Addressing the threats of IoT Hans de Jong Technology Lead for - - PowerPoint PPT Presentation

# dSymp dcypher Symposium 2017 | Oct 4th Media Plaza Utrecht | connects cybersecurity knowledge

Addressing the threats of IoT

Hans de Jong Technology Lead for Security Innovation & Fellow Head of NXP Product Security Incident Response Team (NXP PSIRT) NXP Semiconductors, Eindhoven

# dSymp dcypher Symposium 2017 | Oct 4th Media Plaza Utrecht | connects cybersecurity knowledge

IoT, the upside

• Can make life easier and better
• Large market opportunity

# dSymp dcypher Symposium 2017 | Oct 4th Media Plaza Utrecht | connects cybersecurity knowledge

IoT, the downside

• It will only fly if security

and privacy are well taken care of.

– Otherwise people will not trust it and not buy it

• If security and privacy

are not taken care of, IoT can derail society.

# dSymp dcypher Symposium 2017 | Oct 4th Media Plaza Utrecht | connects cybersecurity knowledge

How to get attacked?

Logical attacks = rem ote attacks? Make use of software errors in the IoT device Physical attacks = local attacks? Make use of physical vulnerabilities in the IoT device

# dSymp dcypher Symposium 2017 | Oct 4th Media Plaza Utrecht | connects cybersecurity knowledge

How to get attacked?

Logical attacks = rem ote attacks? Make use of software errors in the IoT device Physical attacks = local attacks? Make use of physical vulnerabilities in the IoT device

No!

# dSymp dcypher Symposium 2017 | Oct 4th Media Plaza Utrecht | connects cybersecurity knowledge

What attacks to protect against?

# dSymp dcypher Symposium 2017 | Oct 4th Media Plaza Utrecht | connects cybersecurity knowledge

Aim to protect against any remote attack (logical & physical).

Reason: they can be scripted and executed by laymen.

Aim to protect against any local logical attack if an attacker can have local access. Same reason.

(Only needed if attacks can do more harm than to the attacker alone)

What attacks to protect against?

Make a trade-off between investment in the attack and value to be gained / damage done (at any point during the lifetime)

# dSymp dcypher Symposium 2017 | Oct 4th Media Plaza Utrecht | connects cybersecurity knowledge

What to protect

• Always protect integrity/ authenticity.
• Protect confidentiality when needed (often the case).
• Protect availability when needed.
• Protect privacy when applicable.
• Consider to protect against physical attacks – at least attacks

that may give attacker full control over the device.

– Boot protection – Lifecycle protection (avoid getting back to debug mode) – Protection of keys – Protection of usage of the keys (access control)

# dSymp dcypher Symposium 2017 | Oct 4th Media Plaza Utrecht | connects cybersecurity knowledge

Three Principles for IoT Security

• Protect the device as good as possible / necessary

– See previous slides

• * Assume it will be compromised during the lifetime.

 Make sure there is a way to recover the device.

– Without a truck-roll whenever possible.

• * Limit the attractiveness of hacking the device, e.g.

– Use diversified keys (different keys per device and per purpose): breaking one device does not break the system. – Limit the bandwidth for DNS requests

* The last two require a secure anchor in the device.

# dSymp dcypher Symposium 2017 | Oct 4th Media Plaza Utrecht | connects cybersecurity knowledge

Some other principles

• Take care of privacy when applicable (look at GDPR!).
• Strive to use isolation whenever possible.

– Run keys, crypto and essential functions on a different core.

• Make sure to be able to remotely update the device.

– Plan for enough capabilities (e.g. memory, crypto, processing) during the foreseen lifetime.

• As buyer: make sure that a security update service is

provided and the support lifetime is stated in the contract.

• End of security updates = end of life of the IoT device.
• Know the security of what you buy.

# dSymp dcypher Symposium 2017 | Oct 4th Media Plaza Utrecht | connects cybersecurity knowledge

Security certification – WHY?

How to know the security of w hat you buy?

Product A Product B Product A Product B

# dSymp dcypher Symposium 2017 | Oct 4th Media Plaza Utrecht | connects cybersecurity knowledge

How about IoT?

