- Email: [email protected]
How to disinfect and secure the Internet of Things
FEATURE
How to disinfect and secure the Internet of Things
Dr Hongwen Zhang
Dr Hongwen Zhang, Wedge Networks, OpenCloud Connect Security Working Group The Internet of Things (IoT) is here. The CES 2015 convention in Las Vegas highlighted smart robots, smart televisions, smart health monitors and smart door locks. Whether by cable, Bluetooth or wifi, nearly everything is interconnected, perhaps to a smartphone, perhaps to a cloud service. From a consumer or business customer perspective, the IoT is convenient and appealing. It’s also not inherently safe – not as it exists today. And that is scary. The fundamental problem is about the uncertainty and risks of scaling complexity. Early experiments on the interactions between very simple elements – analogous to termites obeying a few basic rules – showed how surprisingly intelligent behaviour begins to emerge as the number of elements increases. Putting an emphasis on ‘surprisingly’ – rather than ‘intelligent’ – means that we are not predicting some malevolent intelligence to emerge from the growing network of smart fridges, but rather that we may find ourselves facing unexpected consequences by adding billions of relatively simple devices to our already complex Internet.
Criminal certainty Even before we get on to those surprising consequences, however, there is the all-too-predictable certainty that criminal minds are already planning ways to exploit the IoT and create new forms of cyber-attack. The 2013 holiday season saw a smart, Internet-connected fridge sending out spam as part of a junk mail campaign that had hijacked more than 100,000 connected devices. But why should this be any more worrying than the existing threat of botnet-launched spam campaigns? A couple of years ago we heard about a breach affecting Telvent control sys18
Network Security
tems designed to be used with ‘smart grid’ power networks.1 The attackers installed malicious software on the network and also accessed project files for its OASyS DNA system – designed to integrate an electricity company’s IT network with the grid control systems so that legacy systems and applications can communicate with the new smart grid technologies. There was nothing inherently wrong with OASyS DNA: it was a highly sophisticated system in use since the late 90s. But it was never designed to connect to the Internet.
“While computers and IT systems have for many years been fighting off attacks, none of these simple devices joining the IoT have inherent defences and they remain wide open to cyberattack” Project files provide a clever way to spread malware because vendors have full rights to modify customers’ systems through the project files. The files hold a lot of customer-specific system data, so an attacker could also use the project files to study a customer’s operations for vulnerabilities in order to design further attacks on critical infrastructure. The Stuxnet attack a few years ago was
a sophisticated example of how a project file was studied to discover how the centrifuges were controlled and then the file was modified so that they were now behaving in a different, harmful manner.2
The added challenge The first big difference lies in the sheer number of devices that could be, and eventually will be, connected. The world’s population is around seven billion people, and already there are many more devices than that connected to the Internet – although estimates seem to vary considerably. According to IDC’s estimation the number of connectible devices approaches 200 billion while the number of sensors (eg, the accelerometer in a smartphone) that track, monitor, or feed data to those things is already more than 50 billion, with scientists talking about trillion-sensor networks within 10 years. Of those 200 billion things, around 20 billion are already connected, and the number is predicted to reach 30 billion by 2020. So the first problem is not so much about the impact of any particular thing as about the possibility of unpredicted responses or vulnerabilities emerging out of sheer complexity. The second big difference – and the one posing more immediate risk – is the fact that most of the devices now being connected are new to the IT arena. Whereas each new computer added to the Internet comes with some
September 2016
FEATURE degree of malware protection built into its operating system, things like smoke detectors, security alarms and utility meters come from a different culture: traditionally they were either autonomous units or else, if they were connected, it was on a closed, dedicated network. Fire alarms were installed by one company, control and instrumentation networks came from a different vendor, the electricity meter was installed by the power supplier and none of these networks overlapped. While computers and IT systems have for many years been fighting off attacks, none of these simple devices joining the IoT have inherent defences and they remain wide open to cyberattack. The risk is not only that the particular function could be compromised – say fire alarms disabled before an arson attack – but the IoT could provide a weak link or point of entry to an otherwise strong security chain. The infected fridge could continue sending out spam mail without drawing attention to itself because its normal operation would not be affected. Despite this relative vulnerability, the most publicised attacks so far on IoT control systems have penetrated the system via IT: attackers using simple phishing-style means to breach the perimeter and then target privileged access accounts. As well as gaining access to databases and high-value systems, this approach lets them use the same privileges to reach control systems and whole new opportunities for sabotage and cyberwar.
