M2M Security Round Table

At our Wavefront M2M Waveguide Events over the last two years that have toured Montreal, Ottawa, Toronto, Calgary and Vancouver, one question surfaced in every city – yep “What about security when we start connecting everything to the enterprise?”… To which our industry partners represented from Deutsche Telekom‘s M2M Competence Center, Rogers and Sierra Wireless emphasized that weaknesses are mostly at the end points and not the cellular air-link AND that the level of security required is commensurate with what you are trying to protect.  Clearly, you don’t need much security to protect sensor data reporting the water temperature of a coffee pot or the internal temperature of a cow – taking from a couple of real world examples.  Yes, really!

Wavefront facilitated an M2M Security Round Table a little over a year ago now where we brought together operators of major infrastructures – BC Hydro SmartGrid and Port of Vancouver with industry vendor experts, Wurldtech, Elliptic Technologies, Sierra Wireless as well as BCIT to surface the issue, needs, approaches and some very telling stories to shed light on what I’ve dubbed – The InSecurity of Everything.

Here are some interesting and telling points from our M2M Security Round Table

1. Connecting all sensors – traditionally SCADA type devices with vulnerabilities – to the internet is giving an IP address to things that use to be secure because you could not access the wires that connected them – this is bringing cyber security concerns into the enterprise causing physical security to merge with cyber security in all organizations.
2. There are now statistics that show the level and frequency of attacks is on the rise but no one likes to talk about how they got hacked as it is damaging to reputation.
3. The business case for a Security Development Life Cycle or SDLC is generally based on maintaining operations and creating a need for “future-proofing security”.  The easiest way to stop a power generating facility for example, is to change the set point on an emissions sensor and the plant will shut itself down.
4. The business case for security around any major port is pretty simple in that most countries simply can’t afford to have a major port shut down.
5. The weakest link is often at the endpoints:  In early SmartMeter deployments, the optical ports on the meters – originally included to allow manual firmware upgrades – were compromised when businesses started up offering to reduce your electrical bill for a small onetime fee – a side channel attach.  The proliferation of all sorts of low cost connected widgets that operate on any number of various basic Linux operating systems have lots of back doors left wide open – our kids know how to take over these things.
6. Security elements are often included in systems design but the associated costs result in these measures being removed through the procurement processes that consider only the “cost now” and not “the total cost of ownership” – productivity loss that results from poor security practises is substantial.
7. Many hardware end points have the ability to support firmware upgrades after deployment, it is surprising the number of devices that never get updated – leaving back doors wide open.
8. People often know what they need to do but they don’t always do it.
9. The rate of threat attempts is increasing and most are unintentional so you need to think about being at risk even if you don’t think you are a target.
10. On distributed denial of service (D-DOS) attacks, these are often a bunch of kids with nothing better do.
11. A few D-DOS algorithms that can get into your IP camera can bring down your internal network by pinging your connected coffee pot or photo copier.
12. Not all threats come knocking on your hardened front door firewall but get in via a trusted employee who connects their BYOD to your network – behind your firewall.

Do what you know needs to be done – just don’t stop doing.