The IoT industry needs to do more to secure data, says Beecham Research

There are key areas where the industry supporting the internet of things (IoT) needs to provide better security, according to Beecham Research.

The key areas where external or internal attacks may originate and need to be addressed by the fast-growing IoT industry are shown on Beecham’s IoT security threat map.

“The only reason we have not seen serious IoT breaches already is because the IoT has not yet been deployed in large-scale consumer or enterprise applications that make them attractive to attackers,” said Beecham Research technology director Jon Howes.

“Traditional machine-to-machine [M2M] applications are typically very focused, using specific edge devices, a single network and custom platform, making it relatively easy for security professionals to secure to the acceptable level,” he said.

However, Howes said IoT cuts across different sectors and embraces multiple devices and networks – from satellite to cellular – along with a growing number of IoT platforms and big data systems, which presents threats on many different levels and fronts.

“Wherever there is a new interface between devices, networks, platforms and users, there is the potential for a new weak link,” he said.

Without concerted action now, Howes believes the proliferation of different devices, networks, platforms and applications to support the IoT multiplies the vulnerabilities and greatly increases the potential for malicious attacks.

Beecham’s IoT security threat map points to a number of specific internal and external threats inherent in the IoT ecosystem.

With sensors and devices, researchers believe the challenge is largely around identification, authentication and authorisation, to ensure a level of trust and avoid risks such as application hijacking.

There is also the threat of physical intrusion. “Using differential power analysis, it is well known that by listening to very small changes in power consumption when different calculations are performed in a chip, it is possible to work out an encryption key,” said Howes.     

The threat map shows that the main threat at the network level comes at the interface between different types of network.

“With a mix of fixed, satellite, cellular and low-power wireless networks, as well as personal and body area networks, the challenge is to secure the transfer of multiple streams of data between selected networks without exposure of key secrets or equipment control,” said Howes.

According to Beecham, with more than 100 organisations now offering IoT platform systems, combined with the growth of big data and cloud-based technologies across multiple market sectors, this is where most attacks will be focused.

“The benefits of IoT by definition rely on lots of data with high levels of searchability and analysis, but this also means the data must exist in plain text, which presents multiple threats – not least from insider attacks from sysadmins and authorised users,” said Howes.