA
Issue 1 2020, ESDA (Electronic Security Distributors Association , News
The Electronic Security Distributors’ Association (ESDA), established in 1989, has elected David Shapiro as its chairperson for 2020.

Read more...
Dimension Data debuts fifth business
Issue 1 2020 , News
Dimension Data has launched its fifth business in the MEA region, Dimension Data Security, aimed at helping organisations in the region address the challenges of today’s rapidly evolving threat landscape.

Read more...