Addressing the threats of IoT Hans de Jong Technology Lead for Security Innovation & Fellow Head of NXP Product Security Incident Response Team (NXP PSIRT) NXP Semiconductors, Eindhoven # dSymp dcypher Symposium 2017 | Oct 4th Media Plaza Utrecht | connects cybersecurity knowledge
IoT, the upside • Can make life easier and better • Large market opportunity # dSymp dcypher Symposium 2017 | Oct 4th Media Plaza Utrecht | connects cybersecurity knowledge
IoT, the downside • It will only fly if security and privacy are well taken care of. – Otherwise people will not trust it and not buy it • If security and privacy are not taken care of, IoT can derail society. # dSymp dcypher Symposium 2017 | Oct 4th Media Plaza Utrecht | connects cybersecurity knowledge
How to get attacked? Logical attacks Physical attacks = rem ote attacks? = local attacks? Make use of Make use of physical software errors in vulnerabilities in the IoT the IoT device device # dSymp dcypher Symposium 2017 | Oct 4th Media Plaza Utrecht | connects cybersecurity knowledge
How to get attacked? Logical attacks Physical attacks = rem ote attacks? = local attacks? No! Make use of Make use of physical software errors in vulnerabilities in the IoT the IoT device device # dSymp dcypher Symposium 2017 | Oct 4th Media Plaza Utrecht | connects cybersecurity knowledge
What attacks to protect against? # dSymp dcypher Symposium 2017 | Oct 4th Media Plaza Utrecht | connects cybersecurity knowledge
What attacks to protect against? Aim to protect against Make a trade-off any local logical attack between investment in if an attacker can have the attack and value to local access. Same reason. be gained / damage (Only needed if attacks can do done (at any point more harm than to the attacker during the lifetime) alone) Aim to protect against any remote attack (logical & physical). Reason: they can be scripted and executed by laymen. # dSymp dcypher Symposium 2017 | Oct 4th Media Plaza Utrecht | connects cybersecurity knowledge
What to protect • Always protect integrity/ authenticity. • Protect confidentiality when needed (often the case). • Protect availability when needed. • Protect privacy when applicable. • Consider to protect against physical attacks – at least attacks that may give attacker full control over the device. – Boot protection – Lifecycle protection (avoid getting back to debug mode) – Protection of keys – Protection of usage of the keys (access control) # dSymp dcypher Symposium 2017 | Oct 4th Media Plaza Utrecht | connects cybersecurity knowledge
Three Principles for IoT Security • Protect the device as good as possible / necessary – See previous slides • * Assume it will be compromised during the lifetime. Make sure there is a way to recover the device. – Without a truck-roll whenever possible. • * Limit the attractiveness of hacking the device, e.g. – Use diversified keys (different keys per device and per purpose): breaking one device does not break the system. – Limit the bandwidth for DNS requests * The last two require a secure anchor in the device. # dSymp dcypher Symposium 2017 | Oct 4th Media Plaza Utrecht | connects cybersecurity knowledge
Some other principles • Take care of privacy when applicable (look at GDPR!). • Strive to use isolation whenever possible. – Run keys, crypto and essential functions on a different core. • Make sure to be able to remotely update the device. – Plan for enough capabilities (e.g. memory, crypto, processing) during the foreseen lifetime. • As buyer: make sure that a security update service is provided and the support lifetime is stated in the contract. • End of security updates = end of life of the IoT device. • Know the security of what you buy. # dSymp dcypher Symposium 2017 | Oct 4th Media Plaza Utrecht | connects cybersecurity knowledge
How to know the security of Security certification – WHY? w hat you buy? Product A Product B Product A Product B # dSymp dcypher Symposium 2017 | Oct 4th Media Plaza Utrecht | connects cybersecurity knowledge
