Navegando el estado de la seguridad del IoT para construir confianza digital

La confianza digital es esencial para la seguridad de cada elemento conectado, desde marcapasos y impresoras conectadas hasta el transporte y la infraestructura crítica. Y a medida que el uso de estos dispositivos IoT continúa expandiéndose exponencialmente, comprender las tendencias en la confianza digital nunca ha sido tan crítico.

With that in mind, Keyfactor and Vanson Bourne partnered on a report, Digital Trust in a Connected World: Navigating the State of IoT Security, which draws insights from 1,200 survey responses from two unique perspectives – those who design and manufacture connected devices/products (OEMs) and those who deploy and operate connected devices/products within their organization.

Ready to dig into the data? Ellen Boehm, SVP of IoT Strategy and Operations at Keyfactor, and Mitch Mershon, Product Manager for Emerging Markets at Keyfactor, sat down to discuss key findings from the report, including trends in IoT device identity and management, the prevalence and impact of security breaches, and the impact of industry standards on product development. Read on for a recap of their conversation, or click here to watch the webinar.

Estableciendo la confianza digital: Tendencias en la gestión de dispositivos e identidades IoT

First and foremost, it’s essential to start with the building blocks of digital trust: Every machine needs an identity, and every identity must be managed.

Traditionally, we think about identity management from the enterprise perspective, meaning server racks, laptops, and other devices on a corporate network. But we now live in a world of smart, connected devices that extend everywhere and to everyone, and each of those IoT devices needs an identity because each one represents an attack vector.

These modern devices can also be very complex, in some cases even a machine of machines. Think about a car or a plane – each has many different components with its own operational networks that can connect to the corporate network. In these cases, we have a machine with multiple identities inside it with its own broader identity that connects into a system.

So, how exactly does all of this work? First, you have manufacturers, designers, and developers that make an IoT device, whether a wind turbine, a train, a drone, or anything else. These OEMs handle efforts like security design, testing, certification, and identity provisioning. Once the device is produced and sold, it’s deployed into a facility such as a factory, hospital, or utility grid, where operators take over and manage service deployment, device health monitoring, and end-of-life decommissioning. Fortunately, both teams’ budgets for IoT device security will continue to increase year over year. According to our report, leaders expect a 45% increase in the next five years, which shows that IoT security is a priority investment for companies because they understand the risks it can have on the business if done incorrectly. However, 52% of that budget could be at risk if it needs to be diverted to handle cleanup after the fact, such as in the case of an outage or a compromise. This is notable because cyber attacks are on the rise.

Comprendiendo los riesgos: La prevalencia y el impacto de las brechas de seguridad en los dispositivos IoT

Las brechas de seguridad están aumentando y nadie está exento: casi todas las empresas ya han experimentado un ciberataque y las que no, probablemente lo harán en un futuro próximo. De hecho, el 89 % de los encuestados afirmó que los productos IoT de su organización han sufrido un ciberataque en los últimos 12 meses, y el 69 % dijo haber observado un aumento en los ataques a dispositivos IoT en los últimos tres años.

¿La razón de este aumento? El IoT se utiliza en todas partes: los encuestados informan de un aumento del 20 % en el uso de dispositivos IoT en los últimos tres años. Más dispositivos significan más identidades (tanto identidades más amplias para cada dispositivo como todas las identidades para las máquinas más pequeñas contenidas en él), lo que multiplica el número de vectores de ataque. 

For example, manufacturing used to be a tight, close-knit system, but now all the new machinery is connected with different sensors within each unit. Each of those sensors, plus the machinery at large, is an attack vector. Or consider the case of supply chain management, where one company talks to another and another and another, creating a chain. In both cases, operators must ensure they can trust every single identity and communication along the way to secure against attacks, even from seemingly innocent devices like an HVAC unit.

Y el coste de estos ataques no es insignificante:

• $236,000 is the average cost that companies have paid as a result of a breach in the past year because their IoT devices were able to leak data or someone was able to get in through a device into the network. Considering that number is from one year, it’s easy to imagine how that starts to add up over time.
• $2.3 million is the average cost for a certificate outage on a manufacturing line, meaning if a connected device tries to call a server, but the certificate is invalid, the factory line can no longer produce until the issue is fixed.

Tampoco se trata solo de dinero. Según los encuestados, las principales preocupaciones tras un ciberataque incluyen el daño a la reputación externa, la pérdida de datos de clientes, la pérdida de confianza de los empleados en la organización, las multas reglamentarias y la pérdida de ingresos.

