Securing the Internet of Things: Protecting IoT Devices and Data

Released by : Ines Kellou, Dhikra CHEBIRA and Hanaa BOUDINA

Introduction:

IoT — Internet of Things is one of many technologies in the winding door of inventions that we are witnessing in today’s world. It refers to devices that use the Internet, or other types of networks, to send and receive data. The components of these devices are designed to be able to handle everything from everyday household tasks to complicated technical processes. However, IoT devices are far from being infallible.

In the following, we will delve into the most common security concerns and threats surrounding IoT devices. From network security to data encryption and protection to privacy concerns, the problems that come with this technology are not to be taken lightly and should be addressed in order to guarantee safe and private usage.

IoT Network security:

To grasp IoT network security, it’s essential to understand the types of networks IoT devices rely on. The most common choice is WiFi due to its widespread availability in users spaces, making WiFi the most accessible choice of all, especially if the device is meant for the home, where all communications will happen over a short range without requiring a lot of power, which WiFi networks are known to be short on. This type of network is also favored for data-heavy transmissions, as there is no extra charge unlike cellular networks, another kind of way to connect IoT devices.

Of course, WiFi networks face a number of security risks:

• Evil twin attacks: in which an attacker learns the service set identifier (SSID) and radio frequency of a WiFi access point and is able to duplicate it, and then broadcast a stronger radio signal than the legitimate WAP to trick users into connecting to it instead. This means that the attackers are able to access sensitive data shared by the user over this false access point.
• Denial of Service (DoS) attacks: in which the network is flooded with traffic until it can no longer process regular requests from legitimate users. This results in making the IoT device unaccessible, rendering it useless.
• Man in the Middle attacks (MITM): in which a third party inserts itself into the communications between two other parties, thus intercepting the data exchanged between the two, rerouting it, modifying it, and possibly corrupting it. This can make IoT devices act up in unexpected ways, and not respond to usual commands or prompts.

As for cellular networks, they are generally agreed to be the safer option. Unlike WiFi, cellular networks enable encrypted connection by default, giving the average user secure connectivity. While it is less cost-friendly, it covers a wider range and thus makes communication possible over a large area, bigger than a home or an office space. However, they still remain prone to threats, namely DoS and MITM attacks.

Many IoT devices will also use Bluetooth networks to interact with each other. This works on a very short range, ideal for objects such as speakers, headsets, phones, earphones…

Bluetooth connections are especially sensitive to MITM attacks, as hackers can intercept information between two parties if authentication is flawed or not enabled. If the device’s Bluetooth is discoverable, it also makes it prone to unauthorized access by unwanted persons.

Encryption and Data Protection:

IoT’s pervasive influence comes with challenges, including illegal data manipulation and device hacking. For instance, sensor data can be falsified, leading to inaccurate analysis and control. IoT-connected device botnets are also exploited for DDoS attacks due to their lack of security updates. To address these issues, encryption regulations have been introduced, requiring the application of IoT encryption algorithms.

1. Symmetric Encryption: This method employs a single shared key for both encryption and decryption. Sender and receiver must agree on this key before secure communication can occur. Symmetric encryption operates as stream or block ciphers, providing speed and efficiency. Examples include AES, DES, IDEA, and Blowfish.
2. Asymmetric Encryption: Unlike symmetric encryption, asymmetric encryption uses a key pair: a public key for encryption and a private key for decryption. This approach enhances security through authentication. Top examples include RSA, DSA, ECC, and TLS/SSL. IoT architecture combines symmetric encryption for encryption and asymmetric encryption for decryption, effectively addressing security challenges in heterogeneous distributed systems.

Authentication and Authorization:

IoT devices must undergo authentication and authorization processes to access and exchange data. Authentication involves device identification, while authorization grants permissions. These processes enable role-based access control, ensuring that devices have access and permissions tailored to their specific requirements. It is essential to emphasize that both authentication and authorization are highly recommended for IoT devices to operate securely and effectively.

Privacy Concerns in IoT:

While IoT offers immense potential and convenience, it also brings a host of privacy concerns that demand our attention. As IoT devices become increasingly integrated into our lives, it is crucial to consider the implications for our personal privacy and data security.

