This presentation aims to create awareness for IoT device makers on the various aspects they might encounter with their products. Security challenges which need to be addressed are listed to try to guide developers along the right path.

1. Embedded/IoT Product Life-Cycle
Why the Secure Development Life-Cycle Sucks
Oliver Meili @oooohhhmmy, null SG, 2016-01-19

2. Agenda
• Embedded Devices and the IoT
• Product Life-Cycle
– Development
– Sales and Deployment
– Operations and Maintenance
• Security in the Product Life-Cycle
Oliver Meili @oooohhhmmy

3. Generic IoT Architecture
Thing
Cloud
Thing
Thing
Gateway
Big
Data
Little
Data
Device
Mgmt
Analy-
tics
Visuali-
zation
Oliver Meili @oooohhhmmy

4. The Thing
• Your Fridge, Washing
Machine, Sensor on an
Assembly Line
• Software built by ageing
(mechanical, electrical)
engineers who are experts
in
– Interfacing the electronics
with the physical world
– Dealing with limited memory
(16+kB ROM, 1+kB RAM)
– Dealing with real-time
constraints
– Reliability
Based on Small Microcontroller
8-bit, 16-bit, 32-bit (Cortex-M)
No or Embedded (RT)OS
FreeRTOS, TinyOS, Contiki OS, RIOT-OS
Low Power
Sleep Modes
Interfaces with Physical World
Connects Sensors
Network Interface
BLE, 802.15.4, WiFi
Oliver Meili @oooohhhmmy

5. The Gateway
• Your Home or Industrial
Router
• Often based on OSS and
third-party components
• Software built by
software engineers
• Needs to support new
functionality
– Device Management
– Key Management
– New wireless interfaces
Based on Large CPU
32-bit (Cortex-A, Intel x86)
Powerful Embedded OS
Linux, Windows (CE), QNX
Low Power
Sleep Modes
Separates the Things from the Internet
Might be an Application Gateway
Network Interface
WiFi, Ethernet, 3G, 4G
Oliver Meili @oooohhhmmy

6. Product Life-Cycle: Development
• Consists of mechanics, electronics and software
– They have to work together!
• Can take several years, depending on complexity
– Products exist in various variants and with tons of configuration
options
• Software is becoming more and more componentized
– Third-party and open-source components
• Testing is very difficult
– Need to test real world interfaces, unknown conditions
Development
Oliver Meili @oooohhhmmy

7. Product Life-Cycle: Development
Development
• Hardware-in-the-Loop Testing
– Simulating the real world, functional testing
Oliver Meili @oooohhhmmy

8. Product Life-Cycle: Development
Development
• There is an embedded way of writing software – everything is static
– No heap/memory allocation to improve reliability
– Software is configured statically, i.e. OS tacks, stack size, features
• Firmware contains very few parameter checks for efficiency reasons
(runtime and code size)
– Parameter checks only activated during functional testing
• Modern Things have a network interface!
– Firmware engineers know little about networking protocols and very
little about security
– Integration of lwIP or mIP, maybe (D)TLS
Oliver Meili @oooohhhmmy

9. Product Life-Cycle: Sales
• Embedded products stay on the market for years
– How often do home appliances get refreshed in stores?
• For more complex products, there is a provisioning step
when deploying a device
– Someone needs to configure the Thing before it can be used
• Reliability is often more important than the number of
features
– Extreme case: air traffic control
Sales
Oliver Meili @oooohhhmmy

10. Operations & Maintenance
Product Life-Cycle: Operations
• Embedded products stay in operations for a very
long time
– Cars reach an average age of 13 years
– How often do you exchange home appliances?
– How old is the oldest MRT train in Singapore?
• Spare parts need to be available
– Components (mechanical/hardware) will be reused
– Not just software bits ;-)
Oliver Meili @oooohhhmmy

11. Operations & Maintenance
Product Life-Cycle: Operations
• Traditionally there are no or only very few software
updates
– This is changing drastically with connected devices
– And no security management
• Any update requires re-testing
– Use of huge test equipment, old software
– Upgrade of third-party software is a big risk
• Requires detailed analysis of changes in components
Oliver Meili @oooohhhmmy

12. Operations & Maintenance
The Product Life-Cycle
• Embedded Products
– Take years to develop
• Verification is one of the hardest tasks to do
– Are sold for a considerable amount of time
• How long do you find a new car model for sale at the dealer?
– Are in operations for a very long time
• When was the last time you bought a new washing
machines?
Development
Sales
Oliver Meili @oooohhhmmy

13. Security Requirements
• Things in foreign lands
– Developers don’t know the Thing’s environment and it’s
not going to be a well protected network (IPv6 instead of
NAT, firewalls?)
• Enterprise integration
– Identity and key management, authentication, logging
• Minimizing attack surface
– Does every Thing need a webserver, a shell and other
ports open?
• Things need identities
– And they need to be managed
• Over-the-air (OTA) update is a must!
Oliver Meili @oooohhhmmy

14. Security Challenges
• Threat modeling?
– Physical security: theft of parts and Things
• Secure architecture and design?
– Integration into enterprise solutions (auth, PKI, …)
– Logging on small devices, anyone?
• Secure coding?
– Input validation!
• Understanding of security concepts?
– “just disable feature XY and it will work”
– “some even enable firewalls on gateways!”
– “security has to deal with protocols”
Oliver Meili @oooohhhmmy

15. Security Challenges
• Documentation of software components?
• Examples or demos of third-party software?
• Verification and validation
– Working test environment for the whole product
life-cycle, particularly during maintenance
• Vulnerability management?
– Internal and external vulnerabilities
– For the whole product life-cycle
– Disclosure!
Oliver Meili @oooohhhmmy

16. Conclusion
• Things in the Internet of Things sometimes live a
very long time
– Think multiple decades
– Testing and maintenance are the tough part
• Developers are not always up to the task to
implement security
– There are still mechanical engineers writing firmware
• Configuration management is crucial
– Manage variants and vulnerabilities
Oliver Meili @oooohhhmmy