Supply chain attacks are rampant, targeting stores globally and resulting in millions in losses in food supply that directly impact affected neighborhoods and countries. The European Union (EU) and United States (US) are facing attacks on the food supply chain due to vulnerabilities in exposed IoT devices and the use of insecure default passwords on these exposed systems. The spate of attacks occurring across the EU over the past 4-5 weeks, plus the warnings on preparedness have highlighted these long-standing attack vectors.
European Union Agency for Cybersecurity (ENISA), the US Federal Bureau of Investigation Cyber Division, and news sources such as RTE are bridging the current gap to increase awareness on what can be done today. This is necessary and helpful.
Other similar attacks stem from insecure IoT devices used to gain access to systems and networks. For example, in the Target attack more than a decade ago, an HVAC system was the entry point. With winter coming, exposed devices for heating systems remain an easy target if left unsecured.
Much of the focus is on what the consumer of these insecure products should do, but why not shift the responsibility to the vendors and help them build better products?
In my home, I declined using a heating system controller that could be accessed from my phone. Keep-it-simple (KIS) was the best approach to avoid introducing software vulnerabilities through upgrades or poor design. We should not expect consumers and business owners to be knowledgeable in security, they should be focused on their business and/or their family life.
How is a consumer or business owner supposed to determine which device is secure?
How can they know which vendors make better decisions about built-in security?
How can we change things so shop owners can focus on which refrigeration units fit their space and business needs best, knowing their purchases are secure?
First, vendors face a difficult job in determining the best approaches for building IoT devices. The decision points are vast, and the necessary information may not be readily accessible to design and development teams. When I served as CTO for the Center for Internet Security, this challenge became apparent, leading my team to develop a design guide for IoT security. The guide covers all key decision points and compares various IoT stacks. Numerous experts reviewed it, mainly Internet Engineering Task Force (IETF) contacts who either wrote the protocols or were responsible for ensuring security in well-resourced vendor organizations.
In many of today's exploits, online devices with easy-to-guess passwords are at the crux of the problem. We have solutions such as Bootstrapping Remote Secure Key Infrastructure (BRSKI), which enables a device to be brought online in a new environment and automatically updated with secure keys to establish safe communications. However, with hundreds of thousands of device manufacturers, information on how to secure a stack and which authentication solutions to use remains buried beneath vast amounts of unorganized data.
Here is a link to the Center for Internet Security IoT hardening guide, and I will ask for permission from CIS to work on and publish an update. This document compares the most commonly deployed IoT stacks for developers to first select the appropriate stack for their platform. Then it walks through the security capabilities that can be built upon each of the stacks. If you are a vendor and you’ve locked into a protocol stack, there are options to secure it. This guide puts it all in one place to simplify the process and make these decision points more universally accessible.
Additionally, some vendors secure their devices and systems by design and by default today. SecurityBiaS helps expose that information transparently through our Ecosystem Aware Security Economics (EASE ™) platform, which includes device assessment comparisons to simplify decision-making for businesses. Eventually, this transparency should lead to improved Security Built-in at Scale (BiaS), where consumers including businesses can purchase products with increased confidence and remain focused on their core business.