En general, los encuestados coinciden en que la seguridad de sus dispositivos IoT necesita mejorar (88 %) para protegerse contra estos riesgos. Dicho esto, el 47 % de los encuestados cree que ya está haciendo todo lo posible para proteger su organización. Observando más de cerca, el 56 % de los encuestados está de acuerdo en que su organización no tiene la conciencia y la experiencia adecuadas para prepararse para los ciberataques a través de dispositivos IoT. Esa cifra salta al 59 % si se consideran solo las organizaciones que ya han experimentado un ciberataque, en comparación con el 27 % entre las organizaciones que aún no han sufrido un ataque.

Fortunately, even though attacks are rising and security is challenging, protection is possible. It requires having complete visibility into IoT devices and their identities, including the ability to quickly find those identities as needed and automate lifecycle management activities so that devices don’t go down and everything stays operational, even as certificates expire or become compromised. It also requires partnering with a company that has the proper expertise in IoT security to fill in potential gaps on the internal team.

Integrando la seguridad desde el inicio: Principales tendencias para que los OEM asuman la responsabilidad de la seguridad IoT

Centrándonos en los OEM, en particular, destacan tres tendencias en lo que respecta a la seguridad IoT:

1. Security must be at the heart of product design: OEMs understand that having proper security architecture from the beginning of product design is just as important as the electronics, functionality, and the software itself. That’s because if security isn’t done correctly, it becomes impossible to do things like send secure firmware updates remotely, activate new features, or upsell customers. As a result, more manufacturers are considering security from the beginning.

2. Third-party partners provide the expertise to implement security effectively: We’re also seeing more collaboration within the ecosystem as manufacturers realize they don’t need to develop everything from scratch. Now, OEMs are looking to implement best practices from across the field and work with expert partners to implement the best security possible. This approach is also essential as manufacturers think about how technology will change and how they can make their designs flexible enough to be used in the field for 10-15 years. According to respondents, the top reasons to partner with third parties include greater flexibility and cost from a resourcing perspective, the ability to gain complete visibility into hundreds of millions of device identities, and reducing internal workloads around a highly niche skill.

3. Security doesn’t end when the device rolls off the line: Security is not just about what the device looks like when it’s first produced. Rather, OEMs are responsible for security for the entire lifetime of the device. Think about a software update on an iPhone: When a user clicks “install,” the phone first validates that the firmware has a certificate. It does a signature verification before installing anything to know where the update is coming from and that it can be trusted. This ongoing verification is essential to security.

Todo esto es especialmente importante porque, por mucho que uno se prepare para una experiencia segura, las brechas de seguridad ocurren. Y cuando se produce una brecha en un dispositivo IoT, más del 70% de los encuestados cree que al menos cierto nivel de responsabilidad recae en el fabricante.

Con esto en mente, los OEM consideran que su principal responsabilidad (entre muchas) es la gestión del ciclo de vida de los componentes de ciberseguridad dentro de los productos. Otras responsabilidades importantes incluyen compartir una lista de materiales de seguridad o Software, revisar los sistemas operativos y proporcionar actualizaciones de Software.

Adopción de estándares de la industria: El impacto de las regulaciones en el desarrollo de productos IoT

Even with all the progress manufacturers and operators are making regarding IoT security, there’s still a lack of clarity around best practices. And that’s mainly due to the fact that regulations vary significantly from one country to another. Keeping up with these standards is another reason why partnering with third-party experts benefits OEMs.

Looking at the big picture, standards are becoming more common and having a much more significant impact on product development. For example, Matter’s open-source connectivity standard for smart home and IoT devices is one of the most recognized standards to come together over the past several years. The automotive industry has also led the way with various regionally-based standards.

Regardless of the industry, many manufacturers must make changes to meet these standards. If they don’t, they either can’t sell their product due to governmental regulations, or they’re missing out on part of the market thanks to consortiums like Matter. The fact that these regulations can now impact sales and market fit – not to mention that end users are starting to expect products to meet specific standards – has forced manufacturers to adjust how they do business, and that trend will only continue.

La seguridad IoT está evolucionando: los OEM y los proveedores deben mantenerse al día

El estado de la seguridad IoT ha cambiado drásticamente en los últimos años, y ahora estamos alcanzando un nuevo nivel de riesgo. 

As IoT devices become so much more prevalent across the entire world, they’re increasingly becoming attack vectors. At the same time, both manufacturers and users admit that they lack the proper expertise to secure these devices. Already, this situation has led to severe ramifications from breaches that extend well beyond immediate financial impacts, such as reputational damage and audit risks.

En respuesta, los OEM y los proveedores deben priorizar la seguridad IoT, integrándola desde el inicio y colaborando con expertos que puedan ayudar a subsanar las lagunas de conocimiento, mantener una conciencia adecuada y adherirse a los estándares nuevos y cambiantes. Cuando esto ocurra, las organizaciones estarán bien encaminadas para protegerse contra estos riesgos crecientes.