Did you hear the joke about product managers and cybersecurity? Neither have I, they tend to not have much to do with each other – and that’s a problem. Product Managers who want to continue innovating and selling more of their products without any consumer hesitations need to wake up and smell the flowers – they need security and they need it done right. For product managers security is a business driver, not just an R&D task.
The mainstream approach to ensuring security and privacy when developing connected products is Security-by-Design (or SBD). It’s a focus that seeks to guarantee that a product has been designed, from its foundation, to be secure. Regulation authorities use it as a base requirement for security certification, and it’s heralded as a quality standard by security analysts and R&D teams alike. But dare I ask, is Security-by-Design enough? Considering the increased frequency of IoT attacks, there is good reason for doubt.
What is ‘Security-by-Design’?
Security-by-design refers to security built into the product from the ground up. Starting with a resilient design, decisions about the product’s development are based on best practices for cybersecurity.
The objective is focused on minimizing the potential attack surface area. This represents all the entry and communication points that are outward facing in an information system. For software this can be the OS, libraries, and read/write access. For network integrations these are the open ports, active IPs, network flows and used protocols. All these entry points need to be identified and protection mechanisms need to be put in place. For all the components that have little or no use in the system, a process of hardening is used, where the openings and ports are closed or minimized to limit the possibility of remote interaction. This includes encrypting traffic, making sure there is no excess code, allocating enough space, and encrypting binaries.
How Security-by-Design fails to protect devices
Considering that Security-by-design involves a fairly rigorous approach, why would anything else be needed? Because no matter how thorough you can be, Security-by-design only represents a first step towards achieving viable, ongoing protection.
The modus-operandi of hackers is to seek out any and all vulnerabilities and then upon finding one, exploit it. They expect some layer of security to be in place, their work is to identify the gaps in those layers and take advantage of it. Undoubtedly, the secret to their success is the element of surprise. Hackers seek out those inconspicuous “nooks and crevices” within a product’s system architecture, and from there launch their attack. The security of every product has an expiration date, and that is the moment a hacker manages to bypass it.
The attack landscape is always changing and evolving, you can’t future-proof an information system. Security becomes a continuous effort, rather than a switch to be flicked. A proactive layer of security is required that is automatic and able to provide ongoing, real-time detection and remediation against attacks throughout the product’s lifecycle.
The lab vs the wild
Even the most thorough penetration testing regime, can’t anticipate every possible method of attack. There is no possibility of adapting to attack vectors that as of today are unknown. In the “lab” a product can only be pen-tested against known forms of attack vectors, but in the ‘wild’ hackers are persistent and quite willing to adapt their techniques to find new ways to get through known security barriers.
A proactive solution, such as Firedome will constantly monitor the traffic of a device, monitor domains and IPs to detect any port scanning and brute force attacks. It should monitor CPU and memory consumption for crypto-hacking and denial-of-service attacks. Unusual activity that is happening in real time will be identified, such as suspicious log-ins that are not consistent with typical user patterns. The real-time capabilities should extend beyond the product itself but be connected to threat intelligence feeds that scan the dark web for any leaked passwords or malware heuristics.
Security-by-design is the equivalent of having a fenced off property, but a cunning thief will always find a novel way of getting around a fence. Proactive security is therefore the equivalent of having a surveillance system in addition to the fence, to constantly monitor for new, emerging threats.
What’s the risk for IoT?
IoT devices represent an emerging threat landscape with its own set of risks, primarily; privacy, safety, and availability. Whether the IoT device is a watch, a monitor or a fridge, it’s always going to be used to send or receive data. With so much data being transmitted, protecting user privacy is a critical factor that is threatened in an attack. The heightened interaction between the physical world and the virtual world, escalates the safety risk. Should a connected medical device be tampered with, the consequence could be life threatening. Finally, our continued adoption of IoT naturally deepens our dependence on it. Should a device be made unavailable in an attack, by default an entire production system can be brought down with it, bringing business to a standstill.
In this riskier context, the biggest pitfall of Security-by-design is its ability to lull developers into a false sense of security. Yes, it’s critical, but no, it’s not enough. Aside from the operational cost of applying, maintaining and delivering continuous security patches, there is the business risk of not providing real time security detection and response. Should your product be breached, it’s your business reputation and potential loss of customers that will be jeopardized.
Leave security to the experts
For many IoT developers cybersecurity is that big, hairy spider in the room that everyone knows is there, but no-one wants to deal with it. Product development teams need to keep up with the latest in functionality, design, UX and stay competitive with pricing, work within business constraints and market needs. Staying up to date with evolving cybersecurity threats is an expertise in itself and not just another KPI that can be added into the mix.
Firedome helps IoT brands to both develop their products in line with Security-by-design, but also provide a proactive, endpoint security solution to protect IoT devices against cyber attacks. Brands often request from Firedome a vulnerability assessment of their devices in order to identify any security gaps in their product. They then go on to deploy a lightweight agent that continues to detect and prevent any new and emerging threats. By providing continuous, proactive protection, IoT brands can focus on what they do best, creating innovative IoT solutions that never fail to impress.
Implement Firedome’s proactive, security solution on your IoT device and keep it secure well into the future!