The Internet of Things Must Not Be Allowed To Turn Into The Internet of Trouble

 

Over the past couple of years, there has been a huge upsurge in the amount of information security incidents, ranging from malicious software that holds you to ransom by "kidnapping" your digital assets to alleged hacking attempts by nation states against global companies.

There have been high-profile incidents such as the Yahoo hacking that led to the compromise of more than 500 million accounts, through to the cancellation of surgeries and other medical procedures in a hospital in the United Kingdom in recent days.

We also had a chilling demonstration of how fragile the ecosystem of the Internet is when the service provider Dyn was among a group of companies deluged with a tsunami of internet traffic and unable to deal with the real business traffic that they were supposed to process. This led to a massive availability issue for large swathes of the internet, including major brands such as Amazon, Twitter, PayPal and Spotify. Their systems were up and running, but their customers in many parts of the world could not connect to them.

This was the second attack on a scale never before witnessed on the Internet, the first was an attempt to silence a security technology journalist by the name of Brian Krebs. Society does not benefit from the silencing of an investigative journalist.

And there would be outcry if this sort of attack on investigative journalism happened in the "real world" as opposed to it happening online.

These attacks were carried out by a massive "bot", or army, of devices connected to the internet with poor security controls implemented on them that allowed a hacking group to install their own software on millions of devices around the world.

Somewhat ironically, these were security devices. They were security cameras that people had bought to protect their homes, their loved ones and their personal assets. Many of these cameras were connected to digital video recorders (DVRs) that record the CCTV type images from the security cameras. A piece of malicious software known as Mirai was developed by a crime-ware organisation and released on to the Internet.

Belatedly, the manufacturer has issued a recall to any customer who purchased through official channels, but it is likely that take-up of this offer will be slow.

So what does this mean for the average Internet user?

Unfortunately, as things stand, it is not good news. This article is not meant to be a prophecy of doom, but as long as there is money to be made through crime on the internet, things will only get worse. There is such limited regulation, almost no legislation and consequent enforcement capability on the global platform we all share as the internet that it cannot get better in the short term.

We are already on an exciting journey into the "Internet of Things" (IoT). If you were to believe all the marketing hype, this will transform all our lives. From smart-home heating systems to fridges that will order products as they are finished to lighting systems we can monitor remotely, the list goes on. Undoubtedly, many of these things will be of huge benefit, particularly in the health and security scenarios for people who may be isolated or have limited mobility.

However, as has been seen with Mirai, if these systems are not secure, the very future of the internet and all its amazing benefits, will be threatened. This is not an attempt at hyperbole or scaremongering.

Within Europe, we have the CE mark applied to products that have demonstrated their conformance with specific product standards. Some classes of products cannot be sold in Europe without the CE (Conformité Européenne) mark. A consumer purchasing a CE marked product can take certain comforts in the fact that the product is likely not to cause them or anyone else harm if used according to manufacturer guidelines. There is currently no equivalent on the internet. Anyone can buy any product from any supplier via any commercial channel in any jurisdiction and just connect it to their Internet connection.

Unfortunately, we have a "perfect storm" situation developing here. There is a very low level of awareness with consumers as to the type of things they should be looking for from a security perspective when purchasing a new product.

Price tends to be the deciding factor and more of these purchases are done via the internet and delivered from suppliers in other jurisdictions. Until that level of consumer awareness increases and responsibility taken for the choice of a low cost, but insecure device, as opposed to a more expensive one with demonstrated compliance with standards in the area, it will be very difficult to keep the Internet safe.

When purchasing a car, we are all well aware of the safety features and these are often key decision factors for those with young families etc. The NCAP ratings are heavily promoted by safety-conscious manufacturers. We also have the situation where manufacturers are acutely aware of the potential for fines and compensation in the event of their products causing harm.

The lack of consumer awareness combined with a dearth of regulation or legislation in the area of consumer devices that are internet connected is a recipe for disaster in the long term.

This lack of regulation or legislation that is applicable to all jurisdictions that are connected to the Internet is a fundamental issue for the users of the Internet, now and into the future. There are states across the globe that are struggling to deal with far more serious issues in terms of wars, famines, natural disasters and so on and quite rightly will not commit to a global effort to secure the internet. This is even if the will to do this would ever exist.

Anyone could control these devices, access content on them, create malicious or misleading info on them, delete footage of a crime, determine when someone is at home or not and so on.

One area where we are seeing regulation requirements is the European Union General Data Protection Regulation (EU GDPR). This regulation, that comes into force in May 2018, states the principles of data protection by default and data protection by design. This is a principle that all of us in the InfoSec industry are excited to see. Our desire would be to see this sort of principle extended to all other situations, not just ones that process personal data.

