The Internet of Things is offers a wealth of opportunity for the telecoms industry. It presents mobile operators a chance to develop and enhance their consumer offerings and increase market growth. Research suggests the industry will grow from $900 billion in 2014 to $4.3 trillion by 2024[i]. We’ve already seen the likes of Vodafone delve into the consumer side of IoT with the launch of its new “V by Vodafone” bundle, whereby consumers are charged for the number of connected devices they add to their monthly plan. However, alongside this raft of growth and opportunity comes the heightened risk of security breaches.
Operators need to be smart with their investment when it comes to IoT. It’s all well and good chasing new sales leads and initiatives, and reaping the rewards, but security needs to be high, if not at the top, of their agenda. More than 30 billion connected devices will be in use by 2025, of which cellular IoT—including 2G, 3G and 4G technologies – is forecast to account for about seven billion units[ii]. With the increased number of devices accessing the core network, operators need to ensure they plan for the worse and have prevention measures in place for possible hijackers. The repercussions of such a breach can have serious consequences for both the operator and end user, as any device hijack can be a potential entry point to the network for an attack.
Security attacks can come in all different shapes and sizes. One of the more common breaches is the “man-in-the-middle” concept, whereby a hacker is looking to interrupt and breach communications between two separate systems. This attack can have severe consequences as the hacker secretly intercepts and sends messages between two parties when they are under the belief that they are communicating directly with each other. Following this, the hacker can trick the recipient into thinking they are still getting a legitimate message. These attacks can leave the networks, and end-users, in a position of extreme vulnerability with regards to IoT, due to the nature of the devices being hacked. For example, these devices can be anything from industrial tools, machinery or transportation to innocuous connected “things” such as smart TV’s or connected fridges.
Another common treat posed to IoT networks are denial of service (DoS) attacks. There can be a host of reasons for the network being unavailable, but it usually refers to infrastructure that cannot cope due to capacity overload. In a Distributed Denial of Service (DDoS) attack, a large number of systems maliciously attack one target. In comparison to hacking attacks like phishing or brute-force attacks, DDoS doesn’t usually try to steal information or leads to security loss, but the loss of reputation for the affected company can still cost a lot of time and money. Often customers also decide to switch to a competitor, as they fear security issues or simply can’t afford to have an unavailable service.
To tackle these issues, it’s paramount that access to the IoT devices for the applications should be through a controlled and secure environment that first authenticates and authorizes the user/application before allowing access to the core. The first step for operators is to ensure any connection from the IoT device to the core network over S1 and Gb interfaces is fully authenticated. In order to do this, they must invest in and revisit the capabilities of their GTP and SCTP protocols, which will handle the hundreds of connections into the core network. Authentication can be delivered by the RFC 4895 for the SCTP protocol without compromising performance or network monitoring visibility like IPsec/VPNs do. This can prove vital as networks are subject to attacks with greater frequency and demonstrated disastrous outcomes.
Alongside a highly reliable SCTP protocol, operators should implement a DTLS module. Such a solution gives operators peace of mind that eavesdropping and network tampering is dealt with, as well as helping detect and fix real-time connection failures, redundancy and fault tolerance for signaling applications and improved destination and peer path failure. In addition, it can also resolve the issue of bottlenecking in networking due to Diameter signaling, by allowing the Linux host to provide thousands of associations and connections.
It’s clear that the IoT provides a wealth of business and marketing opportunities for operators. But to ensure it’s not a short-lived fad, security must be taken seriously. Attacks on the networks can have detrimental impacts on both the operators, who can have their reputation diminished in seconds if vulnerabilities are publicised, and end-users, whose devices, and therefore livelihoods, are at risk. Now is the time for the industry to lay down the foundations and realise the tools and protocols needed to secure the future.
[su_box title=”About Robin Kent” style=”noise” box_color=”#336588″][short_info id=’104741′ desc=”true” all=”false”][/su_box]
The opinions expressed in this post belong to the individual contributors and do not necessarily reflect the views of Information Security Buzz.