OEMs are working round-the-clock to ensure that their solutions are as secure as possible, but experts point out that data breaches are inevitable regardless of the QA.
OEMs are working round-the-clock to ensure that their solutions are as secure as possible, but experts point out that data breaches are inevitable regardless of the QA. Speaking to asmag.com recently, François Baldassari, CEO of Memfault, a cloud-based observability platform, explained that companies and customers need to remain prepared for breaches, some of which could be serious.
“It's the law of large numbers,” Baldassari said. “Some issues only occur in specific scenarios that are hard to reproduce. They may manifest only once every 10,000 hours. That's very hard to catch in QA! But once you have 10,000 units out there in customers' hands, those issues start happening to someone every hour. Even NASA finds bugs in its software, and indeed they continue to push software updates to the Mars rover to patch issues as they find them. If NASA can't catch everything in QA, nobody can.”
Many of these bugs might be nuisances. But just one of them could be security-related, and that's enough to compromise entire systems. IoT device makers need to build with this reality in mind.
“Rather than depend on QA to find every issue, device makers should have an observability strategy so they can quickly identify and fix issues when they occur in the field,” Baldassari continued. “Instead of waiting for customers to complain, observability techniques allow businesses to automatically identify problems and get the diagnostic information they need to troubleshoot them remotely. A patch can quickly be pushed out before too many customers are impacted.”
Innovations and expectations lead to more vulnerabilities
As technology progresses, the chances of vulnerabilities are only going to increase. Estimates suggest that the number of connections to 5G networks is expected to reach 1.2 billion - twice as many as last year. And by 2026, 5G will be responsible for a third of all worldwide network connections. So the impact of 5G can't really be overstated. IoT developers are racing to build the killer app for 5G because it has opened up the industry to all kinds of ultra-low latency and M2M new edge cases.
“At the same time, modules like Nordic Semiconductor's nRF91 are powering all kinds of devices, bringing the edge to new locales,” Baldassari added. “This combination of connectivity and increased capabilities of hardware mean incredible acceleration of innovation in IoT. But the acceleration is matched by rising expectations on the end user side. For many years, decades really, hardware developers would build a device, see it ship, and then never interact with it again. Now, with price points increasing and IoT devices central to daily life, consumers have both higher expectations and many avenues available to publicize their frustration with your device (Reddit, Twitter, Facebook, etc.).”
So advances in connectivity, hardware design, and customer expectations are all converging to put pressure on the rapid development of next-gen devices that work well all the time. With that kind of pressure, device developers need to take a step back to ensure that basic security best practices are followed.
These devices are often being built by companies who have never before had to contend with the security challenges that come with cloud connectivity. When a device is connected to the internet, anyone anywhere in the world can attempt to poke holes into its software and compromise it. The combination of new threads and shorter development timelines are extremely challenging for security teams.
How to make IoT devices more secure
For robust security, devices must be updateable. Some critical elements to support that include firmware validation, ensuring secure delivery and unencrypted device in transit, signing firmware updates, establishing mechanisms for anti-rollback, and ensuring notifications of security changes due to updates.
“Developers should know their third-party code,” Baldassari said. “Say you've built a popular wearable device, but then it experiences an unavoidable vulnerability in a third-party library, which leaves its OS open to security breaches. Developers need to be aware of what third-party code they're using and the nitty-gritty details of how it works. They should evaluate the effects of third-party code through the development cycle. Again, devices should be updateable, with the capability to send OTA updates in the case of third-party issues.”
Developers should rotate secrets, or at least, avoid using a master secret that unlocks an entire fleet. A compromise of one device is terrible but much better than it leading to the compromise of all.
“Lastly, I'd say developers should consider new programming languages,” Baldassari added. “I like Rust, which is less likely to experience memory management bugs. And its type-checking and borrow-checking in the compiler means developers can detect potential security issues earlier in the development cycle.”
Metrics to watch out for
One of the best ways to monitor any process is through key metrics. Every device is unique, but here are a few metrics you should care about if security is a concern.
- How much data is being sent and received by your devices? A big increase in traffic could be a sign that they are under attack.
- What firmware version is each device running? Out-of-date firmware often contains vulnerabilities
- How often do devices reset? A device resetting could be a sign that its memory has gotten corrupted.
Conclusion
Ensuring the security of IoT devices is important but making them completely fool-proof is an impossible task. Cybersecurity, then, is a continuous process that requires robust measures from vendors as well as installers. As solutions advance and customer demands become more complex, careful consideration of relevant metrics, the right knowledge of programming languages, and other best practices are unavoidable.