The Internet of Things (IoT) is becoming increasingly essential in terms of assisting with product development and enhancements. However, it can also deliver significant benefits within the manufacturing industry - streamlining processes and fast-tracking production.
In this article, we look at some key security principles - important considerations for the IoT manufacturing industry.
1. Why Should You Invest in Security for Your Product or Ecosystem?
Manufacturing is an area where IoT plays a particularly important role. IoT is about progress. IoT looks ahead, driving new approaches as to how the solutions are architected and built. It also helps to drive both operational and strategic decision-making - as a network of physical devices embedded with sensors that collect and exchange data, IoT helps manufacturers to optimize products and processes, operations, and performance, reduce downtime and enable predictive maintenance.
As a result, IoT brings new business streams and models that allow manufacturers to remain competitive.
Therefore, devices cannot simply be built and then enter the market without appropriate security. Each device represents an entry point for potential hackers to attack. ‘Security-by design’ is paramount, it begins at the point of manufacture, which then allows organizations to provide critical security updates remotely, automatically, and from a position of control.
Some of the biggest cybersecurity challenges for the manufacturing sector are;
-
Social engineering
-
System intrusion
-
Basic web application attacks
The reasons behind these attacks are largely related to money, however, industrial espionage is also a significant factor.
Any organization in the manufacturing industry, including supply networks that serve the sector, is vulnerable to cyber-attacks.
2. Data Security and Chains of Trust
Smarter does not mean secure. IoT necessitates a continuous chain of trust that provides appropriate levels of security without limiting the capacity to communicate data and information. IoT and the devices and applications it powers result in a colossal and continuous amount of constantly changing data that is generated as a result.
Data flows from machines and the factory floor, to devices, to the cloud, and subsequent information exchanges occur between all stakeholders in a supply chain. Each device requires an identity and the capacity to transport data autonomously across a network. Allowing devices to connect to the internet exposes them to a number of major risks if not adequately secured.
Regardless of the fact that manufacturing supply chains provide attackers with numerous ways to compromise a device, security is frequently added as a feature rather than being considered a vital component built at the beginning of a product's lifecycle.
IoT security is a necessity to protect devices and subsequent data from becoming compromised.
3. How Organizations Can Successfully Build Secure and Safe Connected Products
‘Security by design’ thinking affords organizations a much greater return on their investments, as changes are much easier and cost-effective to make early in the product lifecycle, especially as appropriate security and privacy features are rarely ever bolted on.
The “how” of this approach is much more variable and is generally based on the organization and operating environment. First you must think like a bad actor and identify the core targets in the system. From there, assess the probability and magnitude of a breach in that asset area and then finally you can move to an evaluation of technology to mitigate the risk.
One of the core takeaways here is also the dimension that security is never going to be a single person's responsibility since no one person will truly understand the full scope of the environment. It's a team game and must be played as such to succeed.
The next tactical point we'd like to address for achieving security in your products is as we call here to "stand on the shoulders of giants". By this we mean, use the tools and information that already exists and you already know work.
-
InfoSec principles and best practices have matured over the years. We should not ignore the internet success we've had to date and recognize that information security principles and best practices have matured.
-
It’s not just about the “things”. While the hype is around the “things” in the solution, they're only one component of the ecosystem and we still will have users, services and organizations that will be core and essential actors.
-
Solutions already exist which have been tried and tested. While there are undeniably new considerations that devices bring to the table, there are existing solutions and standards that succeed and can be applied into device environments that enable distributed and trusted identity assurance. And these solutions have the benefit of being battle tested and improved in the existing internet.
As a recap, some of the core information security concepts that we'll talk about for building into your IoT product include authentication, in the sense of authenticating devices to cloud services, between users and devices and from thing to thing. Next is encryption which affords privacy and secrecy of communications between two entities. It is also paramount to address the integrity of data and communications so that messages can be trusted not altered in transit.
4. How Does an IoT Product Architect or Developer Address These Concerns?
One of the proven technology solutions we have today for device identity is Public Key Infrastructure (PKI). As well as its application in a variety of protocols and standards like TLS, PKI is really an InfoSec Swiss army knife and allows you to enable a whole range of information security principles, including those three we just mentioned.
