Recommended
More Related Content
What's hot
What's hot (20)
Similar to NUS-ISS Learning Day 2019-Complying with new IoT cyber security guide
Similar to NUS-ISS Learning Day 2019-Complying with new IoT cyber security guide (20)
More from NUS-ISS
More from NUS-ISS (20)
Recently uploaded
Recently uploaded (20)
NUS-ISS Learning Day 2019-Complying with new IoT cyber security guide
- 1. Complying with new IMDA IoT Cyber Security Guide #ISSLearningDay Mr. Ng Kok Leong, NUS-ISS 2 August 2018
- 2. #ISSLearningDay • Published in Jan/2019. • Google to download the PDF soft copy.
- 3. Agenda • Current efforts of IoT security guidelines • IoT: Brief definition • IoT ecosystem • IMDA baseline recommendations #ISSLearningDay
- 7. Microsoft Azure IoT Hub #ISSLearningDay Source: https://docs.microsoft.com/en-us/azure/iot-hub/iot-hub-security-deployment
- 8. Microsoft Azure IoT Hub #ISSLearningDay Source: https://catalog.azureiotsuite.com/
- 11. What is IoT? #ISSLearningDay IMDA IoT Security Guide states
- 12. 7 Categories of things (IoT Security Foundation) 1. Consumer domestic 2. Enterprise 3. Industrial 4. Medical 5. Automotive 6. Public agency 7. Critical infrastructure #ISSLearningDay https://www.iotsecurityfoundation.org/
- 13. Things with connectivity #ISSLearningDay Source: https://sg.element14.com/switch-on-iot-connected-lighting
- 14. Things with connectivity #ISSLearningDay Image: www.auzuranatural.sg
- 15. Things with connectivity #ISSLearningDay Image source: https://www.aboutkidshealth.ca/Article?contentid=980&language=English http://caifl.com/cardiac-devices/pacemakers/ https://www.sciencedirect.com/topics/nursing-and-health-professions/pacemaker-battery
- 16. Moving IoT: NUSmart shuttle #ISSLearningDay Source: https://www.straitstimes.com/singapore/transport/driverless-shuttle-on-trial-at-nus-starts-taking-passengers
- 20. IoT ecosystem: AWS IoT as illustration #ISSLearningDay https://www.amazonaws.cn/en/iot-core/
- 21. IoT ecosystem block diagram #ISSLearningDay https://qulsar.com/Applications/IoT/Industrial_IoT.html Device Network Application
- 22. IoT ecosystem block diagram #ISSLearningDay Device Network Application Short range Long range
- 23. IoT connects direct or via gateway to backend #ISSLearningDay https://thingsboard.io/fleet-tracking/
- 24. IoT connects direct or via gateway to backend #ISSLearningDay https://www.mdpi.com/1424-8220/18/8/2581/htm
- 25. End-to-End Encryption #ISSLearningDay Image source: https://www.intrinsic-id.com/markets/connectivity-ics/
- 26. IMDA Baseline Recommendations 11 clauses – 6 conventional IT security practice, 5 IoT specific. #ISSLearningDay
- 27. #ISSLearningDay Section 6: Baseline recommendations for implementation phase
- 28. What is constrained IoT device? #ISSLearningDay Image source: https://www.cisoplatform.com/profiles/blogs/classification-of-iot-devices
- 29. Classes of Constrained Devices (1) #ISSLearningDay Image source: https://www.cisoplatform.com/profiles/blogs/classification-of-iot-devices https://tools.ietf.org/html/rfc7228 IETF’s RFC 7228 classifies the constrained devices into 3 categories Examples of constraints:- • Processing power • Size of memory • Availability of power source
- 30. Classes of Constrained Devices (2) #ISSLearningDay Class 2 – not so constrained • Less constrained and can perform at par with mobiles phones / notebooks, supporting most protocol stacks. Class 1 – quite constrained • Quite constrained in code space and processing capabilities to employ full protocol stack such as HTTP, TLS. Hence, use IoT stack like UDP, CoAP, DTLS • Interact with other devices without the need of gateway. • Do not communicate with server. • Battery operated. • Take care of single sensor. Class 0 – too small to securely run on Internet • Constrains in memory and processing capabilities. • Use Gateway for basic communication need. Image source: https://www.rfwireless-world.com/Terminology/COAP-vs-MQTT.html
- 31. Constrained Device Class 0 – medical device #ISSLearningDay Image source: https://pdfs.semanticscholar.org/6a25/e93587dde53966b 3f0830ed9b78023c2cadd.pdf
- 32. Constrained Device Class 0 - pacemarker #ISSLearningDay Image source: https://www.aboutkidshealth.ca/Article?contentid=980&language=English http://caifl.com/cardiac-devices/pacemakers/ https://www.sciencedirect.com/topics/nursing-and-health-professions/pacemaker-battery
- 33. #ISSLearningDay Section 6: Baseline recommendations for implementation phase
- 34. #ISSLearningDay Section 6: Baseline recommendations for implementation phase
- 38. #ISSLearningDay 1. Identify the assets 2. Create an IoT system architecture overview 3. Decompose the IoT system 4. Identify threats 5. Document threats 6. Rate the threats
- 40. #ISSLearningDay Section 6: Baseline recommendations for implementation phase
- 41. Root of Trust #ISSLearningDayImage source: https://www.slideshare.net/linaroorg/sfo17-304- demystifying-ro-tfinallc-83555369 Root of Trust (RoT) is a source that can always be trusted within a cryptographic system. It generally includes a hardened hardware module.