Physical role That brings us to the third difference. A lesser difference, but potentially the most dangerous of all, is that many of the
September 2016
things joining the IoT have more of a direct physical role than the computers, game consoles and databanks currently populating the Internet. When the Stuxnet worm closed down some thousand centrifuges at Iran’s Natanz nuclear facility in 2010, IT departments all over the world woke up to the fact that a cyber-attack could cause actual physical damage. This was not simply an attack generating a signal to shut down the centrifuge, but one designed to force changes in the centrifuges’ rotor speeds that could lead to destructive vibrations and internal damage – causing far more serious delays to the nuclear programme than any simple shut down.
“Security as a Service, however, would mean providing traffic that is already decontaminated – so even the most humble connected switch on the IoT could benefit from the most sophisticated security” So the IoT adds enormous extra scale to the already crowded Internet and it also adds extreme diversity. On the one hand, we are networking highly critical systems: industrial and utility grid control systems that could cause widespread damage or economic harm if breached; critical healthcare and remote medical devices containing sensitive personal data or responsible for life support; navigation and control systems for connected cars, air traffic control and so on. At the other extreme we have small low-cost monitoring devices, meters, wearable devices, simple switches for remote control of household lighting etc.
With such a range of devices it would be unrealistic to insist that every ‘thing’ joining the IoT should have its own built-in defences. The latest malware signature has some 60 million records and to be sure of identifying it by current pattern matching techniques would require 3-4GB of RAM. A more sophisticated defence is provided by behavioural analysis – studying how the code behaves when quarantined in a sandbox environment. Such analysis of behaviour for signs of malignancy is what computer scientists call an ‘NP complete’ problem – or what the layperson would call ‘extremely difficult’. Reducing operational costs is one major driver for IoT connection – so adding sophisticated cyber-security to a $10 switch would be hopelessly uneconomical. There is no way that we can realistically defend the IoT on the militia model, where every device is armed against attack – so how is it possible to provide adequate protection across such a vast and diverse cloud?
Disinfecting the IoT Security is at the centre of the five key challenges being addressed by OpenCloud Connect (OCC), spelled out under the name VASPA: Virtualisation, Automation, Security, Programmability and Analytics.3 Originally known as the Cloud Ethernet Forum (CEF), established in 2013, OCC is an industry organisation embracing every type of cloud stakeholder – including major users as well as cloud service providers, network service providers, equipment manufacturers, systems integrators and software developers. Continued on page 20...
Network Security
19
NEWS/CALENDAR ...Continued from page 19 The most promising approach so far to securing the cloud, and so the IoT, is to adopt the Software Defined Network (SDN) principle and consider the traffic flow as a virtual network, rather than a string of hardware elements and so define a distinct ‘security layer’ to orchestrate Security as a Service. Today’s Internet has been compared to a water supply without any guarantee of purity, leaving responsibility for filtering and sterilising the water to the customers. Internet users are expected to install their own anti-virus software, firewalls and other forms of security. Security as a Service, however, would mean providing traffic that is already decontaminated – so even the most humble connected switch on the IoT could benefit from the most sophisticated security that would be provided by the network itself.
“When it comes to the Internet of Things, consumers and business customers can’t manage security on their own. The IoT can’t be secured at the end node” On the network scale, deep packet inspection, pattern recognition coupled with a constantly updated cloud databank of emerging attack signatures, behavioural analysis and other costly high-level malware defences become an economic proposition. For individual users and most client companies, such levels of security would be way beyond budget. Provide Security as a Service and let your customers order whatever level or type of security they need for their business, knowing it will always be up to date and maintained in peak condition. Security as a Service provides a very attractive revenue stream and it must be the ultimate added-value proposition for building customer loyalty and reducing churn. When it comes to the Internet of Things, consumers and business customers can’t manage security on their own. 20
Network Security
The IoT can’t be secured at the end node. If the Internet of Things is going to be safe – as well as compelling – then securing the networks and the back end is not a luxury, it is a necessity.