PKI is perfect for enhancing the assurance around the integrity and uniqueness of device identity. This is because of security focused crypto-processors, like TPMs, which provide strong hardware based protection of the device's private keys from compromise and unauthorized export. But also PKI can reduce the threat of overproduction or counterfeiting with mechanisms to enable auditable history and tracking.
There are technologies and solutions you can deploy that allow you to limit the amount of trust you put in the manufacturing environment, while still building trustable products and reducing risks of overproduction. The approach we cover combines TPM hardware with PKI enrolment techniques during the device and platform build process.
Leveraging these technologies can help you arrive at a built product situation where you have assurance about the integrity of the hardware protection, assurance that credentials you issue to the device are protected by the hardware and that the enrollment process has verified these components and assumptions prior to the issuance of an identity from a trusted hierarchy.
5. Generalized Architecture Considerations
If we can imagine devices proceeding through a manufacturing line, at some point, usually in the final stage of the build process where the devices enter a configuration and initialization stage. At this stage, this is where we prescribe for the device identity provisioning to occur. A provisioning system on the manufacturing line interfaces with the device, potentially over probes or network connections and will facilitate the device to create keys, the extraction of a device ID number and proxy an identity issuance request to GlobalSign's IoT Edge Enroll.
Iot Edge Enroll will issue a credential and install it back on the device. After this stage, you have a provisioned device with an identity credential from a trusted issuance process, protected from compromise by secure hardware. The credential can be used in the operational phase of the device lifecycle for authentication and other security needs.
These technologies have a very vertical agnostic range of applications and use cases. However, there are some which are particularly suited toward the application of PKI and IoT for strong device identity.
These include:
-
Network or server appliances for feature licensing.
-
Device identity for home appliances to authenticate and encrypt communications providing privacy.
-
Connected diagnostic equipment running embedded servers which need to provide a trusted SSL connection for administrators.
-
Connected car use case leveraging strong device identity for secure communications, as well as for trusted and secure firmware updates.
6. Benefits of Leveraging the Cloud for Your Identity
Many of these concepts are familiar to consumers of SaaS solutions, and in some instances relatively newer concepts to operational technology providers who may not have as broad or deep experience consuming cloud services in their solutions.
First by looking toward the cloud, it really enables simplified infrastructure requirements and costs for on-premise hardware setup and configuration, as well as the ability to bring additional manufacturing sites online with marginal incremental cost. Echoing this is the elasticity that SaaS models provide, allowing OEMs (Original Equipment Manufacturers) to better tie expenses and revenues in operational expenditures, as well as with the ability to scale the system dynamically meeting the needs of the business growth. And finally there's the added functionality that a platform can provide for auditability, access control and reporting that often are more difficult to maintain across a multi-site on-premise deployment. Combining lightweight cloud service APIs with modern network fail-over hardware solutions provides mitigation of risks of manufacturing downtime due to network connectivity.
7. Ongoing Considerations for IoT Security
As with any assessment of the IoT, the number of devices, users and systems operating in each ecosystem is magnifying and understanding the impact is imperative. With the number of deployed IoT devices growing at an exponential rate, the issue of security needs to be addressed at manufacturing level. In many previous cases, product providers either addressed security issues ad hoc as they encountered them, used a third-party security company, or simply relied on the end-customer’s internal security measures.
As a result, trust models are evolving. There is a time dimension of solutions where you must consider the products and devices from build, provisioning, operation, through sun setting must be considered.
What is the answer to enabling robust identity and security in your IoT solution?
-
Consider security throughout the lifecycle of the product, starting as early as possible.
-
When working with 3rd party service and solution providers, ensure that they are capable of maintaining the integrity of the services.
-
Look and leverage existing proven solutions where possible, especially as far as security is concerned, rather than novel or proprietary standards and approaches.
-
Recognize the diversity of these ecosystems is massive and each will have its own key needs, therefore leveraging solutions that are flexible are also key.
GlobalSign has a wealth of experience on understanding IoT security considerations and have provide a flexible, scalable and purpose built PKI platform which addresses the needs of the IoT. First is the scalability to accommodate a substantial number of identities and endpoints in each customer ecosystem, along with the dynamic and fast operational requirements. In addition, we enable support for the complexities and nuances of the variety of device environments, as well as affording variations in usage and lifecycle models.
GlobalSign is also able to provide the range of solutions mentioned above in a customizable and business focused deployment models to enable success in the solution.