1. Data Collection and Profiling: IoT devices often gather extensive data about users’ behaviors, preferences, and activities. This data can be used to create detailed user profiles, raising concerns about invasive monitoring and profiling.
2. Ownership and Control: Questions about data ownership and control arise. Users may not always have clarity regarding who owns the data collected by IoT devices and how it is used. This lack of transparency can undermine user trust.
3. Data Security: Security vulnerabilities in IoT devices can lead to data breaches and unauthorized access. Protecting data both at rest and in transit is crucial to prevent privacy breaches.
4. Location Tracking: Many IoT devices, such as GPS-enabled wearables, track users’ locations continuously. This raises concerns about the potential for location data to be misused or accessed without consent.
5. Data Sharing: IoT device data may be shared with third-party companies for various purposes, including marketing and analytics. Users often have limited control over who accesses their data.
6. Vulnerabilities and Unauthorized Access: Inadequate security measures can expose IoT devices to cyberattacks, leading to unauthorized access and data theft.
7. Regulatory Gaps: The regulatory framework for IoT privacy is still evolving, leaving gaps in legal protections. Users may have limited recourse in cases of privacy violations.

To address these concerns, it is imperative for stakeholders, including manufacturers, service providers, and policymakers, to take proactive measures:

• Transparency: Manufacturers should provide clear information about data collection, ownership, and usage policies, ensuring that users can make informed decisions.
• Security: Robust security measures must be integrated into IoT devices at both hardware and software levels to safeguard user data.
• Data Minimization: IoT devices should collect only the data necessary for their intended purpose, reducing the risk of excessive data exposure.
• User Control: Users should have granular control over their data, including the ability to opt out of data collection, sharing, and targeted advertising.
• Privacy by Design: Privacy considerations should be part of IoT device design and development from the outset.
• Compliance with Regulations: Manufacturers and service providers must adhere to relevant privacy regulations and standards.

In conclusion, while IoT technology holds great promise, addressing these privacy concerns is paramount to ensure that users can enjoy the benefits of IoT without compromising their personal privacy and data security.

Security Measures in IoT Devices:

To benefit from Internet of Things technologies, it is necessary to implement measures that secure the devices and make connectivity to them private and reliable.

One effective approach involves fortifying the network through which these devices communicate:

• For WiFi networks, we often encounter WiFi Protected Access (WPA) protocols and its later iterations (WPA2, WPA3). This protocol features individualized data encryption, meaning each connection between a node or device on the network is encrypted. In addition, new WPA protocols use simultaneous authentication, where two ends of a connection will conduct a handshake to verify the authenticity of the other. Modern WPA also provides robust protection against brute force attacks by limiting the number of times a user can “guess” a password. WiFi networks are also password protected, so choosing a strong password that isn’t used in other contexts is necessary to ensure the network isn’t breached by unintended parties.
• For cellular networks, many of the same concepts are employed. The Extensible Authentication Protocol for example also uses simultaneous authentication between the device and network, and WPA can be used to secure cellular-based internet hotspots.

Security Measures for Data Protection:

Data protection is at the core of IoT security. As IoT devices continue to proliferate, protecting the integrity and confidentiality of data becomes increasingly vital. Here are key security measures for data protection in IoT:

1. End-to-End Encryption: Implement strong encryption protocols to protect data both in transit and at rest. This ensures that data remains confidential even if intercepted by malicious actors.
2. Data Access Controls: Employ robust access control mechanisms to limit who can access and modify IoT data. Role-based access control ensures that only authorized individuals or devices can interact with the data.
3. Regular Security Audits: Conduct regular security audits and vulnerability assessments to identify and address potential weaknesses in IoT systems. This proactive approach helps prevent data breaches.
4. Secure Device Management: Implement secure device management practices, including secure boot processes and firmware updates. Ensure that only authorized updates can be applied to IoT devices to prevent unauthorized access.
5. Data Obfuscation: Utilize techniques like data obfuscation or tokenization to protect sensitive information. This makes it challenging for attackers to decipher the data even if they gain access.
6. IoT Security Standards: Adhere to recognized IoT security standards and best practices, such as those provided by organizations like the IoT Security Foundation. Compliance with industry standards helps ensure data protection.
7. Data Backups: Regularly back up IoT data to secure storage locations. In the event of a security breach, having a backup can prevent data loss and minimize the impact.
8. User Awareness and Training: Educate users and employees about the importance of data protection in IoT. Encourage strong password practices and awareness of potential threats.
9. Incident Response Plan: Develop a comprehensive incident response plan to address data breaches or security incidents promptly. This includes notifying affected parties and authorities as required by law.
10. Secure Data Transmission: Use secure communication protocols, such as HTTPS and MQTT with TLS, to ensure data remains encrypted during transmission.

By implementing these security measures, IoT stakeholders can significantly enhance data protection and mitigate the risks associated with data manipulation and breaches in the IoT ecosystem.

In conclusion IoT’s potential is undeniable, but its security challenges are equally significant. Addressing these challenges with comprehensive measures is essential to realize the full potential of IoT while safeguarding user privacy and data.