About the author Dr Hongwen Zhang is president and CEO of Wedge Networks, which he co-founded in 2005, and co-chair of OpenCloud Connect’s Security Working Group. Zhang was instrumental in developing the high-performance architecture that provides the basis behind Wedge’s security appliance, the BeSecure Web Gateway. Wedge Networks has been chosen by OpenCloud Connect (OCC) to help lead its Cloud Security initiative and Zhang was appointed co-chair of OCC’s Security Working Group in November 2013. Zhang holds a PhD in computer science from the University of Calgary; an MSc in computer engineering from the Institute of Computer Technology – Chinese Academy of Sciences (Beijing, PRC); and a Bachelor of Science in computer science from Fudan University (Shanghai, PRC). With more than two decades of high-tech leadership experience, Zhang is a co-inventor and holder of several patents in the area of computing and networking. Prior to establishing Wedge Networks, he was a co-founder of the 24C Group, which pioneered the first digital receipts infrastructure for secure electronic commerce. Zhang was previously principal of Servidium, now ThoughtWorks Canada.
References 1. Fahmida, Rashid. ‘Telvent hit by sophisticated cyber-attack, SCADA admin tool compromised’. Security Week, 26 Sep 2012. Accessed Aug 2016. www.securityweek.com/telvent-hit-sophisticated-cyber-attackscada-admin-tool-compromised. ä :ETTER ä+IMä@!NäUNPRECEDENTEDä look at Stuxnet, the world’s first digital weapon’. Wired, 3 Nov 2014. Accessed Aug 2016. www.wired. com/2014/11/countdown-to-zeroday-stuxnet/. 3. OpenCloud Connect. Home page. Accessed Aug 2016. www.opencloudconnect.org.
EVENTS CALENDAR 3–5 October 2016 Industrial Control Cyber Security USA Sacramento, CA, USA www.industrialcontrolcybersecusa.com
11–14 October 2016 SaintCon Provo, Utah, US hwww.saintcon.org
18 October 2016 Cyber Security EU Leeds, UK www.cyber-securityeurope.com
18–20 October 2016 Hack.lu Luxembourg https://2016.hack.lu/
19 October 2016
(ISC)2 Security Congress EMEA Dublin, Ireland http://bit.ly/2ctEClF
22–23 October 2016 Ruxcon Melbourne, Australia www.ruxcon.org.au
26–28 October 2016 Ekoparty Security Conference Buenos Aires, Argentina www.ekoparty.org
27–28 October 2016 BruCON Ghent, Belgium http://brucon.org
27 October 2016 Cyber-security EXPO London, UK www.cyber-securityexpo.co.uk
1–5 November 2016 Hackfest Infinity Quebec, Canada www.hackfest.ca/en
September 2016
How to disinfect and secure the Internet of Things
Dr Hongwen Zhang
Dr Hongwen Zhang, Wedge Networks, OpenCloud Connect Security Working Group The Internet of Things (IoT) is here. The CES 2015 convention in Las Vegas highlighted smart robots, smart televisions, smart health monitors and smart door locks. Whether by cable, Bluetooth or wifi, nearly everything is interconnected, perhaps to a smartphone, perhaps to a cloud service. From a consumer or business customer perspective, the IoT is convenient and appealing. It’s also not inherently safe – not as it exists today. And that is scary. The fundamental problem is about the uncertainty and risks of scaling complexity. Early experiments on the interactions between very simple elements – analogous to termites obeying a few basic rules – showed how surprisingly intelligent behaviour begins to emerge as the number of elements increases. Putting an emphasis on ‘surprisingly’ – rather than ‘intelligent’ – means that we are not predicting some malevolent intelligence to emerge from the growing network of smart fridges, but rather that we may find ourselves facing unexpected consequences by adding billions of relatively simple devices to our already complex Internet.
Criminal certainty Even before we get on to those surprising consequences, however, there is the all-too-predictable certainty that criminal minds are already planning ways to exploit the IoT and create new forms of cyber-attack. The 2013 holiday season saw a smart, Internet-connected fridge sending out spam as part of a junk mail campaign that had hijacked more than 100,000 connected devices. But why should this be any more worrying than the existing threat of botnet-launched spam campaigns? A couple of years ago we heard about a breach affecting Telvent control sys18
Network Security
tems designed to be used with ‘smart grid’ power networks.1 The attackers installed malicious software on the network and also accessed project files for its OASyS DNA system – designed to integrate an electricity company’s IT network with the grid control systems so that legacy systems and applications can communicate with the new smart grid technologies. There was nothing inherently wrong with OASyS DNA: it was a highly sophisticated system in use since the late 90s. But it was never designed to connect to the Internet.
