Securing the Internet of

Transcription

1 Securing the Internet of (Every)Things Earl Perkins Gartner is a registered trademark of Gartner, Inc. or its affiliates. This publication may not be reproduced or distributed in any form without Gartner's prior written permission. If you are authorized to access this publication, your use of it is subject to the Usage Guidelines for Gartner Services posted on gartner.com. The information contained in this publication has been obtained from sources believed to be reliable. Gartner disclaims all warranties as to the accuracy, completeness or adequacy of such information and shall have no liability for errors, omissions or inadequacies in such information. This publication consists of the opinions of Gartner's research organization and should not be construed as statements of fact. The opinions expressed herein are subject to change without notice. Although Gartner research may include a discussion of related legal issues, Gartner does not provide legal advice or services and its research should not be construed or used as such. Gartner is a public company, and its shareholders may include firms and funds that have financial interests in entities covered in Gartner research. Gartner's Board of Directors may include senior managers of these firms or funds. Gartner research is produced independently by its research organization without input or influence from these firms, funds or their managers. For further information on the independence and integrity of Gartner research, see "Guiding Principles on Independence and Objectivity."

2 Let's Get the Big Story Out of the Way Right Now WE'RE ALL GOING TO DIE... but Probably Not From Cyber Security Compromise

3 It's Not the End of the World as We Know It, but It IS Serious Cyber threats are growing Cyber security requires cultural change Incidents drive government, industry to respond Cyber Security Cyber security has unique requirements IT adoption spreads IT security issues Welcome to a world of "continuous compromise"

4 Key Issues 1. What is cyber security and its role in the IoT? 2. What are the cyber security threats that the IoT faces? 3. How can enterprises using the IoT secure it?

5 Risk, Challenges, and Gaps Agent Profile Targeted Assets Industrial or critical infrastructure espionage Foreign intelligence services/nation-states Organized crime Activists, "hacktivists," terrorists Professional "bot herders," phishers, spammers "Mercenaries" hired to target specific industries State sponsored, paramilitary, intelligence Syndicates, gangs engaged in chip-based fraud IP, financial, production info., plans, strategies National/Industrial plans, secrets, strategies, sabotage Personal ID info., banking info., fraud, ID theft Ideological, hired "mercenaries" Industrial sabotage, planning, strategic secrets Malware wholesalers, rent to other threat agents Attract users, compromise user devices, harvest Gain device control, repurpose, rent, sell processing, fraud, ID theft, industrial espionage The accidental threat Regulatory uncertainty The uninformed employee or partner with access to systems Government regulation run rampant Software maintenance or upgrade, operational errors Business decisions and performance "No 2013 one Gartner, can Inc. and/or build its affiliates. his All rights security reserved. upon the nobleness of another person." Willa Cather

6 What Is Cyber Security and Where Does It Fit in the Internet of Things? Originally used in military and government, when used in the context of IT, for both offensive and defensive capabilities. Commercial markets began using term for operational technology (OT) security in industries such as manufacturing and utilities. Marketing gradually adopted as a new label for information, IT, and OT security. "Cyber security" is not a new concept or idea, but a convergence of offensive and defensive security. "Cyber Security" Information Security IT Security OT Security Physical Security "Offensive" Security

7 Hype Cycle for the Internet of Things expectations Wireless Power Smart Fabrics Low-Cost Development Boards Home Energy Management/ Consumer Energy Management Big Data Smart Transportation Smart City Framework, China Internet of Things DASH7 Context Delivery Architecture Silicon Anode Batteries IT/OT Integration Data Science Autonomous Vehicles Decisions and Recommendations as a Service Quantified Self Operational Intelligence Platforms Smart Dust ah Innovation Trigger Enterprise Manufacturing Intelligence Vehicle-to-Infrastructure Communications Peak of Inflated Expectations Plateau will be reached in: Bluetooth 4.0 Enterprise Information Architecture Facilities Energy Management Raspberry Pi Smart Appliances Complex-Event Processing Home-Area Network Broadband-Connected Televisions Operational Technology Security Z-Wave Wireless Healthcare Telematics Asset Management Machine-to-Machine Communication Services Operational Technology Platform Convergence Consumer Telematics Mobile Health Monitoring Mesh Networks: Sensor Advanced Metering Infrastructure Trough of Disillusionment Vehicle-to-Vehicle Communications ISA-95 Integration Standards IPv6 time /ZigBee RF MCU Public Telematics and ITS 6LoWPAN RFID for Logistics and Transportation Slope of Enlightenment less than 2 years 2 to 5 years 5 to 10 years more than 10 years Source: From "Hype Cycle for the Internet of Things, 2013," 31 July 2013, G Commercial Telematics As of July 2013 Plateau of Productivity obsolete before plateau

8 Operational Technology (OT) Plays a Big Part in the Internet of Things OT is hardware and software that detects or causes a change of state, through the direct monitoring and/or control of physical devices, processes, and events in the enterprise. From vibration sensors to bearings with Bluetooth to microprocessor-based engine controls, even mobile equipment is now IT dependent. The typical plant has thousands of devices with some degree of embedded intelligence used for real-time performance monitoring. Virtually every mobile asset today has data collection capability. Whether continuously fed to the EAM application or via batch upload, performance data is being used for predictive maintenance.

