Seven Security Considerations for Smart Building Devices
A smart building or factory can contain thousands of Internet of Things (IoT) devices. The problem is not all of them are secure. So, does that matter? At Veridify, we believe it does. A flaw in a single product can expose an organization, its people and customers to enormous personal, financial, and reputational risks.
Smart Building Devices Should Have Security Built-in, Even if They Are Small or Resource-constrained
The challenge we face in securing the IoT is that it is diverse. It includes large industrial machinery and smaller, inexpensive sensors. The higher value products are typically managed directly by an individual. Low-resource devices, which are often deployed at scale in connected spaces, cannot easily be updated or maintained. However, they still perform vital functions and, therefore, require the same level of security and management as high-end devices. Despite this, in low-resource devices, security is often skipped.
To help original equipment manufacturers (OEMs) build more secure products, we are taking a close look at a smart building device and highlighting key features that help to protect the technology from the increasing number of cyberattacks. The capabilities outlined below reflect industry best practice and are included in the PSA Certified 10 Security Goals, a key part of the PSA Certified scheme that aims to reduce the barriers to IoT security, making it quicker, easier and more cost-effective to get secure products to market.
- Establish a Secure Connection Between a Device and an Owner
The number of connected devices that are being shipped every year continues to grow, as does the amount of data users collect on them. Protecting the data and ensuring the device only takes commands from an authentic owner is critical. We can do this by assigning a unique identity to the device and securing communication between it and the owner, aligning to the 10 Security Goals.
- Implement a Zero Trust Framework
All devices are inherently untrusted and must be mutually authenticated in order to communicate with other devices.
- Perform Vital Security Functions, using a Root of Trust
That includes critical device-to-device functions like authentication and data protection, and they should enable features including secure boot and secure firmware updates. Implementing a hardware-based Root of Trust creates a trusted environment in the silicon.
- Implement Zero-touch Provisioning To Help Speed Up Secure Deployment
Zero-touch onboarding enables mass IoT deployments by reducing the time it takes to onboard devices securely, while provisioning of data and configuration settings in the field help to ensure the product remains secure throughout its lifecycle, as mentioned in the Security Goals. Zero-touch features also lower the cost and time involved in managing ownership and maintenance over the lifetime of a device.
- Security Must Be Reusable and Scalable
The onboarding and chain-of-custody operations must be able to easily scale to hundreds, thousands or potentially millions of devices globally by building on a common hardware-based Root of Trust.
- Existing Systems Should Be as Secure as New Technologies
In a typical building automation setting where thousands of connected controllers and edge devices have to be protected, device-level security for new systems and the retrofitting of security to existing systems should be allowed.
- Protect Every Device in the System
In a building automation system, for example, security has to extend to every device – even the smallest IoT products and sensors. Small code size for security functions can help ensure all devices are protected and vulnerabilities are minimized, or utilize an external security gateway.
References: smart building security, OT security, IoT security
