Getting IoT Security Right: Lessons from Other Security-Conscious Markets

Getting IoT Security Right: Lessons from Other Security-Conscious Markets

“IoT security” has long been a hot topic, with many articles and conferences insisting that the biggest single obstacle to growth in this industry is the lack of a comprehensive solution to secure IoT devices and ecosystems. But in many ways, the challenge of IoT security is not a new one, and there are clear parallels between IoT security and other industries that have needed to secure their critical assets and business models.  Understanding the technical and commercial structure of these approaches provides excellent guidance for IoT device manufacturers on how to address their security needs as well.

The focus of this article is on the global pay television market. Like many industries leveraging the Internet of Things, pay-TV involves high-value business models (more than US$200 billion in annual revenues), vulnerable edge devices subject to attack (set-top boxes), and a quickly evolving threat landscape that requires an active and dynamic approach to security.

A Short History of Pay-TV Security

From the very beginning of digital pay TV’s launch in the 1990’s, service providers turned to a small group of specialized Conditional Access System (CAS) companies whose expertise was in securing the pay-TV business model against piracy using smart card-based solutions that they either developed themselves in-house or customized based on available industry chips. Smart cards were the technology of choice for pay TV because they provided a hardware-based root of trust, securely storing the keys necessary decrypt access to pay-TV services. Smart cards also allowed service providers to implement and manage a single security solution across a variety of different set-top box vendors and devices, as well as offering the advantage of being replaceable, enabling service providers to “swap” cards in case of security issues.

By defining this “intermediary” role for CAS vendors in between the device manufacturers and the pay-TV operators who used those devices, it not only allowed each party to focus on their core strengths and business activities, but it also created a clear definition of who was responsible for the security lifecycle management of pay-TV services. And considering the average life of a set-top is almost 10 years and that CAS systems are under constant attack, that role is a critical one in order to create a sustainable pay-TV business model.

This is very important to consider when we think about IoT device security. The question of “who is responsible for what” is one that needs to be unequivocal.  In the world of pay TV, this was a byproduct of the fact that the companies providing CAS technologies were effectively different companies than those providing the devices themselves. Therefore, security responsibilities were clearly defined, and when breaches occurred (as they inevitably did), pay-TV operators knew exactly to whom they could turn for support. As a result, this successful model still remains dominant today in broadcast pay television, and the technology provided by CAS vendors has continued to evolve over time to fend off wave after wave of pirate attacks.

Becoming a Trusted, Strategic Security Partner

As CAS vendors become the trusted security experts in pay TV, operators also began to ask for their help with the end-to-end definition of their security architectures and choice of other technologies, like chipsets and set-top boxes. In fact, CAS vendors ultimately took responsibility for certifying the end-to-end implementation of pay-TV security, with the other parties in the chain required to submit their technologies for evaluation and approval. As the industry evolved further and new video distribution methods (namely the internet) and devices (like PCs, tablets and smartphones) became popular, CAS vendors were called on to adapt their security technologies to this environment as well. This role in helping design security into new devices, adapting it to new networks and evolving it over time is critical to IoT as well.

In addition, as pirates started to leverage the internet to distribute content illegally in new ways, CAS vendors were called on to provide managed anti-piracy services. This included both monitoring the internet and dark web for piracy as well as the response measures required to actively manage it. Today, CAS market leaders like Kudelski Group’s NAGRA are able to cover the entire end-to-end security needs of their customers, helping them to design, integrate, certify, run and sustain high levels of security over time, protecting their critical assets and business models. This same breadth of products and services is also important to consider when selecting an IoT security vendor.

Other Industries Embrace Similar Models

Pay TV is not the only industry to embrace the model of an independent security partner. Others as varied as banking, telecommunications and IT, all of which involve billions of dollars in revenue at risk of fraud, have also turned to trusted third-party security providers as well, also frequently using smart cards. This technology has protected a wide range of different types of businesses:

  • Banking applications, where smart cards have been used as payment and credit cards
  • Telecommunications, where smart cards (in the form of SIM cards) have been used to secure the secrets required for phones to access mobile networks
  • Corporate IT, where smart cards give secure access to company networks and resources

Smart card-based systems for all these industries are designed to resist attacks from even the most determined hackers and pirates, and as a consequence, these industries have resisted sustained efforts from organized criminals to undermine their businesses. As a result, the technology has evolved and flourished.  Smart cards have been so successful because they provide a secure device for storing data and executing security functions that need to remain “secret”, preventing counterfeit and pirate solutions from becoming widespread.

Whom Do You Trust?

Fast forward to IoT and many device manufacturers seem to be repeating mistakes that were already made and solved in these other industries many years ago. The worst mistake is that many IoT devices seem to be designed without any security at all, or with security only as an afterthought. Many IoT silicon vendors – whose real expertise lies in delivering functionality and connectivity – see this as an opportunity to position “security” as a selling point for their chips in the hope they can differentiate their products in what is often a low-margin business. But designing security into IoT chipsets is not enough to secure end-to-end security lifecycle management provided by the specialized security vendors like the ones mentioned above. The key question is whether or not the security provider is committed to the long-term protection of the end customer’s business model and has the infrastructure and operational experience to be the long-term guarantor of end-to-end IoT security.

What Does Good IoT Security Require?

Let’s assume for the moment that device manufacturers and service providers embrace the concept of identifying a partner to be responsible for security. What should they look for?