“While computers and IT systems have for many years been fighting off attacks, none of these simple devices joining the IoT have inherent defences and they remain wide open to cyberattack” Project files provide a clever way to spread malware because vendors have full rights to modify customers’ systems through the project files. The files hold a lot of customer-specific system data, so an attacker could also use the project files to study a customer’s operations for vulnerabilities in order to design further attacks on critical infrastructure. The Stuxnet attack a few years ago was
a sophisticated example of how a project file was studied to discover how the centrifuges were controlled and then the file was modified so that they were now behaving in a different, harmful manner.2
The added challenge The first big difference lies in the sheer number of devices that could be, and eventually will be, connected. The world’s population is around seven billion people, and already there are many more devices than that connected to the Internet – although estimates seem to vary considerably. According to IDC’s estimation the number of connectible devices approaches 200 billion while the number of sensors (eg, the accelerometer in a smartphone) that track, monitor, or feed data to those things is already more than 50 billion, with scientists talking about trillion-sensor networks within 10 years. Of those 200 billion things, around 20 billion are already connected, and the number is predicted to reach 30 billion by 2020. So the first problem is not so much about the impact of any particular thing as about the possibility of unpredicted responses or vulnerabilities emerging out of sheer complexity. The second big difference – and the one posing more immediate risk – is the fact that most of the devices now being connected are new to the IT arena. Whereas each new computer added to the Internet comes with some
September 2016
FEATURE degree of malware protection built into its operating system, things like smoke detectors, security alarms and utility meters come from a different culture: traditionally they were either autonomous units or else, if they were connected, it was on a closed, dedicated network. Fire alarms were installed by one company, control and instrumentation networks came from a different vendor, the electricity meter was installed by the power supplier and none of these networks overlapped. While computers and IT systems have for many years been fighting off attacks, none of these simple devices joining the IoT have inherent defences and they remain wide open to cyberattack. The risk is not only that the particular function could be compromised – say fire alarms disabled before an arson attack – but the IoT could provide a weak link or point of entry to an otherwise strong security chain. The infected fridge could continue sending out spam mail without drawing attention to itself because its normal operation would not be affected. Despite this relative vulnerability, the most publicised attacks so far on IoT control systems have penetrated the system via IT: attackers using simple phishing-style means to breach the perimeter and then target privileged access accounts. As well as gaining access to databases and high-value systems, this approach lets them use the same privileges to reach control systems and whole new opportunities for sabotage and cyberwar.
Physical role That brings us to the third difference. A lesser difference, but potentially the most dangerous of all, is that many of the
September 2016
things joining the IoT have more of a direct physical role than the computers, game consoles and databanks currently populating the Internet. When the Stuxnet worm closed down some thousand centrifuges at Iran’s Natanz nuclear facility in 2010, IT departments all over the world woke up to the fact that a cyber-attack could cause actual physical damage. This was not simply an attack generating a signal to shut down the centrifuge, but one designed to force changes in the centrifuges’ rotor speeds that could lead to destructive vibrations and internal damage – causing far more serious delays to the nuclear programme than any simple shut down.
“Security as a Service, however, would mean providing traffic that is already decontaminated – so even the most humble connected switch on the IoT could benefit from the most sophisticated security” So the IoT adds enormous extra scale to the already crowded Internet and it also adds extreme diversity. On the one hand, we are networking highly critical systems: industrial and utility grid control systems that could cause widespread damage or economic harm if breached; critical healthcare and remote medical devices containing sensitive personal data or responsible for life support; navigation and control systems for connected cars, air traffic control and so on. At the other extreme we have small low-cost monitoring devices, meters, wearable devices, simple switches for remote control of household lighting etc.
With such a range of devices it would be unrealistic to insist that every ‘thing’ joining the IoT should have its own built-in defences. The latest malware signature has some 60 million records and to be sure of identifying it by current pattern matching techniques would require 3-4GB of RAM. A more sophisticated defence is provided by behavioural analysis – studying how the code behaves when quarantined in a sandbox environment. Such analysis of behaviour for signs of malignancy is what computer scientists call an ‘NP complete’ problem – or what the layperson would call ‘extremely difficult’. Reducing operational costs is one major driver for IoT connection – so adding sophisticated cyber-security to a $10 switch would be hopelessly uneconomical. There is no way that we can realistically defend the IoT on the militia model, where every device is armed against attack – so how is it possible to provide adequate protection across such a vast and diverse cloud?
Disinfecting the IoT Security is at the centre of the five key challenges being addressed by OpenCloud Connect (OCC), spelled out under the name VASPA: Virtualisation, Automation, Security, Programmability and Analytics.3 Originally known as the Cloud Ethernet Forum (CEF), established in 2013, OCC is an industry organisation embracing every type of cloud stakeholder – including major users as well as cloud service providers, network service providers, equipment manufacturers, systems integrators and software developers. Continued on page 20...
