There’s a lot of hype around securing the Internet of Things (IoT). At the end of the day, I suggest that a more reasoned approach is in order. Securing the IoT will not be achieved by frantic worry about the volume of endpoints. Myopic focus on the volume of devices in an IoT ecosystem can lead to an important misstep: forgetting that it’s the Internet of Things. That means that all this data is passing through the network. Therefore, tackling security can only occur with diligent attention to the core of the IoT, namely, the network stack. In that way security can become as pervasive as the IoT itself.
I recently had the privilege of participating in a panel discussion at LiveWorx’s CXO Forum on Securing the IoT. Here are two predictions with respect to the IoT and security that I shared with the audience and my co-panelists at the event:
- Access and identity management will be critical in an IoT ecosystem. However, the username and password won’t be part of tomorrow’s approach: the password will die – and soon. It’s not radical to point out that passwords are insufficient on their own for authenticating access to sensitive data. I don’t think that means we’re going to go immediately to 21 levels of authentication, for example. We do need a human factor, and it can be biometric, or it can be at an endpoint. We’re familiar with straightforward biometrics such as the iPhone’s fingerprint scan, but there are also newer methodologies that track the exact way a human swipes a smartphone screen. We can leverage technologies such as this to enhance security in the IoT and its member devices.
- Our industry must work together in public-private partnerships to put a stop to the proliferation of regulations – country by country or region by region – that are creating a tangled web of laws, regulations, and guidelines around security. Conflicting guidance, standards, and regulations cause confusion rather than clarity. International standards bodies and government regulators should consider removing territorial blinders and revisiting the real mission: ensuring, to the greatest extent possible, that information and communications technology (ICT) are genuine and free from compromise and will not permit control over the operations for which they are used.
While strong international standards for IoT security and new authentication methods are just two pieces of the larger puzzle that will make IoT more secure, they are essential pieces. We at Cisco are working to make inroads in both these areas. Stay tuned.
Great blog entry on a hot topic! Do you think that the credentials in IoT as big or bigger an issue than the myriad of machines and devices that will be joining humans in the network?
I believe that locking these devices down is a huge piece of minimizing exposure for all of us, and that a push along the lines of https://letsencrypt.org is a great start – the quicker we eliminate excuses for using PKI (cost, complexity, etc.) the better off we’ll all be. Security shouldn’t be out of reach for those with limited budgets, as we’re all in this together and only as strong as our weakest link.
Nice blog entry Edna. Many challenges AND Opportunities in the IoE. Thanks for being a visible, vocal, and excellent leader in the security space.