Secure Enterprise IoT Platform
In the past 12 months here on CloudTweaks I have discussed some topics that were focused heavily on drones. In part because that is something that interests me, and in part, because I think there is a need for improvement in that space. Another area that remains of and in concern is that of security and the Internet of Things.
When I consider the name, the Internet of Things, I have a vision of a huge field filled with things, all connected and chattering to each other. Not all of the devices though have the same commitment to and around securing the data they produce. We can argue that the freely available bank thermometer we all recall from wandering through town over the years, is not data that requires significant security. If all the Government offices in the city used the bank as the only thermometer they trusted and heated and cooled buildings based on that; then we would need to secure that data. But for the most part, the bank thermometer merely presents information (temperature), and we check it, just to see how hot or cold it is.
That gets us to the essential security truth about the IoT devices around us, not all of them require security. But not all of them DON’T require security either!
Knowing that is useful in designing an IoT framework at the enterprise level. What devices generate data we need to secure. Now we can begin building an enterprise governance framework and operations framework as well. Two very fast buckets we can create are data that requires security and data that does not require security. Having these first two buckets also allow us to create two more operational buckets regarding device outages. Secure data systems, even if they aren’t producing data at the time can’t be offline (that could be tampering). Data that doesn’t require security then means if the device is down, we will get to it best effort it doesn’t require rapid responses.
The problem is devices change. Information that wasn’t critical and didn’t require security suddenly does. Now the problem is we cannot go out and secure all devices as much as we would like. That would create an operational nightmare. We have to be able to have a mesh system for IoT devices that would reduce the overall exposure.
The concept of a mesh network is similar to Microsoft’s Azure Fabric, or the AWS Lambda serverless or micro-services environments. The question is how could we do that in the IoT space. If we consider the concept of a micro-services environment in the IoT world, we could radically alter the security and communication stance of the IoT devices. First off, we could upgrade one drive in the mesh to the latest security solutions. It would then be the initial point of response by the mesh to an external security threat. The same is true of communication types. Devices with critical information have to get that information to an action body. I won’t say a human being, instead simply put something that can respond to the critical information the sensor has. Having an IoT mesh would allow us to have an IoT network that would have greater security and greater communication resilience. The concept of one device, one connection could be changed to 100 devices, 100 connections. Plus 100 responses to a security threat.
That means if your town wants to link all the thermostats in all city buildings to that bank thermometer they can. By simply adding the bank into the IoT mesh network or IoT fabric so that the data can be secured. It would also allow organizations to add or remove IoT devices easily. Organizations can now manage data and sensors based on governance requirements for both, rather than creating an environment where everything is secure (and less able to move), or everything is not secured (and more likely to fall prey to attack).
The mesh network for IoT devices will enable better security, and overall IoT communication resilience. As we move towards this brave new world, it will also reduce the cost of upgrading your IoT infrastructure as new security solutions are released. You only need to upgrade one, or two devices out of the 100’s you have deployed rather than every single device. It reduces the window of security risk, the vulnerability found, new device fixes released, new device fix deployed.
By Scott Anderson
