Cloud security challenges are only expected to be exacerbated by forecast growth in the internet of things.
A growing security threat in the telecom and cloud space is around the “internet of things,” which is forecast to eventually connect tens of billions of devices to the internet. These devices will each have their own specific IP address, which hackers could attack in order to gain access to network or cloud resources.
Recently, a massive distributed denial of service attack knocked out access to major websites including Netflix, Reddit, Spotify and Airbnb. As security experts have concluded, the attack was apparently carried out when bad actor(s) leveraged internet-connected devices including security cameras to overwhelm DNS company Dyn’s infrastructure.
Dyn translates web addresses into the IP information needed to connect a user with a site. The DDoS attack, which remotely used internet-connected devices to send such a large amount of traffic to a particularly site that it crashes, harnessed IoT devices to carry out the attack.
IoT security issues have been regularly raised by experts and continue to slow enterprise adoption. The causality is simple: the more devices connected to the internet, the more possible points of security incursion.
Glenn Fleischman, senior contributor to MacWorld, wrote: “These devices can be hijacked and that’s been happening lately on an alarmingly broad basis. Tens of millions to hundreds of millions of IoT devices have had malware installed that allows them to be remotely triggered as part of a ‘botnet’ used in a DDoS. A large portion of those are apparently [digital video recorders] and home and business security cameras.”
As a solution, Myk Konrad, VP of product management and marketing at Sonus, suggests industry-wide certification around IoT security, as well as a defined period of time in which OEMs or device sellers provide security updates.
“These IP addresses need to be secured,” Konrad explained. “The [session border controller] does still provide application layer assets and provides network layer protection for DDoS, but there has to be a virtual security blanket over the entire orchestration system.”
However, with such a diverse range of devices making up the IoT ranks, Konrad added standards for security remain a challenge.
“One big question for cloud security is what’s the communications standards that will be used to go back to the cloud,” Konrad said. “Some will use SIP because they might be a video device and need to relay both video and voice. That’s a place where you can stand up an SBC to encrypt that feed. … If it’s a cash register just passing back dollars or a thermometer that will be something different. You need to understand which protocol and that might just be something as simple as an encrypted firewall. That’s something that can be done at the device, but needs to be decrypted by a VNF in the cloud.”
Hewlett-Packard Enterprise laid out a multipronged approach to dealing with IoT security challenges, which placed a lot of emphasis on the device makers.
“We need to get IoT device manufacturers to take responsibility in delivering a secure platform,” said Simon Leech, chief technologist for security at HPE. “When they are developing these devices they need to make sure they are taking security into consideration. The cleaner the platform, the lower the risk of being attacked.”
Leech explained a basic consideration is to remove the default password from the devices as part of the set-up process, thus requiring a new password to complete the initiation process. This also leads into another recommendation around the need to educate the users of the devices that they need to understand the security aspects as part of the activation process.
For more on the topic of cloud security check out the latest RCR Wireless News feature report “Securing the cloud in the age of analytics and software.”
Bored? Why not follow me on Twitter