  • Deep relationships with key chipset vendors and the ability to influence their designs are required
  • The flexibility to deliver a root of trust using a variety of different protection methods (integrated secure element, SIM card, TEE, etc) in order to achieve maximum device reach.
  • The ability to provision devices with secrets, either in the production process or over the air (OTA) based on close collaboration with these chipset vendors.
  • The ability to quickly update code on deployed products in case of hacking
  • The ability to constantly monitor (via in-field diagnostics) any deployed products to anticipate potential security compromises (by using techniques such as artificial intelligence-based behavioral monitoring, for example)
  • The presence of proprietary security mechanisms embedded into the silicon in order to activate countermeasures (as has historically been done with smart cards) in the event of a security breach
  • Cryptographic algorithms and other security elements should be changeable in the field on deployed products to counteract piracy on deployed devices.

Most of these things require a strong collaboration on design between IC vendors and security vendors in order to align with the required features. Is such collaboration likely to happen? In industries like pay-TV, it has become the norm. Whether it becomes the norm with IoT will depend greatly on the decisions made by device manufacturers when they chose their security partners and IC vendors. Sometimes at the outset, it may appear efficient to select a “one-stop shop” solution, but a judicious reflection needs to consider the long term, and a key question is “who do I call when bandits knock at my door?”

Final Key Questions

In summary, IoT device makers and service providers are invited to consider two very important questions that are critical to IoT success.

  1. Does your security provider have the technical ability and operational experience to help you withstand both basic and advanced attacks?
  2. Is their commercial business model aligned with your needs for long-term security lifecycle management, keeping your IoT products secure over the long term?

Selecting a trusted, strategic security partner who has the ability and relationships to execute on the required technical features and services to enable sustainable business models is crucial. Once these types of questions become seriously considered in the IoT market, we will be able to make progress on removing “security” from the list of barriers holding back the full potential of the Internet of Things.

The Business Case for Resilient IoT Security – Review of New Research

IoT and a Growing Attack Surface

There is no doubt that the IoT brings with it tremendous opportunities to deliver more and richer data to drive operational efficiency and smart decision making.  But as IoT devices proliferate, they also increase the overall attack surface and expose organizations to additional threats. It has always been clear that it is far more cost-effective to implement good data security during the design phase of any product or system, and exponentially more expensive to fix it after there’s been a breach. Even though IoT security has been commonly recognized for years as one of the key barriers to successful IoT implementation, many management boards have yet to make the necessary investment in it.  So how does a product manager or security officer justify the business case for implementing the right level of IoT data security from the start?

Now thanks to new research released from the Ponemon Institute and IBM this month, those costs can now be quantified based on the real-life experience of 477 different companies who have gone through data breaches themselves, and the scope and cost of the problem can be better understood. In summary, the bad news is that the implementation of IoT devices has indeed increased the attack surface and the overall cost of recovery from data breaches, but the good news is that organizations implementing robust data encryption and incident response services have significantly lowered the cost of those breaches. Let’s look at some of the highlights in more detail.

IoT Data Breach Trends 2017-2018

More than 2000 IT and compliance professionals whose companies had suffered data breaches over the past 12 months were interviewed for the study.

  • They reported that the total cost of an average customer data breach was a staggering US$3.86 million.
  • That’s a year-over-year cost increase of 6.4%
  • The average cost per stolen consumer record of $148.
  • For healthcare, that figure skyrockets to a whopping $408 per lost or stolen patient record.
  • Companies making extensive use of IoT devices saw the average cost per stolen customer record increase incrementally by $5, suggesting indeed that deploying IoT devices can tangibly increase the risk of data loss.

That said, organizations who had taken proactive measures to encrypt most of their data (whether coming from their IT or IoT infrastructure) saw the average cost per stolen record adjusted down by $13, while those who had strong incident response (IR) capabilities – either in-house or with trusted third-party cybersecurity experts – were able to generate another $14 savings per stolen record. That suggests that an organization employing both capabilities might save more than 18% on the cost of a data breach. That means a savings of $700,000 on an average breach. And the survey further shows that companies who have had a single material breach have a 27.9% chance of suffering from an addition breach within the following two years, driving the breach costs (but also the potential savings of good security) even higher.

But we have now also entered the era of the “mega-breach”, according to the report. Ponemon measured for the first time the impact of breaches of between 1 and 50 million records and showed that they had a cost of $40 million and $350 million respectively. When companies invest in IR and encryption technologies for this type of volumes, the savings generated run far into the millions of dollars.  How many records do you have and what would be the total costs to you of such a breach if your company were to suffer one? That’s important to know and contributes directly to your IoT and cybersecurity business case.

Justifications Beyond Data: the Kudelski Group Analysis

But even with this excellent justification for IoT security investment, data breaches are only one potential factor that should be considered as part of the overall business case. Our experience at the Kudelski Group is that devices can also be compromised if not properly protected and could by hijacked by botnets designed to launch distributed attacks on popular websites or services. They could also be hacked to provide false data to their owners, which in the case of industries like power, health care and energy could cause serious productivity, availability, fraud, damage or – even worse – safety issues. The same is true in reverse, where unauthorized commands mistakenly accepted by insufficiently protected devices could cause them to behave in ways that are dangerous – think automotive, aviation and smart buildings. These device security scenarios must also be considered when creating the business case for IoT security but were not the subject of this study.

All the elements discussed so far fall under the category of “risk mitigation”, and while they are very compelling and must be considered, IoT also brings great promises of new features, new business models and operational efficiencies that positively and directly impact the bottom line. Organizations should rightly include (realistic) forecasts for value that IoT will add to the business over the long term. When all these factors are combined, we believe that the justification for a management board to invest in the proper design and implementation of robust, sustainable IoT device and data security as well as managed security and incident response services is overwhelming. And that’s why some of the world’s most recognized and security-conscious brands are already working with us to secure their connected futures.