- 42. How Raspberry Pi stores its data? #ISSLearningDay ARM Cortex A53 (ARMv8) inside Broadcom BCM2837 SoC
- 43. TPM (Trust Platform Module) #ISSLearningDaySource: https://en.wikipedia.org/wiki/Trusted_Platform_Module Source: https://docs.microsoft.com/en-us/windows/device-security/tpm/trusted-platform-module-overview
- 44. TPM (Trust Platform Module) #ISSLearningDaySource: https://docs.microsoft.com/en-us/windows/device-security/tpm/trusted-platform-module-overview Source: https://en.wikipedia.org/wiki/Trusted_Platform_Module Trusted Platform Module installed on a motherboard
- 45. In the context of constrained device, TPM is not a suitable solutions Recommendations include IoT gateways and IoT platforms… #ISSLearningDay
- 46. HSM (or TPM) in IoT circuit board #ISSLearningDay HSM
- 47. Use of ARM processor design #ISSLearningDay Image source: https://hexus.net/static/techdrive/?sf32731391=1 Fitbit Flex ARM Cortex M3 processor
- 50. ARM Cortex-M3: Pebble watch #ISSLearningDay https://community.arm.com
- 52. Who is ARM? #ISSLearningDay Image source: https://www.fudzilla.com/news/processors/40000-arm- cortex-r8-processor-design-is-out 1) ARM creates processor designs but it does not produce any physical products. 2) The technology (IP) is licensed to other companies who design and build their own processors based on ARM’s design, e.g. Texas Instruments, Samsung.
- 53. Cortex-Me sold by ST Microelectronics #ISSLearningDay digikey.sg
- 54. ARM Processors #ISSLearningDay Image source: https://www.arm.com/products/silicon-ip-cpu Cortex-M series for IoT
- 55. ARM IoT SoC solutions #ISSLearningDay Image source: https://www.arm.com/products/silicon-ip-cpu
- 56. Cortex-M Processor: Architecture #ISSLearningDay • ARMv6-M architecture • Cortex-M0, Cortex-M0+, Cortex-M1 • ARMv7-M architecture • Cortex-M3, Cortex-M4, Cortex-M7 • ARMv8-M architecture • Cortex-M23, Cortex-M33, Cortex-M35P ARMv8-M processor architecture differentiates from security perspective because it has “trustzone” technology
- 57. Trustzone Technology #ISSLearningDay Image source: https://www.arm.com/why-arm/technologies/trustzone-for-cortex-m
- 58. Trustzone Technology #ISSLearningDay Source: K5_Addressing_IoT_and_Embedded_Security_at_the_Chip_Level_Roni.pdf Creating isolation in single processor, resulting in one trusted zone and one non-trusted zone, which previously requires 2 processors to achieve.
- 59. Illustration of Isolation: trusted zone vs non-trusted zone #ISSLearningDay Image source: https://www.kwtrain.com/blog/network-security-zones Trusted zone Non-trusted zone
- 60. HSM – one secure zone #ISSLearningDay • HSM • Hardware Security Module • Tamper resistance • One secure zone in physical hardware - the HSM • The non-secure zone (application in another system) accesses its services by application interface. https://aws.amazon.com/cloudhsm/
- 61. Smart Card – one secure zone #ISSLearningDay • One secure zone – the smart card chip • Tamper resistance • The external host/application accesses it’s services by application Interface
- 62. ARM launches anti-tampering processor, M35P #ISSLearningDay Image source: https://venturebeat.com/2018/05/02/arm-designs-anti-tampering- and-software-isolation-into-its-processors/ Since M35p design was announced a year ago, no chip developer has announced any product yet.
