Slashdot Mirror
Securing Networks In the Internet of Things Era
An anonymous reader writes "Gartner reckons that the number of connected devices will hit 26 billion by 2020, almost 30 times the number of devices connected to the IoT in 2009. This estimate doesn't even include connected PCs, tablets and smartphones. The IoT will represent the biggest change to our relationship with the Internet since its inception. Many IoT devices themselves suffer from security limitations as a result of their minimal computing capabilities. For instance, the majority don't support sufficiently robust mechanisms for authentication, leaving network admins with only weak alternatives or sometimes no alternatives at all. As a result, it can be difficult for organizations to provide secure network access for certain IoT devices."
When was gartner right about anything ?
Most of the management types I've met have just enough functioning brain cells to kiss ass and repeat whatever mantra they learned in MBA school or during the most recent management retreat.
Target was breached because HVAC maintenance had access to the same network as the POS terminals, which is inexcusable stupidity. Unfortunately, this is exactly what will happen with the IoT devices. Putting them on an entirely separate network (own APs for wireless, blinkenlights, ...) will cost something, and, since the CIOs don't spend hard time in a closed prison for exposing their systems, or the personal data of employees or customers, they simply will not authorize the expenditure.
The Internet of Things is a buzzword. Buzzwords don't need securing. Problem solved.
"A door is what a dog is perpetually on the wrong side of" - Ogden Nash
You can buy a router for 200 bucks that can do port by port VLAN or create different Wifi SSIDs that link to different VLANs.
Put all your internet of things stuff on VLAN 2, then setup firewall rules that allow the hub for the internet of things devices to either communicate directly with a control system on VLAN1 or just go out to the internet. If VLAN 2 is compromised... it will not compromise VLAN 1.
I've decided to stop wasting my time responding to AC trolls/sockpuppets... so if you want a response from me... login.
There is very little upside to having various infrastructure devices and appliances networked. Downside are too numerous to list here, and securing them is overly expensive.
Solution? Air gap it!
You need to for the following reason.
A billion people who are clueless will buy IoT refrigerators, TVs, toasters, lamps, thermostats, washing machines, dishwashers, and so on.
Companies will cater to this market, and moreover will stop making non-IoT enabled devices.
"No problem", you think, "I just won't put them on the network". But to get around this and ensure you can be data-mined, the devices will be designed not to operate without connecting to their "home base" advertising company.
So the answer is: you need to "change your relationship with the internet" because you'll want to keep turning on your lamps, setting your thermostat, washing your clothes, refrigerating your food, etc.
You might think, "OK, I just won't buy any new devices". That works for a while. But eventually devices break, people need new ones, and we'll be locked into the world of IoT.
You might think, "don't buy those devices and they'll stop making them". But it won't work, because a billion other people will buy them, and a handful of people who refuse don't matter on this scale.
That's why.
HTH.
Yup - only enable services that are actually needed. That reduces the attack surface. A printer doesn't need a default route, a DNS server address, a FTP/Telnet server and many other things that HP and others enable by default in their printers.
Excuse me, but please get off my Pennisetum Clandestinum, eh!
Assuming you will ever read this after posting as an AC, how do you propose the distribution of these One Time Pads will occur? How will each device determine which One Time Pads have been used and which haven't? What happens when you want to check your refridgerator contents from an internet cafe? Even if you can distribute a new OTP set efficiently and securely, how will that be synchronized? How, for example, will the other ten devices in your home know that one of them has a different OTP set installed without using the network? How will you keep people from performing denial of service attacks by invalidating your current OTP set? What happens if the device you use to manage OTP sets fails? How far into this post did you have to read before you realized that your idea is an EPIC FAIL, and you really hadn't given any actual thought to the problem?
What do you mistakenly think this has to do with OTPs?
Guns don't kill people; Physics kills people! - John Lithgow as Dick Solomon on Third Rock From The Sun
don't plug toasters, TVs, fridges, etc into the Internet. the geniuses behind them don't even finish the software they're loaded with at the factory.
if this is supposed to be a new economy, how come they still want my old fashioned money?