{"id":28847,"date":"2019-09-03T22:04:00","date_gmt":"2019-09-03T22:04:00","guid":{"rendered":"https:\/\/www.threatshub.org\/blog\/iot-security-essentials-physical-network-software\/"},"modified":"2019-09-03T22:04:00","modified_gmt":"2019-09-03T22:04:00","slug":"iot-security-essentials-physical-network-software","status":"publish","type":"post","link":"https:\/\/www.threatshub.org\/blog\/iot-security-essentials-physical-network-software\/","title":{"rendered":"IoT security essentials: Physical, network, software"},"content":{"rendered":"
<\/div>\n

Even in the planning stages of a deployment, IoT security is one of the chief stumbling blocks to successful adoption of the technology.<\/p>\n

And while the problem is vastly complicated, there are three key angles to think about when laying out how IoT sensors will be deployed in any given setup: How secure are the device themselves, how many are there and can they receive security patches.<\/p>\n

Physical access<\/h2>\n

Physical access is an important but, generally, straightforward consideration for traditional IT security. Data centers can be carefully secured, and routers and switches are often located in places where they\u2019re either difficult to fiddle with discreetly or difficult to access in the first place.<\/p>\n

Where IoT is concerned, however, best security practices aren\u2019t as fleshed out. Some types of IoT implementation could be relatively simple to secure \u2013 a bad actor could find it comparatively difficult to tinker with a piece of complex diagnostic equipment in a well-secured hospital, or a big piece of sophisticated robotic manufacturing equipment on an access-controlled factory floor. Compromises can happen, certainly, but a bad actor trying to get into a secure area is still a well-understood security threat.<\/p>\n

By contrast, smart city equipment scattered across a metropolis \u2013 traffic cameras, smart parking meters, noise sensors and the like \u2013 is readily accessible by the general public, to say nothing of anybody able to look convincing in a hard hat and hazard vest. The same issue applies to soil sensors in rural areas and any other technology deployed to a sufficiently remote location.<\/p>\n

The solutions to this problem vary. Cases and enclosures could deter some attackers, but they might not be practical in some instances. The same goes for video surveillance of the devices, which could become a target itself. The IoT Security Foundation recommends disabling all ports on a device that aren\u2019t strictly necessary for it perform its function, implementing tamper-proofing on circuit boards, and even embedding those circuits entirely in resin.<\/p>\n