Securing IoT-Enabled Automation in the Enterprise IT Workflow

Ashwin Ramachandra , VP and Head, Engineering R&D Practice, Sasken Communication Technologies

Ashwin Ramachandra , VP and Head, Engineering R&D Practice, Sasken Communication Technologies

One defining aspect of the new and evolved world is that a wealth of information will be driving the life around us. Simply called IoT or Internet of Things, this information will be enabled by billions of devices that sense and then connect. This will be true in the enterprise as well as in personal domains. While the benefits seem immense, there also lies the threat. In the cyber world, in all its simplicity, a stand-alone computing element remains safe. The moment it is connected and reachable, it opens itself to a world of malicious use and threats. IoT enables the march of information, but has a significant detractor in the guise of malware and threats.

The significant shift enterprises will see is that the IT function will be challenged in many ways. Productivity enhancing devices and policies that encourage use of individually owned products such as smart devices have already made their impact on IT. On one hand, it could mean that industrial command and control consoles would become more intelligent while on the other hand facility management will have new workflows that the IT function will have to enable. For example, highly automated plant workflows embracing robotics to further provide a productivity push will become a reality in the near future. This will mean enhancement to the number of sensors and connected devices that are currently deployed to monitor industrial workflow process – right from raw material to finished product. All this information gathered will go back to the central command and control consoles to enable better decision making.

The standard array of malicious attacks like denial of service, spoofing, taking over the host etc. which were hitherto seen on the Internet will make headway into industrial process management.

"The significant shift enterprises will see is that the IT function will be challenged in many ways."

Therefore, security must evolve and the IT function will have to respond to these new paradigms of devices. The state-of-the-art security is itself a journey in progress at the moment. Embedded chips have ‘secure’ execution modes. That in itself is not enough to ward off attacks. The software designed to run on these embedded chips will also need to be designed to thwart such attacks. There will be multiple approaches that will be implemented. Starting from encryption of information that is transmitted from these devices to necessitating presentation of credentials for enabling multi-factor authentication, these measures can only address threats arising out of account spoofing.

Denial of service attacks can be more severe in the world of IoT. The simple reason is that most edge devices will be designed to stay inactive for long periods, waking up only periodically or on an alarm to transmit a small burst of information. The design requirement comes for reducing power usage and therefore prolonging battery life. A malicious approach could continuously spoof alarms requiring the device to be awake constantly and therefore using up its power resources. In all of these situations, the central command server would be inundated with unwarranted information updates from misbehaving devices. Further, it would have no way to turn these devices off.

The next levels of threats pertain to the rich and extensive sets of data that are collected and collated. There are going to be millions of streams of data. Unauthorized access to these streams can expose the operating and competitive advantages of enterprises. Furthermore, these data streams can originate from sensors associated with enterprise human entities which increase the complexity of ownership of data. Everything is susceptible to threat from sensor and edge to smart devices and backend servers.

This further underscores the need to design devices that include stringent policy management mechanisms. These policy management mechanisms should have the flexibility of getting the device to implement specific procedures when it is required to operate outside the normal operating parameters. These procedures could include constant credential exchange as well as override procedures for the central server to reset or turn off misbehaving devices.

In summary, it is clear that the world of IoT will bring immense benefits. At the same time, it will offer a plethora of opportunities for malicious use. The IT function in every enterprise will need to be aware and prepare for installing, enabling and monitoring billions of devices. The task will be of a greater magnitude than what they are handling at the moment. This will also mean increased automation of IT workflows, but with strong security mechanisms built in from the start. Only an alert and evolved IT function can enable the unforeseen benefits of the IoT world.