How about IoT? • Is security certification a solution for IoT? • For smartcards (passports, drivers licenses, identity cards, banking cards), there is Common Criteria certification – Security lab evaluates the product for weeks and gives points for any attack found (e.g. for time, knowledge and equipment needed). – Attack with the lowest amount of points determines the security of the product. – When above a threshold, a Certification Body will issue a certificate. • How about IoT devices? – With fast product life cycles. – With many security updates during its life time. # dSymp dcypher Symposium 2017 | Oct 4th Media Plaza Utrecht | connects cybersecurity knowledge
What does Common Criteria as a standard say? • Certification Body does not necessarily have to be a governmental entity Private Cert Body Public Cert Body What CC allows CC for smartcards • Cert Body does not need to check everything the lab has done in great detail Cert Body Lab Lab Cert Body CC for smartcards What CC allows # dSymp dcypher Symposium 2017 | Oct 4th Media Plaza Utrecht | connects cybersecurity knowledge
What does Common Criteria as Standard Say? • CC evaluator work units are guidance and not mandatory CC for smartcards What CC allows • No requirements how evidence is provided Interviews / Workshops Very formal documentation CC for smartcards What CC allows # dSymp dcypher Symposium 2017 | Oct 4th Media Plaza Utrecht | connects cybersecurity knowledge
What does Common Criteria as Standard Say? • No requirements on which development methodology to use Waterfall Approach Agile Approach CC for smartcards What CC allows # dSymp dcypher Symposium 2017 | Oct 4th Media Plaza Utrecht | connects cybersecurity knowledge
Lean security certification for IoT • CC Certification as applied for smartcards works for smartcards, but will not work for IoT. Expensive, static certification that cannot deal well with product updates. • A lean scheme for IoT can address the above mentioned issues as a Common Criteria based scheme by – Set up of a commercial Certification Body • Run by industry experts with a business understanding when operating – For IoT, keep the product assessment by an independent lab, but let the paradigm of a static “one time assessment only” shift towards assurance via continuous oversight • With a certain degree of freedom for updates • Enabling vendors to perform security updates immediately within approved boundaries • Requiring the vendors to continuously monitor their products and track vulnerabilities • Requiring the evaluator to audit vendor security monitoring processes in certain time frames • Requiring the evaluator to assess updates that are outside of approved boundaries – Reduction of evaluation formalisms and tedious documentation • Reducing efforts at vendors • Reducing efforts at evaluation laboratories on formal aspects # dSymp dcypher Symposium 2017 | Oct 4th Media Plaza Utrecht | connects cybersecurity knowledge
Should firmware be encrypted? • Local physical attacks are not scalable, but .. – When code can be taken from one device, it can sooner lead to finding remotely exploitable vulnerabilities. – Also consider brand damage and IP theft. • Hence firmware encryption may be good to consider. – Note that the key has to be on the device – So it is obfuscation – Makes attacks more difficult # dSymp dcypher Symposium 2017 | Oct 4th Media Plaza Utrecht | connects cybersecurity knowledge
Is this promoting security by obscurity? • We subscribe to Kerchhoff’s principle, … • … but Kerchhoff did not consider millions of devices with fixed ROM code in the field which are not updatable. – There always has to be some code in ROM So, where are we exactly? # dSymp dcypher Symposium 2017 | Oct 4th Media Plaza Utrecht | connects cybersecurity knowledge
Conclusions / Recommendations • Security is essential for making IoT successful while protecting society • Consider remote / local and logical / physical attacks – Some always, some depending on value to protect – Scope: the entire life time of the device • Make sure the device can be updated during its lifetime • Stop using devices when no longer maintained • Let governments and businesses for IoT devices that they buy demand – An update service for security patches – A minimum period that devices will be maintained – Certified devices • A CC certification infrastructure is needed that is appropriate for IoT # dSymp dcypher Symposium 2017 | Oct 4th Media Plaza Utrecht | connects cybersecurity knowledge
QUESTIONS? # dSymp dcypher Symposium 2017 | Oct 4th Media Plaza Utrecht | connects cybersecurity knowledge
Recommend
More recommend
