The Internet of Things (IoT) is a reference to the billions of connected devices that help to automate our increasingly complex world. But IoT can also disrupt or jeopardize our world if devices are not secured properly.
For example, a recent Kaspersky study found that more than 1.5 billion IoT devices were hacked over a six-month period from January to June of 2021 alone. While many of these breaches were aimed at “borrowing” the computing power of the device to mine cryptocurrency, other hacks allowed the devices to perform Distributed Denial of Service (DDOS) attacks via botnets, or even obtain confidential data.
Better IoT security is needed, but security is often an afterthought (if it’s even considered at all) for devices like smart toilets or pet food dispensers. But IoT encompasses more than just frivolous uses. Your Internet-connected thermostat, security camera, and equipment sensor can put every device in your home, office or cloud deployment at risk — including your workstations and virtual servers storing customer information or proprietary data.
Of course, bad actors only need to exploit one weak link to gain access to your network, from where they can move horizontally or vertically in order to find, steal and/or disrupt valuable resources.
Device and network service providers are on the hook to provide better hardware and network security, but those that provide the software that drives the devices also need to make security a priority. This article can help IoT software developers understand:
- IoT security threat categories
- How to mitigate IoT security threats
IoT Threat Types
According to recent estimates, there are more IoT devices in the world than people. That means billions of networked devices that:
- Need to be secured at every connection point within their network architecture.
- Need to be vetted to ensure misconfigured back doors haven’t unwittingly been installed.
- Need to connect to APIs that all-too-often have security issues.
- Need to ensure the security of their software supply chain.
- For example, Tech Target reports that a Python supply chain attack allowed an attacker to steal cryptocurrency.
Let’s take a look at each of these threats in turn.
Inadequate IoT Network Isolation
The way in which IoT devices connect to the rest of your network can increase or decrease your risk profile. In our highly interconnected world, one weak point provides an entrance for bad actors or malicious code to infect the entire network. The SolarWinds cyberattack is a notable example of accessing widespread systems through a single gateway.
To mitigate this risk, consider network isolation or segmentation to separate network-connected assets, usually based on function and trust level. Use VLANs to create silos of functionally-related devices, and a combination of firewalls and gateways to control access from one VLAN to the next. This kind of separation can help limit an attack’s blast radius.
Insecure IoT APIs
Application programming interfaces (APIs) provide a simple way for two applications to communicate and work together. Since IoT devices have limited processing and storage capabilities, they extensively use API software for data transfer, analytics, and communications.
But devices need to generate keys or other authorization codes to connect. Accidentally-exposed keys create an avenue for an attack. And since an API can connect many points in a network, it creates multiple instances for misuse.
Developers that use Python to create APIs for IoT devices should be aware of how quickly the code can become outdated. For example, the community no longer supports Python 2, leaving IoT devices programmed in Python 2 highly vulnerable. Additionally, minor versions of Python are regularly updated to address community-discovered vulnerabilities. But replacing the entire Python deployment on an IoT device is a non-trivial exercise, requiring extensive testing, prep work, downtime, bandwidth, and more.
Insecure IoT Software Supply Chain
The software supply chain for an IoT device is composed of both the proprietary and third-party code installed on the device, as well as all the processes used to import, build and run the code. Increasingly, third-party code is provided by open source software. In fact, the World Wide Web Consortium (W3C) reports that 91% of IoT developers use open-source software, hardware, or data in at least one part of development.
According to the Synopsis 2021 Open Source Security and Risk Analysis (OSSRA) report, 84% of examined codebases had at least one vulnerability, and the average number of vulnerabilities in a codebase was 158. Investigating, remediating, and redeploying fixes to these vulnerabilities can quickly overwhelm many IoT providers.
With networks comprising thousands of disparate devices, keeping track of configurations and updates becomes complex. Some organizations are not even able to identify all their IoT devices. Yet, maintaining a secure infrastructure depends on applying all patches and/or updates since the network is only as secure as the weakest link.
How to Mitigate IoT Security Issues
As we’ve seen, there are multiple potential security issues that can affect IoT devices. While hardware and network issues are best left to their respective professionals, developers can help mitigate security issues in software by starting with:
- Ensuring imported components are built securely
- Generating a Software Bill Of Materials (SBOM), because you can’t secure what you don’t know about
- Automating scans for vulnerabilities to avoid being blindsided
- Automating vulnerability remediation to decrease Mean Time To Remediation (MTTR)
1–Import Secure Components
Open source software is generally provided by a vendor or, more commonly, the open source community via public repositories. Unfortunately, public repositories do not provide signing for their pre-built components, which poses a security risk since there is no guarantee that they don’t contain malicious code.
Rather than importing built artifacts like precompiled binaries, consider either using a trusted vendor’s signed components, or else importing only source code from public repositories and securely building the components you require.
This is the process the ActiveState Platform favours: automatically building open source components from source code for Windows, Linux and macOS. Using the ActiveState Platform you can automatically generate your runtime environment directly from source code, limiting the possibility of introducing malicious code.
2–Create a Bill of Materials
Any software bill of materials these days will include open source components from third-party developers. Open-source codebases are vulnerable in two significant ways:
- Via malicious code checked into the public repository
- Vulnerabilities inadvertently coded into open source components
Both can happen outside of your control prior to importing the components.
To mitigate these issues, you first need to understand ALL of the open source components included in your code base, including their dependencies. Creating a Bill Of Materials (BOM) is the best way to identify and remediate vulnerabilities quickly. Without a BOM, you don’t know what you are looking for and can’t remediate it.
Keep in mind that some BOMs are more complete than others. The ActiveState Platform can provide you with not only a complete list of dependencies, but also transitive dependencies (which are dependencies of dependencies), OS-level dependencies and even C/Fortran binary dependencies, as well.
3–Scan IoT Libraries for Vulnerabilities
Most organizations already have a process and solutions in place to monitor their codebases for vulnerabilities and alert them when a vulnerability is discovered. This is a key step, but it’s only the start of the vulnerability remediation process.
4–Automate Vulnerability Remediation
While patches and updates may be limited, you still need to apply them when available. This responsibility can be challenging for an organization with many devices and/or codebases since the investigation, patch/upgrade, rebuild, retest and redeploy processes can be extremely time-consuming.
The only way to truly keep IoT devices up to date is to automate the vulnerability remediation process. For example, the ActiveState Platform enables you to resolve vulnerabilities and automatically rebuild the runtime environment in minutes. It’s a fast and auditable way to eliminate vulnerabilities in your runtime environment in a timely manner.
ActiveState Platform Helps Secure IoT
Insecure APIs, inadequate network isolation, and software supply chain vulnerabilities all put IoT devices, and consequently your business, at risk. Mitigating these issues requires a deep understanding of all the software components in your IoT devices, including their provenance (i.e., the origin of all the components), and all their configurations.
IoT devices powerful enough to run Python can benefit from the ActiveState Platform, an end-to-end solution for open source security and integrity. Using a solution like the ActiveState Platform helps you prevent and mitigate supply chain vulnerabilities by enabling you to automatically create custom Python builds, review and automatically remediate vulnerable dependencies, and quickly rebuild and redeploy a secure version of your IoT’s Python runtime.
Next Steps:
- Try the ActiveState Platform for yourself for free.
- Read about how to improve security with a BOM.
- Understand how the ActiveState Platform securely builds Python packages from source
Recommended Reads
Data Sheet: Improve Open Source Security With a Bill of Materials
Top 10 Trends in Python WebDev for 2021 and the resources to get started
Home Automation With Python: Beginner-friendly Python Project