A day in the life of an IT pro: The scary side of IoT

The future worries me. Not so much in terms of global warming or the impending apocalypse, what I worry about is something more technical – the Internet of Things.

When I put my network engineer hat on, I’m concerned the combination of the Internet of Things (IoT) and software-defined networking (SDN) will lead to headaches, more accidents and restless weekends.

I’m usually one of the first people to research new technologies as they hit the hype-curve, however there are some significant gaps in SDN we must fill before rushing into automating even more IT departments. It is more than simply gaps in security, more that SDN is falling victim to being focused on its features, rather than critical security capabilities.

What’s not in the handbook…

Today’s sprawling networks can be difficult to work with, so for IoT to work we’ll have to turn the security approach we take with our networks on its head. Today’s networks are unapologetically sceptical, if not hostile, due to the vigorous security. Endpoints need to jump through countless hoops until they are allowed to add themselves to a network of their choosing.

However, IoT networks need to welcome and even actively assist endpoint connections. The competition for connections and finding methods to monetise the endpoint-to-network relationship is gaining momentum. The problem we are faced with is that the SDN being built today is based on automating the existing security model, and not taking into account the security model of tomorrow. Many will ask the question ‘how hard is it really to just modify software later on?’ – Unfortunately it can be very tricky.

Discarded endpoints

Connected thermostats, lighting and fridges are just the start of the era of IoT. The future world is full of disposable endpoints which are scattered like grains of sand – think connected LED lights at a concert which coordinate and synchronise by IP to turn the crowd into a huge lit-up display.

These devices are not created by just the big players in tech, but instead you will find that many will be made by generic offshore wholesale manufacturers. Although some of these will know the importance of security, I’m sure that in the interest of efficient and quick manufacturing, many won’t care about security patches at all. Imagine how many manufacturers of USB devices there are – then imagine them also churning out connected devices such as connected LED devices to use and then throw away. How will our networks cope with all of these disposable endpoints?

The cloud is at the end of it all

Nowadays, even the dumbest device can harness the perceived limitless power of enormous datacentres in the cloud. This in turn adds an entirely new security risk for enterprise networks.

Take music detection apps or Alexa as examples. They listen in the background, always on, but where does all that audio go? Consider even Siri voice search clips – who has access to all these clips of… you? Good and bad days, happy and stressed, with geo context. With an increased anticipation for virtual reality headsets and AI devices, wearable tech will become the norm – transmitting and recording information in ways we can’t ignore. Our shiny new SDN driven networks will need welcome the information with open arms, but securely, or IoT won’t reach its full potential.

SDN security needs to be tackled now rather than later

When tens of millions or even tens of billions of new endpoints enter our networks, they all look the same: HTTP:80/HTTPS:443 – Just like any web browser. This makes network managers vulnerable because it’s easy not to notice this flow in the torrent of other web traffic, and perhaps not remove misbehaving endpoints.

The network will have to constantly recalculate virtual endpoint trust credit scores based on behaviour and traffic fingerprints. With thousands or even millions of devices among the traffic, the network must be able to prioritise alerts for human intervention based on weighted risk assessments.

SDN will have to accomplish all of this while simultaneously defining and implementing a new security paradigm, achieving the same type of problem assessment abilities as a human and also replacing processing orders of more traffic.

This, combined with the common decision to ‘do security later’, is what worries me in the brave new world of IoT.

Patrick Hubbard, Head Geek at SolarWinds

Image source: Shutterstock/ a-image