IT Security And Data Protection In The Internet Of Things

The Internet of Things (IoT) refers to the increasing networking of “smart” devices that communicate and interact  via processors and sensors via the IP network.

As an interface between the virtual and real-world, IoT systems also represent increasing added value for companies and are now considered a critical digital transformation technology. At the same time, the opportunities but also possible risks must be countered, and both must be weighed against each other. So how does the secure implementation of IoT devices in the company succeed?

The expert consultants for information security, IT security, data protection and infrastructure, know about the opportunities and security gaps of IoT devices and explain what companies should consider when it comes to IT security and data protection:

What Advantages Does The Internet Of Things Offer?

In contrast to classic (offline) devices, IoT devices offer the possibility of continuously sending the data they collect to the operator – even in real-time. Similarly, the operator can remotely control the devices accordingly. This enables remote maintenance function: characteristic curves, measurement parameters, or even operating software can be adapted and constantly updated for the respective application.

This results in more dynamic behavior, not just abstractly in distant data centers. Still, specifically on-site, where sensors collect data or actuators are supposed to carry out control and regulation functions. With appropriate programming, several IoT devices can exchange their data and react automatically to given environmental influences in the network.

In addition, manufacturers of IoT devices can continuously update and thus improve the functions through a permanent connection to the Internet in cooperation with the customer and – based on data obtained in the field. This can, for example, shorten the “time to market”,, i.e. the time until market launch, which in turn benefits users as the technology is more readily available.

What Is The Core Problem With The IoT In Terms Of IT Security?

Unlike traditional IT, IoT devices interact directly with their physical environment. Access to built-in sensors and actuators must therefore protect above all. Last but not least, privacy, health and possibly even life depend on it.

As the current developments show, the focus of attackers is now on mobile devices and IoT systems. The regular connection to an IT network via direct communication with the third-party cloud is problematic since devices with proprietary software and external access are located directly in the company’s network. In addition to access to the interfaces to the user’s physical world, this also offers manufacturers and attackers a potential gateway into local IT networks. To make matters worse, IoT devices, in particular, are primarily producing for the mass market. The result is that functionality will give priority at the expense of security to minimize manufacturing costs and “time to market”.

In the basic configuration, the user usually has no control over what data will record and transfer. Furthermore, the setting options on the part of the user are usually limit or non-existent. Mandatory safety standards are missing here; users depend on their audits. This affects several areas: data protection, data security and reliability. Even those who understand the risks usually have no means to invest enormous effort to prevent unwanted data transmissions.

Can Companies Use IoT For Themselves Despite The Security Gaps?

To use IoT sensibly for your company, time and other resources should carefully calculate to plan and implement its introduction sensibly. It is not sufficient to buy IoT devices and operate with the standard settings. Therefore, a healthy evaluation phase, which also includes whether the use of the IoT makes sense, is an essential part of the strategy. In the beginning, there is always the question: Which problems will solve with the IoT for which there is no other variant?

As with all other parts of the company’s IT infrastructure, the IoT could integrate into information security management. The risks of the IoT about IT security and data protection must specifically address. Suppose the company cannot do this when choosing an external service provider. In that case, care need to take to ensure that a security concept will create and implement.

What Should Companies That Want To Use The Internet Of Things Do Specifically To Protect Their Data?

As early as the planning and implementation phase, you should consider a few points and pay attention to technical details. This includes an evaluation before using the IoT devices regarding security and functionality. What tasks should the IoT devices ultimately perform? What services need to be accessible from the IoT devices? Are there special requirements for the availability of the IoT devices or the confidentiality. And integrity of the data stored or processed?

These general requirements result in further specific demands on the IoT devices:

• Authentication: 

Which type of user authentication should use? Is it necessary to set up users?

• Administration: 

How should the IoT devices need to administer? Are all settings locally, or should IoT devices will integrate into a central administration and configuration management system?

• Network Services And Network Connection: 

The network connection of the IoT devices should plan. Above all, necessary restrictions and monitoring measures should take into account.

• Logging: 

Logging also plays a vital role in IoT devices, such as diagnosing and eliminating faults or detecting and resolving attacks. It makes sense to determine how and at what times log data will evaluate as early as the planning phase.

Also Read: The Internet Of Things: Into The Age Of Networked Things