• Is security certification a solution for IoT?
• For smartcards (passports, drivers licenses, identity cards,

banking cards), there is Common Criteria certification

– Security lab evaluates the product for weeks and gives points for any attack found (e.g. for time, knowledge and equipment needed). – Attack with the lowest amount of points determines the security of the product. – When above a threshold, a Certification Body will issue a certificate.

• How about IoT devices?

– With fast product life cycles. – With many security updates during its life time.

# dSymp dcypher Symposium 2017 | Oct 4th Media Plaza Utrecht | connects cybersecurity knowledge

What does Common Criteria as a standard say?

Lab Cert Body CC for smartcards Lab Cert Body What CC allows What CC allows Private Cert Body CC for smartcards Public Cert Body

• Certification Body does not necessarily have to be a governmental entity
• Cert Body does not need to check everything the lab has done in great detail

# dSymp dcypher Symposium 2017 | Oct 4th Media Plaza Utrecht | connects cybersecurity knowledge

What does Common Criteria as Standard Say?

• CC evaluator work units are guidance and not mandatory
• No requirements how evidence is provided

CC for smartcards What CC allows Interviews / Workshops What CC allows Very formal documentation CC for smartcards

# dSymp dcypher Symposium 2017 | Oct 4th Media Plaza Utrecht | connects cybersecurity knowledge

What does Common Criteria as Standard Say?

• No requirements on which development methodology to use

CC for smartcards Waterfall Approach What CC allows Agile Approach

# dSymp dcypher Symposium 2017 | Oct 4th Media Plaza Utrecht | connects cybersecurity knowledge

Lean security certification for IoT

• CC Certification as applied for smartcards works for smartcards, but will not work for IoT. Expensive, static certification

that cannot deal well with product updates.

• A lean scheme for IoT can address the above mentioned issues as a Common Criteria based scheme by

– Set up of a commercial Certification Body

• Run by industry experts with a business understanding when operating

– For IoT, keep the product assessment by an independent lab, but let the paradigm of a static “one time assessment only” shift towards assurance via continuous oversight

• With a certain degree of freedom for updates
• Enabling vendors to perform security updates immediately within approved boundaries
• Requiring the vendors to continuously monitor their products and track vulnerabilities
• Requiring the evaluator to audit vendor security monitoring processes in certain time frames
• Requiring the evaluator to assess updates that are outside of approved boundaries

– Reduction of evaluation formalisms and tedious documentation

• Reducing efforts at vendors
• Reducing efforts at evaluation laboratories on formal aspects

# dSymp dcypher Symposium 2017 | Oct 4th Media Plaza Utrecht | connects cybersecurity knowledge

Should firmware be encrypted?

• Local physical attacks are not scalable, but ..

– When code can be taken from one device, it can sooner lead to finding remotely exploitable vulnerabilities. – Also consider brand damage and IP theft.

• Hence firmware encryption may be good to consider.

– Note that the key has to be on the device – So it is obfuscation – Makes attacks more difficult

# dSymp dcypher Symposium 2017 | Oct 4th Media Plaza Utrecht | connects cybersecurity knowledge

Is this promoting security by obscurity?

• We subscribe to Kerchhoff’s

principle, …

• …

but Kerchhoff did not consider millions of devices with fixed ROM code in the field which are not updatable.

– There always has to be some code in ROM

So, where are we exactly?

# dSymp dcypher Symposium 2017 | Oct 4th Media Plaza Utrecht | connects cybersecurity knowledge

Conclusions / Recommendations

• Security is essential for making IoT successful while protecting society
• Consider remote / local and logical / physical attacks

– Some always, some depending on value to protect – Scope: the entire life time of the device

• Make sure the device can be updated during its lifetime
• Stop using devices when no longer maintained
• Let governments and businesses for IoT devices that they buy demand

– An update service for security patches – A minimum period that devices will be maintained – Certified devices

• A CC certification infrastructure is needed that is appropriate for IoT

# dSymp dcypher Symposium 2017 | Oct 4th Media Plaza Utrecht | connects cybersecurity knowledge

QUESTIONS?