9 OT Security is the foundation of the IoT The practice and technology used to protect information, processes, and assets associated with systems monitoring and/or controlling physical devices, processes, and events that initiate state changes in enterprise operational systems. IT Security Systems Industrial Control Systems (ICS) Process Control Systems (PCS) Distributed Control Systems (DCS) Supervisory Control and Data Acquisition (SCADA) Systems OT Security Physical Security Systems

10 You Have Been Invaded! 9

11 Is IT, OT, and "PT" Convergence Necessary? OT IT OT IT Physical Physical "Today": - Silo organization - Proprietary systems - Culture differences "Tomorrow": - Common governance - Standard systems - Cultures leveraged

12 The Internet of Things: It Is Already Here Remote sensing of objects and environment Over 50% of Internet connections are things: 2011: 15+ billion permanent, 50+ billion intermittent 2020: 30+ billion permanent, >200 billion intermittent Audio Cameras and microphones widely deployed Building and infrastructure management New routes to market via intelligent objects Everything has a URL Content and services via connected products GPRS Wi-Fi LTE Augmented reality Higher resolution display Flash Situational decision support NFC

13 Many Types of "Things" and Many IoT Architectures Smart autonomous "things" Controllable sensing "things" Communicating/ Sensing "things" Identifiable "things" Humans are both IoT nodes and endpoints Many "things" will exploit cloud architectures to communicate with people and endpoints

14 IOT Business Examples Controllable Things & Ensembles What if we could monitor and control equipment remotely? Parking bay sensors plus mobile apps enable dynamic pricing, reduce congestion, e.g., SFPark. Intelligent transportation, combine traffic sensors, intelligent signage. Reduce congestion and pollution. Precision agriculture plus selective irrigation, reduces cost/improve yields. Diagnose/correct problems and improve customer service/reduce service costs. Utility smart metering plus demand management to control consumption. Improves consumer service, regulatory compliance and the environment. Sifteo, intelligent "cubes" for games and education. Building cube app ecosystem. Automotive tracking and diagnostics. Remote home management, monitoring & security e.g., using Zwave. How can we use collections of sensing/controllable objects to provide a new service?

15 Who's Exploiting The Internet of Things and Who Should Investigate It? Industry examples: Utilities, e.g., smart grid, infrastructure monitoring Transportation & logistics, e.g., for track & trace, route optimization Healthcare, on-body monitoring Security/insurance asset monitoring, communications Advertising, knowledge of product/technology usage drives adverts on a different channel Business Situations: Stored assets where monitoring and replenishment increases revenue Expensive information shadows, e.g., supply chain for fresh produce Complex equipment, monitoring can reduce maintenance or support Critical infrastructure or equipment needing prompt diagnosis and repair Convert "pay to own" to "pay to use" Sensing replaces manual labor Sensing enables new features Convert products into relationships

16 IoT Will Pose Technical, Commercial, and Social Challenges Security E.g., OTA updates, hacking smart meters, authenticating data Deployment Commissioning a large number of sensor nodes Hype and Immaturity Of technologies and vendors Interoperability and Fragmentation E.g., O/S, programs, protocol stacks, tools... Software Architectures IoT middleware, distributed databases and processing, programming to minimize rf usage Tools E.g., debugging distributed algorithms in sensor networks Future Proofing Decade-long life span, retirement of technologies such as 2G Privacy Risks of sensing "things"

17 Is Entity Management Necessary in the IoT? Is the concept of identity expandable? Identity & Access Mgmt Asset Mgmt Mobile Device Mgmt??

18 Adopt a Strategy of IT/OT Convergence, Alignment, and Integration Information Technology Operational Technology

19 Can These Security Pillars and Foundations Be (Re)used for OT and the IoT? Application Security Identity & Access Endpoint Protection Data Security Network Security Detect Prevent Protect Remediate Infrastructure Protection Interaction Integration Correlation Context Awareness Governance, Risk and Compliance Management Intelligent Security and Risk Decisions and Actions

20 CIOs Must Embrace OT as representative of the Internet of Things By 2015, in more than 70% of enterprises, a single executive a newstyle CIO will oversee all Internet-connected entities. Factors driving this prediction: By 2015, unified oversight of all Internet-connected technologies will become a widespread business imperative. By 2015, context-aware information management will characterize leading enterprises. Leading CIOs are developing leadership roles enterprisewide across all technologies. Accelerating convergence of Internet-connected technologies. Credible, high-performing CIOs are the natural choice for the role. Factors against this prediction: Fewer than 30% of CIOs are responsible for all enterprise technologies in CIOs who focus mainly on technology issues and service delivery lack the necessary vision. Many IT organizations lack strategic business skills and credibility in non-it technology. Enterprise power structures, politics, and personalities may inhibit unified oversight. Credible non-cio individuals may have greater authority.

21 Recommendations Educate your enterprise on the taxonomy of cyber security and the Internet of Things to engineering and business Evaluate security solutions and services based on their ability to handle cyber security vs. particular subsets For enterprises with significant OT assets, begin the process of IT/OT convergence planning where needed Assess current security programs and solutions to ensure possible mobile and IoT implications are identified Monitor industry progress in converging technologies that expand security s remit to include relationships and objects

22 Recommended Gartner Research The Internet of Things Is Moving to the Mainstream Hung LeHong and others (G ) The Impact of Critical Infrastructure Protection Standards on Security Earl Perkins (G ) Agenda Overview for Operational Technology Alignment With IT, 2013 Kristian Steenstrup (G ) Predicts 2013: IT and OT Alignment Has Risks and Opportunities Kristian Steenstrup and others (G ) Cool Vendors in IT/OT Alignment and Integration, 2013 Kristian Steenstrup and others (G ) For more information, stop by Gartner Research Zone.