The directive on security of Network and Information Systems (NIS) from the European Union was formally adopted during the summer of 2016 and member states have up to two years to transpose into local laws. It has wide-ranging implications for providers of "essential services" and how they handle cyber security and cyber incidents.

However, it does not do anything to address the issues highlighted recently with regard to the security of consumer devices that will be connected to the Internet.

The Internet is a utility in the same way as the water service, electricity grid, transport networks and so on. Many people cannot carry out their daily tasks or jobs without reliable Internet services. As we move more and more to the IoT, especially health-related devices using the Internet, the internet transitions from a useful tool to a critical service.

Regulators and legislators must do more to ensure the basic quality from an InfoSec perspective when it comes to the sale of IoT and other connected devices. This could go as far as requiring the equivalent of a CE conformance from an information security perspective before access to the internet is granted.

Consumers must be made more aware of the risks associated with the connection of insecure devices to the internet and installed within the home or given to children or other vulnerable members of society. We have seen the withdrawal from sale in the past year of motorised devices often referred to as "hover boards" due to battery fire safety concerns. The same thing has happened with regard to battery safety issues with mobile phones recently.

The Internet of Things must not be allowed to turn into the Internet of Trouble. There are so many opportunities for IoT devices to contribute to society and the next wave of Internet usage.

Now is the time to ensure that attacks such as the Mirai based ones are not the future, but rather the past.

Independent:         Internet of Things: 2017 Predictions:

 

« German Spy Chief Fears Russian Interference In 2017 Elections
Was Donald Trump's Surprise Victory Hidden In The Data? »

CyberSecurity Jobsite
Perimeter 81

Directory of Suppliers

North Infosec Testing (North IT)

North Infosec Testing (North IT)

North IT (North Infosec Testing) are an award-winning provider of web, software, and application penetration testing.

ZenGRC

ZenGRC

ZenGRC - the first, easy-to-use, enterprise-grade information security solution for compliance and risk management - offers businesses efficient control tracking, testing, and enforcement.

Practice Labs

Practice Labs

Practice Labs is an IT competency hub, where live-lab environments give access to real equipment for hands-on practice of essential cybersecurity skills.

Authentic8

Authentic8

Authentic8 transforms how organizations secure and control the use of the web with Silo, its patented cloud browser.

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

BruCON

BruCON

Brucon is Belgiums premium security and hacking conference.

CyberSecurityJobsite.com

CyberSecurityJobsite.com

CyberSecurityJobsite.com is a specialist job board designed to attract candidates working within Cyber Security, Information Security or Information Assurance.

Cybercom Group

Cybercom Group

Cybercom offers strategic advice, testing & quality assurance, security solutions, system development, integration, management and operation services.

Nation-E

Nation-E

Nation-E offers innovative cyber security solutions for industrial installations, critical infrastructure and smart grids.

SecureAppbox

SecureAppbox

SecureAppbox provide solutions that protects the communication of sensitive data as well as advice on data security and compliance with GDPR.

Cyber Forensic & Investigation (CFI)

Cyber Forensic & Investigation (CFI)

Cyber Forensic & Investigation (CFI) is recognized as Thailand’s leader in cyber investigations and digital forensics.

Tenzir

Tenzir

Tenzir's primary focus lies on network forensics: the systematic investigation of cyber attacks with big data analytics.

Tracepoint

Tracepoint

Tracepoint provide full-service cyber incident response, remediation and recovery solutions for the most time-sensitive situation your company may ever face.

Enzoic

Enzoic

Enzoic is an enterprise-focused cybersecurity company committed to preventing account takeover and fraud through compromised credential detection.

ECHO Project

ECHO Project

The main objective of ECHO is to strengthen the cyber defence of the European Union, enhancing Europe’s technological sovereignty through effective and efficient multi-sector collaboration.

Dutch Institute for Vulnerability Disclosure (DIVD)

Dutch Institute for Vulnerability Disclosure (DIVD)

DIVD's aim is to make the digital world safer by reporting vulnerabilities we find in digital systems to the people who can fix them.

European Data Protection Supervisor (EDPS)

European Data Protection Supervisor (EDPS)

The EDPS is the European Union’s independent data protection authority. We monitor and ensure the protection of personal data and privacy when EU institutions and bodies process personal information.

Strivacity

Strivacity

Strivacity lets brands quickly add secure login and identity management capabilities to their customer-facing applications without tying up an army of developers or consultants to do it.

Millennium Corporation

Millennium Corporation

For nearly two decades, Millennium Corporation has been operating on the leading edge of cybersecurity.

Ironblocks

Ironblocks

Ironblocks is a pioneering cybersecurity firm that specializes in delivering comprehensive, end-to-end security solutions for the rapidly evolving Web3 ecosystem.

HanaByte

HanaByte

HanaByte is a security consultancy focused on delivering state of the art solutions in the cloud. We specialize in delivering cloud services with an emphasis on security.