Slashdot Mirror
Securing Networks In the Internet of Things Era
An anonymous reader writes "Gartner reckons that the number of connected devices will hit 26 billion by 2020, almost 30 times the number of devices connected to the IoT in 2009. This estimate doesn't even include connected PCs, tablets and smartphones. The IoT will represent the biggest change to our relationship with the Internet since its inception. Many IoT devices themselves suffer from security limitations as a result of their minimal computing capabilities. For instance, the majority don't support sufficiently robust mechanisms for authentication, leaving network admins with only weak alternatives or sometimes no alternatives at all. As a result, it can be difficult for organizations to provide secure network access for certain IoT devices."
Most "things" in the internet of things will send very small amounts of data. A microSD card full of random data will provide secure communication for several years. Incidentally the same has been true of banks for a very long time. They send you a new bank card every few years.
When was gartner right about anything ?
Most of the management types I've met have just enough functioning brain cells to kiss ass and repeat whatever mantra they learned in MBA school or during the most recent management retreat.
Target was breached because HVAC maintenance had access to the same network as the POS terminals, which is inexcusable stupidity. Unfortunately, this is exactly what will happen with the IoT devices. Putting them on an entirely separate network (own APs for wireless, blinkenlights, ...) will cost something, and, since the CIOs don't spend hard time in a closed prison for exposing their systems, or the personal data of employees or customers, they simply will not authorize the expenditure.
The most secure computing device in general use is also the smallest: The (mini-, micro-, nano-) SIM card in your GSM phone does crypto that's good enough for payment processing. NFC cards are the same technology, just wireless. These cards run on microwatts. If the internet of things is insecure than it's due to laziness and cheapness, not because there's a technological problem. Minimal computing capabilities my ass.
The Internet of Things is a buzzword. Buzzwords don't need securing. Problem solved.
"A door is what a dog is perpetually on the wrong side of" - Ogden Nash
You can buy a router for 200 bucks that can do port by port VLAN or create different Wifi SSIDs that link to different VLANs.
Put all your internet of things stuff on VLAN 2, then setup firewall rules that allow the hub for the internet of things devices to either communicate directly with a control system on VLAN1 or just go out to the internet. If VLAN 2 is compromised... it will not compromise VLAN 1.
I've decided to stop wasting my time responding to AC trolls/sockpuppets... so if you want a response from me... login.
... we need to have an insecure buzzword, to "change our relationship" with the Internet? Why?
There is very little upside to having various infrastructure devices and appliances networked. Downside are too numerous to list here, and securing them is overly expensive.
Solution? Air gap it!
Most things like printers do not need to talk to the entire Internet. They just need to talk to the local network. So remove their default route. Without a route to the Internet, discover/communication/mischief becomes much more difficult. Its not perfect, but its an easy policy to remember. If it doesn't need to send packets out, then don't tell it how to get there..
connecting completely different systems to the internet for the purpose of doing something other than computing
Define a "thing" and distinguish it from "computing" to help some of us understand. Is a printer a "thing"?
Companies [...] will stop making non-IoT enabled devices. [...] the devices will be designed not to operate without connecting to their "home base" advertising company.
Then there's an opportunity for a competitor to say in an ad "Do you want your food to spoil just because your Internet went out? You don't have to worry about that with a QSI refrigerator."
..but in 30 years. Meanwhile, the toaster manufacturer needs Granny to be able to but and use it without explicitly pluuging in a network or configuring anything.
So IOT devices will have to have wifi sneak capabilities, always trying to establish a wifi connection. They can continually try to crack encrypted wifis.
It will be an interesting household with a few dozen nodes continually spamming the aether trying for connection.
don't plug toasters, TVs, fridges, etc into the Internet. the geniuses behind them don't even finish the software they're loaded with at the factory.
if this is supposed to be a new economy, how come they still want my old fashioned money?