Network Security
19
NEWS/CALENDAR ...Continued from page 19 The most promising approach so far to securing the cloud, and so the IoT, is to adopt the Software Defined Network (SDN) principle and consider the traffic flow as a virtual network, rather than a string of hardware elements and so define a distinct ‘security layer’ to orchestrate Security as a Service. Today’s Internet has been compared to a water supply without any guarantee of purity, leaving responsibility for filtering and sterilising the water to the customers. Internet users are expected to install their own anti-virus software, firewalls and other forms of security. Security as a Service, however, would mean providing traffic that is already decontaminated – so even the most humble connected switch on the IoT could benefit from the most sophisticated security that would be provided by the network itself.
“When it comes to the Internet of Things, consumers and business customers can’t manage security on their own. The IoT can’t be secured at the end node” On the network scale, deep packet inspection, pattern recognition coupled with a constantly updated cloud databank of emerging attack signatures, behavioural analysis and other costly high-level malware defences become an economic proposition. For individual users and most client companies, such levels of security would be way beyond budget. Provide Security as a Service and let your customers order whatever level or type of security they need for their business, knowing it will always be up to date and maintained in peak condition. Security as a Service provides a very attractive revenue stream and it must be the ultimate added-value proposition for building customer loyalty and reducing churn. When it comes to the Internet of Things, consumers and business customers can’t manage security on their own. 20
Network Security
The IoT can’t be secured at the end node. If the Internet of Things is going to be safe – as well as compelling – then securing the networks and the back end is not a luxury, it is a necessity.
About the author Dr Hongwen Zhang is president and CEO of Wedge Networks, which he co-founded in 2005, and co-chair of OpenCloud Connect’s Security Working Group. Zhang was instrumental in developing the high-performance architecture that provides the basis behind Wedge’s security appliance, the BeSecure Web Gateway. Wedge Networks has been chosen by OpenCloud Connect (OCC) to help lead its Cloud Security initiative and Zhang was appointed co-chair of OCC’s Security Working Group in November 2013. Zhang holds a PhD in computer science from the University of Calgary; an MSc in computer engineering from the Institute of Computer Technology – Chinese Academy of Sciences (Beijing, PRC); and a Bachelor of Science in computer science from Fudan University (Shanghai, PRC). With more than two decades of high-tech leadership experience, Zhang is a co-inventor and holder of several patents in the area of computing and networking. Prior to establishing Wedge Networks, he was a co-founder of the 24C Group, which pioneered the first digital receipts infrastructure for secure electronic commerce. Zhang was previously principal of Servidium, now ThoughtWorks Canada.
References 1. Fahmida, Rashid. ‘Telvent hit by sophisticated cyber-attack, SCADA admin tool compromised’. Security Week, 26 Sep 2012. Accessed Aug 2016. www.securityweek.com/telvent-hit-sophisticated-cyber-attackscada-admin-tool-compromised. ä :ETTER ä+IMä@!NäUNPRECEDENTEDä look at Stuxnet, the world’s first digital weapon’. Wired, 3 Nov 2014. Accessed Aug 2016. www.wired. com/2014/11/countdown-to-zeroday-stuxnet/. 3. OpenCloud Connect. Home page. Accessed Aug 2016. www.opencloudconnect.org.
EVENTS CALENDAR 3–5 October 2016 Industrial Control Cyber Security USA Sacramento, CA, USA www.industrialcontrolcybersecusa.com
11–14 October 2016 SaintCon Provo, Utah, US hwww.saintcon.org
18 October 2016 Cyber Security EU Leeds, UK www.cyber-securityeurope.com
18–20 October 2016 Hack.lu Luxembourg https://2016.hack.lu/
19 October 2016
(ISC)2 Security Congress EMEA Dublin, Ireland http://bit.ly/2ctEClF
22–23 October 2016 Ruxcon Melbourne, Australia www.ruxcon.org.au
26–28 October 2016 Ekoparty Security Conference Buenos Aires, Argentina www.ekoparty.org
27–28 October 2016 BruCON Ghent, Belgium http://brucon.org
27 October 2016 Cyber-security EXPO London, UK www.cyber-securityexpo.co.uk
1–5 November 2016 Hackfest Infinity Quebec, Canada www.hackfest.ca/en
September 2016