One of the core vendors in the emerging Internet of Things (IoT) ecosystem is predicting there will be 200 billion connected things by 2020 and this much heralded IoT tsunami will undoubtedly impact us all in multiple ways. We’ve all become familiar with accessing services through our mobile phones, but through the IoT this will be extended further, to include interaction with devices and things in our homes, our cars, our streets, our hospitals and our cities.
And yet, for every new and exciting use case that emerges, there are more and more horror stories of breaches and hacks that send a shiver down the geekiest of spines. In 2016, it is estimated that 3.1 billion data records were breached (the number was a mere 480 million in 2015).
This included a wide variety of hacks to companies across many verticals, but needless to say some hacks are more dangerous than others; and this is demonstrated nowhere better than in the field of healthcare.
It is now becoming commonplace to find implants and other medical devices, such as pacemakers and insulin pumps, which are ‘smart’ and ‘connected’ – i.e. able to receive, transmit and process data and then take consequent action on the patient. This brings many obvious advantages to both healthcare professionals and patients alike, reducing the need for needless journeys and saving precious waiting and consulting time for both time-starved patients and doctors alike.
However, these benefits are not without risk, as highlighted recently when pharmaceutical firm Johnson & Johnson had to contact over 100,000 patients to recall a faulty insulin pump which had a security flaw. Vulnerabilities were discovered in the pump control box, such that if the device were hacked, the pump could be sent malicious instructions, for example to inject a lethal dose of insulin. The term ‘fatal security flaw’ has never been a more apt descriptor.
One can also imagine a similar disaster scenario in our ‘smart cities’, where bogus traffic sensors could issue rogue guidance, for example increasing speed limits at times of peak congestion. It doesn’t take much imagination to predict the outcome when self-driving cars are taking their instructions from such sensors.
It therefore goes without saying that in many industries, as smart, connected devices are rolled out more widely, security isn’t just a nice to have, but becomes an absolute essential. So why isn’t security built in to all such devices? Well, security often means additional cost, additional processing power and generally much more complexity, when often cost and time to market are the essential design factors.
Furthermore, there is very little structure around IoT in terms of standards and certifications, and so even those service providers concerned about security, have difficulty finding informed support, standardisation and guidance.
Thomas Gayet, Head of the ‘CERT-UBIK’ Computer Emergency Response Team at Paris-based Digital Security, points out that the level of maturity among manufacturers of connected objects in general varies a great deal when it comes to cybersecurity. “Surprisingly, the level of security of connected objects does not generally correspond to the actual security needs. Some connected objects that one might regard as mere gadgets are highly secure, while, on the other hand, many connected healthcare devices do not incorporate any security measures at all!” he warns.
As awareness grows and connected services proliferate, security threats need to be taken much more seriously. And, given the potential life threatening consequences as outlined above, security can never be a mere afterthought.
To achieve optimum security, it has to be built in from the ground up, at the manufacturing and design stage. A device with a Root of Trust (RoT), protected and isolated at manufacture, enables a device to be given a secure identity, and one that can be trusted throughout its lifecycle.
At Trustonic, we inject a RoT and a secure platform into more than 900 million mobile connected devices, which means these devices can now be inherently trusted and their identity guaranteed
With RoT, any fraudulent nodes (or connected ‘things’) can be easily identified and isolated and, similarly, any users of the system would also require a trusted identity.
In the insulin pump example above, anyone attempting to modify the actions of the pump (e.g., to increase dosage to a lethal level) would first need to prove they are authorised to perform actions on the system and any subsequent messages sent to the device would also need to be digitally signed and validated using the RoT.
Furthermore, Root of Trust and embedded security needn’t mean additional hardware costs or added complexity. The protection can be taken care of at the design stage, leaving app developers and service providers with a simple yet cost effective means of leveraging the heightened and robust security demanded by many of these emerging services.
Trustonic will be exhibiting at the following shows in the coming weeks, please contact us to arrange a meeting to discuss how Trustonic security can help protect your mobile services and applications.
RSA conference, San Francisco, 13-17 Feb, 2017; Booth N4615
MWC, Barcelona 27 Feb – 2 Mar, 2017; Hall 6 – 6I40
