The power of objects in the Internet of Things (IoT) to change the state of environments — in addition to generating information — will cause chief information security officers (CISOs) to redefine the scope of their security efforts beyond present responsibilities, according to Gartner, Inc.
Gartner predicts that IoT security requirements will reshape and expand over half of all global enterprise IT security programs by 2020 due to changes in supported platform and service scale, diversity and function.
“The IoT is redrawing the lines of IT responsibilities for the enterprise,” said Earl Perkins, Research Vice President, Gartner. “IoT objects possess the ability to change the state of the environment around them, or even their own state; for example, by raising the temperature of a room automatically once a sensor has determined it is too cold or by adjusting the flow of fluids to a patient in a hospital bed based on information about the patient’s medical records. Securing the IoT expands the responsibility of the traditional IT security practice with every new identifying, sensing and communicating device that is added for each new business use case.”
Traditional “information” technology is now being supplemented by purpose-built, industry-specific technologies that are tailored by where and how that technology is used and what function it delivers. Information remains a key deliverable and is the fuel for IoT devices. The device’s ability to identify itself (such as RFID tags that identify cargo), sense the environment (such as temperature and pressure sensors) or communicate (such as devices in ocean buoys that transmit environmental changes to the areas around them) requires information to be generated, communicated and/or used.
Although traditional IT infrastructure is capable of many of these tasks, functions that are delivered as purpose-built platforms using embedded technology, sensors and machine-to-machine (M2M) communications for specific business use cases signal a change in the traditional concept of IT and the concept of securing IT.
“This is an inflection point for security. CISOs will need to deconstruct current principles of IT security in the enterprise by re-evaluating practices and processes in light of the IoT impact,” said Perkins. “Real-time, event-driven applications and non-standard protocols will require changes to application testing, vulnerability, identity and access management (IAM) — the list goes on. Handling network scale, data transfer methods and memory usage differences will also require changes. Governance, management and operations of security functions will need to change to accommodate expanded responsibilities, similar to the ways that bring your own device (BYOD), mobile and cloud computing delivery have required changes — but on a much larger scale and in greater breadth.”
Although the business use cases being identified daily are indeed innovative and new, the technologies and services that deliver them are seldom new as well — they are also seldom uniform in architecture and design. Each use case risk profile has specific requirements that may result in the use of old platform and service architecture with a new technology “overlay” to improve performance and control.
“This represents an interesting challenge for CISOs when delivering secure services for the IoT,” said Perkins. “In some cases, it may be a ‘past is future’ exercise in evaluating mainframe, client/server, Web, cloud and mobile security options as part of an overall IoT business use case. Even out-of-maintenance systems such as Windows XP may still play a critical role for some industry infrastructure as part of an IoT security system. Security planners should not throw away their old security technology manuals just yet.”
CISOs should not automatically assume that existing security technologies and services must be replaced; instead, they should evaluate the potential of integrating new security solutions with old. Many traditional security product and service providers are already expanding their existing portfolios to incorporate basic support for embedded systems and M2M communications, including support for communications protocols, application security and IAM requirements that are specific to the IoT.
“At this time, there is no ‘guide to securing IoT’ available that provides CISOs with a framework for incorporating IoT principles across all industries and use cases,” said Perkins. “Another unique characteristic of the IoT is the sheer number of possible combinations of device technologies and services that can be applied to those use cases. What constitutes an IoT object is still up for argument, so securing the IoT is a ‘moving target.’ However, it is possible for CISOs to establish an interim planning strategy, one that takes advantage of the ‘bottom-up’ approach available today for securing the IoT.”
CISOs should resist the temptation to overthink security planning while patterns and solutions are still emerging. They should start small and develop initial security projects based on specific IoT interactions within specific business use cases. CISOs can build on these use case experiences to develop common security deployment scenarios, core architectural foundations and competency centers for the future.
“The requirements for securing the IoT will be complex, forcing CISOs to use a blend of approaches from mobile and cloud architectures, combined with industrial control, automation and physical security,” said Perkins. “Fortunately, many of the security requirements for the IoT will look familiar to the CISO. The technologies and services that have been used for decades to secure different eras of computing are still applicable in most cases.