- 63. #ISSLearningDay Section 6: Baseline recommendations for implementation phase
- 64. TLS (or SSL, which is still commonly known as) #ISSLearningDay Image source: https://www.cloudflare.com/learning/ssl/what-is-ssl/ https://yourshop.com/security-b19.html TLS: Transport Layer Security SSL: Secure Sockets Layer
- 65. TLS utilized by IoT #ISSLearningDay Image source: https://www.digi.com/videos/connecting-digi-xbee3-cellular-to-aws-with-mqtt
- 66. MQTT: Message Queueing Telemetry Transport #ISSLearningDay Image source: https://aws.amazon.com/iot-core/ MQTT protocol recommends use of TLS for more sensitive MQTT implementations
- 67. MQTT: a publish / subscribe protocol #ISSLearningDay Image source: https://www.hivemq.com/blog/how-to-get-started-with-mqtt MQTT protocol was invented by IBM back in 1999 for satellite communications with oil-field equipment.
- 68. #ISSLearningDay Problem: TLS is not lightweight • TLS adds additional two round trips to the start of every session • TLS certificates are large files, and device memory is limited in IoT
- 69. TLS v1.3 – improved version #ISSLearningDay Image source: https://blog.cloudflare.com/why-iot-is-insecure/ TLS 1.3 eliminates a complete round trip in the TLS handshake, which makes TLS much lighter and faster If the same IoT device talks to the same server again, there is no round trip at all, as the parameters chosen in the initial handshake are sent alongside application data.
- 70. CoAP: Constrained Application Protocol #ISSLearningDay Image source: https://www.rfwireless-world.com/Terminology/COAP-vs-MQTT.html CoAP was created by IETF. It was designed for use by constrained devices on constrained network (low-power, lossy networks).
- 71. CoAP utilizes DTLS #ISSLearningDay Image source: https://www.semanticscholar.org/paper/Lightweight- DTLS-Implementation-in-CoAP-based-IoT-Lakkundi-Singh
- 72. UDP is more lightweight than TCP #ISSLearningDayImage source: https://www.pubnub.com/blog/why-you-should-run-your- game-servers-separate-from-your-chat/ No ordering of messages No tracking connections
- 73. DTLS: session initialization not any lighter #ISSLearningDay Image source: https://blog.cloudflare.com/why-iot-is-insecure/
- 74. Problem: IoT Gateway breaks end-to-end encryption #ISSLearningDay Image source: https://cloud.google.com/iot/docs/how-tos/gateways/
- 75. Object Security for Constrained RESTful Environments (OSCORE) #ISSLearningDay • A method for application-layer protection of the Constrained Application Protocol, using object signing and encryption. (under Internet draft) • OSCORE provides end-to-end protection between endpoints communicating using CoAP. • Designed for constrained nodes. Image source: https://tools.ietf.org/id/draft-ietf-core-object-security-15.html
- 76. #ISSLearningDay Section 6: Baseline recommendations for implementation phase
- 77. #ISSLearningDay Section 6: Baseline recommendations for implementation phase
- 78. #ISSLearningDay Section 7: Baseline recommendations for operational phase
- 79. #ISSLearningDay Section 7: Baseline recommendations for operational phase
- 81. Data Diode, creating air gap #ISSLearningDay https://owlcyberdefense.com/learn-about-data-diodes
- 82. #ISSLearningDay Section 7: Baseline recommendations for operational phase
- 83. Over the Air Update #ISSLearningDay Image source: https://blog.particle.io/2019/05/09/ota-firmware-updates/
- 84. Over the Air Update #ISSLearningDay Image source: http://www.iphonehacks.com/install-ios-7-0-4-update-iphone-ipad https://searchmobilecomputing.techtarget.com/definition/OTA-update-over-the-air-update Previously, user needed to connect iphone to computer using USB cable to update OS through iTunes. With OTA, Apple can deliver updates remotely
- 85. #ISSLearningDay Section 7: Baseline recommendations for operational phase
- 86. Section 7: Baseline recommendations for operational phase #ISSLearningDay
- 87. In summary, the key words • Tamper protected hardware module • Hardware root-of-trust • Over-the-air update • Digital signature, encryption #ISSLearningDay