IoT security challenge: security monitoring and analytics

5.11 SECURITY MONITORING AND ANALYTICS

History shows that vulnerabilities are invariably found after a product is deployed – and often exploited in “zero-day” attacks. It is vital to be able to detect unforeseen vulnerabilities, anomalies and threats in live IoT deployments, and to respond quickly, recover and remediate. In performing these tasks intelligently and automatically, it is important to devise new paradigms of IoT security monitoring, incident management and recovery. Since IoT is by definition vulnerable, we need to monitor and analyse dataflows for advanced attacks, exceptions and other deviant behaviour. Furthermore, we should learn from discovered incidents, preferably in real-time, in order to define relevant anomalies and improve protection and detection. No matter how well defence measures are implemented, some threats will still get past even the best defences. Detecting such threats requires strong understanding of what the systems “should” be doing. Machine learning may help to find threats hiding in the noise of trillions of events generated every month.

5.11.1 Current Landscape and Recent Developments

State-of-the-art security analytics are developed by the Industrial Internet Consortium under the Industrial Internet of Things Analytics Framework273, which is intended for system architects, technology leaders and business leaders looking to successfully deploy industrial analytics systems. Although this framework has a business focus and not a security focus, it addresses the required building blocks for security monitoring and analytics.

Schonwalder274 proposed and investigated a distributed passive monitoring architecture for IoT. The architecture relies on the Routing Protocol for Low-Power and Lossy Networks (RPL), which was discussed in the previous section, to monitor the network in a lightweight manner. Higher-order monitoring nodes can passively listen to the network while participating in its operation. Monitored nodes do not require to be instrumented, nor do they need to dedicate resources to the monitoring tasks which are operated by the cloud.

Coordinated Vulnerability Disclosure

As ISO identifies275, inappropriate disclosure of a vulnerability could not only delay the deployment of the vulnerability resolution but also give attackers hints to exploit it. Vulnerability disclosure is a process through which vendors and vulnerability finders may work cooperatively in finding solutions that reduce the risks associated with a vulnerability. It encompasses actions such as reporting, coordinating, and publishing information about a vulnerability and its resolution. The goals of vulnerability disclosure include the following: a) ensuring that identified vulnerabilities are addressed; b) minimising the risk from vulnerabilities; c) providing users with sufficient information to evaluate risks from vulnerabilities to their systems; d) setting expectations to promote positive communication and coordination among involved parties. A strategy to deal with discovered threats and vulnerabilities includes a Coordinated Vulnerability Disclosure (CVD) program that balances security with the interests of manufacturers and stakeholders, as well as a clear understanding of liability. As discussed276 by US-CERT, CVD practices commonly lead to a strategy for Vulnerability Management (VM), which is the common term for tasks such as vulnerability scanning, patch testing, and deployment. VM practices focus on the positive action of identifying specific systems affected by known (postdisclosure) vulnerabilities and reducing the risks they pose through the application of mitigations or remediation such as patches or configuration changes. This is also discussed in the previous section on product lifecycles.

Data Classification

Combining the computing power available within the cloud with the vast volumes of data that can be generated by IoT, it should be possible to segregate bad actors, limit access to malicious parties, and integrate easily with third party logging and intrusion detection and prevention systems. Data will be collected within the cloud from a variety of data components in the IoT ecosystem. Some data might be highly sensitive, while other data might be relatively benign; a security monitoring framework should provide capabilities to classify data and to protect data based on its classification. Interface controls should limit access and exposure of sensitive data on the basis of classification.

Honeypots

A honeypot is a computer security mechanism that appears to be a legitimate device containing information of value but is actually isolated and monitored. A honeypot resource is never meant for legitimate use; therefore, any access to the honeypot resource is suspicious, and either accidental or hostile in nature. The attack strategies are recorded by the honeypot, and may include network traffic, payload, malware samples, and the toolkit used by the attacker. Some honeypots that are specifically geared towards IoT include IoTPOT278, Dionaea279, and ZigBee Honeypot. DutchSec's HoneyTrap offers an advanced system for running and managing honeypots.280

Security Event Reporting and Information Sharing

Detailed descriptions of IoT incidents, such as those provided by ENISA281, can be used as input for evaluations and validations of certain security measures. The analytics framework should operate in the cloud, given that most IoT devices are resource-constrained. This approach creates an opportunity to compare large volumes of dataflows and detect and react to malicious activities over millions of devices. For example, the Malware Information Sharing Platform282 (MISP) is an open source threat intelligence platform that provides open standards for Threat Information Sharing. This platform is built to collect and share large amounts of data including reporting and alerting solutions. Gateway-Based Monitoring The gateway is uniquely suited to monitor traffic to and from the cloud, and should support anomaly detection and integrate easily with existing anomaly and intrusion detection systems. A secure gateway might even support intrusion prevention capabilities to exclude suspicious actors from the ecosystem. A logging and reporting framework should allow the gateway to observe, baseline, and monitor communications traffic and component behaviour.

5.11.2 Key Findings

- Data collection and analytics for massive numbers of IoT devices is a major challenge.

– New metrics and methodologies are required to support IoT infrastructure analytics given the data characteristics of resource-constrained IoT devices.

– Monitoring and analytics capabilities should provide input for vulnerability management programs.

– In case vulnerabilities are not solved by the supplier, monitoring tools should be able to detect and disconnect vulnerable devices from the internet.

– The industry should act as a global community when learning from incidents. This requires an open culture of sharing incidents and mutual learning where security is a joint responsibility