Guest post from LiveWorx Sponsor Certified Security Solutions, Anthony Ricci, Senior Software Engineer
Do you remember the movie E.T, where E.T. is essentially stranded on Earth until he assembles a makeshift communication device which sends a message to his spaceship to return to earth to retrieve him?
How fortunate was it that his alien counterparts assumed the message was from him? I mean, who else on earth could have sent a message, right? What if the message was sent from evil human scientists “pretending” to be E.T.? Instead of a happy ending where E.T. goes home, the humans could have trapped and captured the aliens when they land. Now the evil human scientists have hostage aliens along with a pretty sweet spaceship!
In the IoT world, a more realistic scenario would be a “connected” thermostat which sends data to a server. As we consider the security around the communication between the devices, we should ask ourselves:
- Should the server trust the thermostat just because it can communicate with it?
- Should the thermostat trust the server that it is communicating with?
- How can we be sure that the thermostat and the server are what they claim to be?
As you develop your IoT security strategy, these questions must be taken into consideration.
Why is security so important for a simple device like a thermostat? The answer is that once it is “connected” it is no longer just a thermostat. It becomes an endpoint to a network with knowledge of specific devices within it. This information can be exploited and become an effective attack vector. There are countless examples of network breaches that have occurred via unsecured endpoints. Recently, hackers attempted to steal data from a North American casino through a “fish tank” that was connected to the internet.
Someone used the fish tank to get into the network, and once they were in the fish tank, they scanned and found other vulnerabilities and moved laterally to other places in the network.Justin Fier Director for cyber intelligence and analysis at Darktrace
In an environment where identity assurance is needed, devices need a way to trust each other. The premise of Mutual Authentication is for both devices to present their digital certificates to each other. IoT device - Client Authentication certificate, Server - SSL certificate. As long as the certificate presented to the other party is "trusted" (the presented certificate is chained to a trust root) then the receiving device will trust it. This is all accomplished with Public Key Infrastructure (PKI) using asymmetric cryptography and digital certificates. Within the Gartner article, “PKI Is Gearing Up for the Internet of Things,” analyst Erik Wahlstrom states, “PKI has been a quiet yet foundational security tool for identity professionals for two decades. The IoT, mobility, certificate life cycle handling, scale and new deployment options create resurgent interest in PKI, its potential disruptors and its vendors.” This resurgence can be seen within the automotive, industrial, and medical sectors as many companies have adopted PKI as a best practice within their IoT implementations.
PKI supports the distribution and identification of public encryption keys, enabling users and computers to both securely exchange data over networks and verify the identity of the other party.
In simple terms, a CA signs and issues digital certificates to entities and individuals after verifying their identity. They are signed using its private key; its public key is made available to all interested parties. CAs use this trusted root certificate to create a "chain of trust". Because the devices in question “trust” the CA, they “trust” the certificates that are signed by the “trusted” CA.
Typical PKI includes the following key elements:
- A trusted party, called a certificate authority (CA), acts as the root of trust and provides services that authenticate the identity of individuals, computers and other entities
- A registration authority, often called a subordinate CA, certified by a root CA to issue certificates for specific uses permitted by the root
- A certificate store, which resides on a local computer as a place to store issued certificates and private keys
With this technology implemented in your environment, you can easily identify and trust communications between devices, implement non-repudiation and assure your devices are in fact what they claim to be.
PKI has proven its worth in solving high-assurance problems for the past two decades and stands ready to securely manage digital certificates for the IoT.Richard Moulds VP of strategy, Thales e-Security
In conclusion, don’t be like E.T., make sure your devices can phone home with certainty.