printer friendly version

Welcome to the age of inter-trustability

The concept of the Internet of Things (IoT) is getting a lot of airtime right now. The IoT is the global network of the future where everything is connected to everything. It’s not a future technology or idea, however, if you have a smart home or even a portion of a smart home, you’re already in an IoT world.

If you have a smart watch or fitness band, you’re also in this world and you probably have no idea who is able to access your information. In security speak, if your security systems are talking to each other, building management systems and human beings via a centralised platform, you’re already ‘IoTing’.

The real IoT, however, goes far beyond the above. In a smart city, for example, street lights, traffic lights (or robots in South Africa), manhole covers and highway gantries (if used competently for the benefit of the users, like that will ever happen) are all examples of ‘things’ that are going to be on the network, sending and receiving information. More than simply sending or receiving information, the things will be acting on information: a simple example would be switching on the heater when the temperature falls below a set level.

My belief is that the key to the IoT, its very foundation if it is to be successful, is security. Yes, IoT will require IT security skills, but IT security doesn’t cut it and IT security people don’t have the ability to handle IoT – they would pick it up easily, but it will be a learning curve. Physical security doesn’t have it either, we can’t even secure an IP camera. Can you imagine asking your financial director for more budget to firewall the air conditioner, or encrypt the controller that waters the garden at certain times of the day?

One of the key areas in which IoT differs from traditional information security is in scale. You are looking at a best-case scenario of having 10 times the number of devices than we currently have online, with more reasonable estimates 20 to 50 times the number. Your free antivirus package is not going to do you much good. For one, the daily updates will crash the Internet.

Another key area is the diversity in the IoT. A plane normally used to fly you overseas is a thing, as is an electronic component in your toaster, and these things aren’t always polite enough to speak IP. Especially in the industrial world, installations are designed to last for many years, not be replaced every three years, meaning you will face a variety of protocols. And doesn’t the security industry have enough issues with IP alone?

What we will require is a security foundation built into the IoT, with standard protocols that deliver ‘inter-trustability’ between devices. To gain our trust, IoT systems will have to build a chain of trust across a variety of devices, using hardware and software security solutions that form part of the core of each device, each platform they are connected to, and every other device.

The bolt-on security we try to use in today’s information-rich environment can’t manage that task. Simply consider your Windows operating system and the apparent ease with which almost anyone with a bit of technical knowledge can get the better of you. When running a nuclear power plant, you don’t want that type of risk – or at least I think most people in the developed world have realised this; a certain family that wants to build nuclear power stations in South Africa probably doesn’t care as long as their cut makes it to Panama.

Andrew Seldon

Editor

Share this article:

Further reading: