How can IoT devices efficiently address security challenges considering diverse connected sensors and the need for robust cyber protection?
How can IoT devices efficiently address security challenges considering diverse connected sensors and the need for robust cyber protection?
Hi,
Short answer:
They can (and do). Otherwise governments, banks etc would not deploy them. But clearly they do.
Your best bet is to go read up the datasheets and user manuals of commercial IoT devices (pick any sensor or actuator, and find any reputable company - obviously not your typical cheap device for hobby use), and you'll see what features there could be useful for securing a deployed solution.
Also, there are guidelines (but they can never be considered "ratified" as a blind guarantee for deployments) - there's an org paper you could dig up (I forget it's name) whch has a sort of checklist - it's hundreds of items long. I'm sure there are many others.
OWASP usually release guidelines regarding the security of devices. You can refer the OWASP guide for IoT devices here.
At hardware level, you can enable encryption chips, remove access to flash and programming/debugging ports. On software side, you can enable OTA updates to ensure security patches are provided.
Furthermore you can use tamper detection MCU and send alert when someone try to access the device port illegally.
As a customer, you can connect your devices to a separate subnet.
Your concern is warranted. As a former IT Security professional, IoT security is a big concern. We have had to develop security audit processes to evaluate introductions of new equipment. They are not all the same.
Any new equipment needs to be under go a risk assessment to full understand the risks and required mitigation to reduce those risks. A solid risk management program would has a risk assessment as part of it security awareness program.
I see some IoT products address security with some options but it is not on by default. This causes me concern. It makes it easier to by pass security ti ignore security out of the box.