Commercial IoT: Big Trouble in Small Devices (Host Identifcation HIP)

[DarkReading

Check IoTWiki FreshThinking also ]

There are endless scenarios where hackers could wreak havoc on the industrial Internet of Things. There’s also a readily available solution called ‘HIP.’

It’s impossible to ignore the explosion of connected “things” today. Everywhere we turn there’s a new connected device. Hundreds to millions of unmanned devices and sensors are being deployed on everything from mining equipment and smart buildings to healthcare monitors and thermostats. By 2020, the Internet of Things (IoT) is projected to include somewhere between 20 billion and 50 billion connected things.

Still, many businesses haven’t quite wrapped their heads around the IoT. They know it is an opportunity that can’t be ignored—connecting our digital and physical worlds has the power to inform far better business decisions—but they see complexity and security red flags at the prospect of thousands of things talking to each other. They’re rightfully concerned.

Anything connected to the Internet has the potential to be exploited, whether it’s your refrigerator or an industrial control system. The sheer number of connected devices makes this complex for businesses.

Take a mining operation where 20 pieces of equipment each has hundreds to millions of sensors collecting and reporting real-time data. Each of these sensors is a connected “thing” that needs to deliver information to and from the network. One of these sensors may detect wear on the piece of equipment and report back the need for maintenance, or even control pausing its workload or shifting workload to another piece of equipment. Hacking this device could be used to send false instructions to physical equipment putting performance or safety in jeopardy.

There are endless scenarios where the industrial IoT, if accessed by hackers, could wreak havoc. Imagine the impact of a successful attack on the energy grid, chemical plants, medical equipment, oil fields or even traffic lights or ATMs. Then, there’s the scenario we saw last fall where unsecure IoT devices were used for a distributed denial-of-service (DDoS) attack on a massive scale.

A Hypermobile Protocol-Level Solution
In my opinion, IoT security needs to be solved at the protocol level. Current security methods, such as firewalls and VPNs, will fail as IoT grows; they are too expensive to deploy and manage in large numbers, and remember we’re talking about hundreds and thousands of IoT devices in a business.

At the same time, we can’t rely on the current IP protocol that runs the Internet today to secure the IoT. IP addresses are easily spoofed, which means an attacker could gain access to an IoT device by impersonating a trusted connection. The IP protocol was not designed as a secure protocol; even Vinton Cerf, co-inventor of TCP/IP  and widely known as the “Father of the Internet,” says he wishes they had done more in the beginning to secure the Internet. Unfortunately, we don’t get a do-over.

So, decades later, businesses need a way to secure the vast number of connected devices that the IoT network of the future requires. I’m a firm believer in an industry protocol called host identity protocol (HIP). HIP was specified in the IETF HIP working group about 15 years ago and has matured considerably since then. With HIP, all occurrences of IP addresses are eliminated and replaced with a unique, non-spoofable address that is invisible by default, making it resistant to man-in-the-middle and DDoS attacks.

In simple terms, you can think of HIP like your fingerprint. It’s unique to the device, and like your fingerprint travels with you always, a HIP address is recognized no matter where it accesses the network from—it’s hypermobile.

[Check out 5 ways to prepare your organization to address the security of the Internet of Things at Interop ITX. ]