According to security experts, the connected cars, a poster child of IoT development also
struggle with a number of vulnerabilities. For enterprises, even the industrial SCADA systems
which are used to manage critical infrastructure have been compromised in a number of cases.
The insecure aspect of IoT is nothing new but the recent attacks have managed to bring it under
widen scrutiny and both all the stakeholders—manufacturers, cybersecurity professionals,
and clients—think of future implications in terms of cybersecurity. Following are some of the
practices which can help you to secure your IoT infrastructures.
Testing and Verifying of Code
In IoT environments, memory leaks and buer overflows are cited as among the most common
vulnerabilities of the Internet of Things’ source codes. C++ and C are mainly used to write the
code of IoT devices, due to their suitability for hardware programming while the smaller IoT
device size is another reason for their selection. Each programming language suers from its
own issues; the same can be said in the case of C and C++. Both of them are infamous for suer-
ing from memory leak and buer overflow vulnerabilities.
For example, the libsecurity-c project of IoT devices uses testing tools such as CLANG,
GCC, and Valgrind compilers to achieve formal verification, while using multiple layers to take
advantage of additional verification and testing.
More protection and verification methods are used for the prevention of buer overflows
such as the use of stack cookies, it is a data string (randomized in nature) which is used by appli-
cations to add into the stack prior to the instruction pointer register in which the data actually
overflows in the case of a buer overflow. Whenever the buer overflow happens, it causes the
stack cookie to be overwritten too. Hence, the application has to be then coded for the veri-
fication of the stack cookie string and match contents; in case it does not match, a terminate
procedure is initiated by the application.
Protect Devices from Identity Spoofing
It is necessary to protect IoT devices from identity spoofing. For this, you have to assess who
your device talks to and whether that device is actually a legitimate device or if it is some sort
of masquerade for hacking. Thus, your IoT devices should have their own unique identity.
Otherwise, hackers can enter your network and identify themselves as your IoT devices to fool
the network.
Usually, the configuration and management of unique identities for IoT devices have been
quite tough mainly because of their low-end and small chipsets. However, today, there are com-
panies like Rubicon which provide clients with a distinct identity for IoT devices of any size.
Such companies also oer security measures for secure identification of microcontrollers as
they don’t have any existing identity. Moreover, symmetric cryptography is also used to take
their security to the next level.
Assess Network Approvals
There are certain technological limits for certificate matching in IoT devices. Many of these
devices are too small and do not have the required space for certificate matching. Even
encryption-based identity matching solutions struggle from similar issues. Encryption is often
treated with too much trust while it is not possible to sandbox it. Cybersecurity experts are
Chapter 12 Holistic View on IoT Security 319
Internet_of_Things_CH12_pp309-326.indd 319 9/3/2019 10:16:43 AM
..................Content has been hidden....................

You can't read the all page of ebook, please click here login for view all page.
Reset