Engineers urged to think ahead when designing security into IoT systems

But there appears to be a double standard when it comes to applying the concepts of security in other areas of life. A report published last week by Proviti found that 'organisations lack high confidence in their ability to prevent a cyber attack or data breach' and added 'companies are not properly preparing for crisis scenarios'. The Internet of Things (IoT) is one area where concerns are emerging. The recently published Beecham Research report – Evolving Secure Requirements for the Internet of Things – warns that there is insufficient security within the emerging IoT standards to manage the long life cycles expected of many connected devices. But the IoT is not alone; there have long been worries about the security of industrial systems and the emergence of so called 'intimate' pictures of celebrities brought into focus concerns about data security in the cloud. The IoT appears to be splitting into two. On one side is the consumer electronics version, featuring fitness wristbands and the like. On the other is what used to be called machine to machine communications, or M2M. Here, machines that were previously standalone are being retrofitted with technology that allows them to 'talk' to other machines and devices. Both have vastly different timescales. Consumer products lifetimes are a matter of months; industrial systems are there for years. And it is these long timescales that concern the authors of the Beecham Research report. Prof Jon Howes, director of technology for the organisation, noted: "While we may have some visibility of potential attacks over a few months, we need to protect IoT devices in the field for 10 years or longer." But, while designers may have some idea of what needs to be dealt with in the short term, how do you attempt to deal with an unspecified threat? The topic was part of the discussion at a recent New Electronics roundtable (see pp 22 to 24). Wind River's Alex Wilson observed: "If you've never looked at how to secure software, there's a big learning curve. Engineers have to think about how to manage security and, to do that, have to think outside of their design rules. The problem is they can't think of every possible threat." Howes' report also points to the need for common security objectives and interoperability. Contributing to the NE Roundtable, Microsemi's Tim Morin noted: "There are security requirements in various markets, but they're segmented by market. For example, some industrial protocols have no security at all." The problem appears to be the scale of the IoT. Engineers may be able to conceptualise the threats to a well defined system, but not to something which sprawls across the world, potentially linking billions of devices. Morin said: "People assume a system is secure because it's embedded. That's not true and it's difficult to sell security because human nature doesn't value it until something bad happens." Wilson noted: "It's tough for customers to think about security; they expect it to be built in, free and easy. But it's a system level design and, for the whole IoT system to work, we need to start from a system architecture point of view, working out how the whole system fits together." "While industry has learnt many lessons from the traditional IT domain," said Robin Duke-Woolley, founder of Beecham Research, "the initial steps in security for IoT are sufficient only for the near term. Pressure must be applied to drive greater system robustness, ensure that interoperability is applied across the industry and to deliver standards that can be measured and certified."