Critical Network Of Things: Why You Must Rethink Your IoT Security Strategy

In a world where hacking and denial of service are everyday threats, many feel that it is about time for the world of the Internet of Things (IoT) to undergo a reality check over its strategy and promotion before disaster strikes, reputations are lost and investors pull up stakes and run for the hills.    

What Is New About IoT?

Having made, lost and then re-made my fortune in and around the industry over the past 20-plus years, I cannot help but smile over the level of hype — and, as a certain US President would call it, “fake news” — surrounding the current world of IoT.

In spite of what the media and investors would like to think, IoT is not new. I can recall building all sorts of systems including AMR (Automatic Meter Reading/ Smart Metering) networks covering whole cities, pharmaceutical storage monitoring, on-line pest/rodent trap systems, trucks and trailer tracking, foodstuff refrigeration monitoring and land subsidence monitoring, just to name a few examples. They all followed the same basic architecture as we see with today’s IoT offerings, but under the label M2M (Machine to Machine).

So, what is the difference, or is IoT really a re-labelling of M2M? If so, why all the media and political hype over IoT now when it has truly been around for decades? Good question.

Risks Of IoT Networks

Many, including politicians, believe we are entering an era when everything around us will be monitored and controlled using the Internet. And just as in Social Media where there is volume, there are big bucks to be made. However, what is to stop IoT becoming just like social media, a market dominated by a few big players? Could the Cisco report published earlier this year that cited figures of up to 60% of IoT investments failing* at the Proof of Concept stage, be the tip of a much bigger iceberg and a sign that this has already started to happen?

Now let’s look at professional ethics, if there is such a thing, in the modern M2M – sorry, IoT – world? Just one look at the advertising and you will see my concerns and those of informed others over the numerous one-sided presentations in the market.  You don’t have to look far to see pictures and diagrams portraying aircraft, automobiles, trains, water supplies and similar applications being promoted without any “health warnings” for such safety-oriented and mission-critical applications.

There are also questions of privacy, security and who owns the data

Then there are concerns over the incumbent telecoms/cell phone players taking advantage of their masts to create IoT networks that vacuum up free-to-use public/shared radio spectrum to dominate networks for fees quoted as little as 5 Euros or dollars per year per point, which totally prohibits others from entering the market.

Privacy And Security Concerns

There are also questions of privacy, security and who owns the data? I have already witnessed the sinister side of IoT with data from my AMR systems being monitored by intelligence services, albeit for counter-terror use. However, data equally could be used by criminals to know if you are home or on vacation and much more.

Then there are DOS [denial of service] or DDOS [distributed denials of service], common terms in the world of Internet; however, this could become an everyday occurrence with wireless IoT jammers becoming commonplace and used to launch ransom attacks on networks. There would be little or no power of redress: Being license-free, it would in theory be possible to jam an IoT signal without breaking the law!

Competition Over Applications And Devices

With many IoT vendors prophesizing tens of millions of devices, will there be enough radio spectrum to go around? Further, it seems to have been forgotten that the vast majority of IoT devices will have to contend with each other and the emerging plethora of other applications sharing the same radio bands. Simply put, something ultimately will have to give, and what happens if somebody invents a new modulation scheme that upsets an existing IoT deployment?

Testability is another hot potato! If your IoT device goes offline, who do you call and who can you blame? I bet you will not get any answer from the aforementioned European vendor that currently offers the 5.00 € per point.

Critical Network Of Things

So, what is the Critical Network of Things and why do we need it? IoT with all its issues and weaknesses is more than satisfactory for the vast majority of applications. However, there are certain applications that deserve a much higher level of service, testability, security, accountability, privacy and ultimately have the ability to be fail-safe.

This is the basis of the Critical Network of Things, or CNoT as we have come to call it. How it works is for you to imagine as this is part of what makes it critical, however CNoT applications do exist and have actually existed for decades.

Four-stage Checklist To Assess Your IoT Strategy

In summary, before being sold down the river with IoT, you need to apply what I have coined the four-stage “Criticality Test.” Simply ask yourself:

1.  How valuable is your data?
2.  What happens if it doesn’t arrive?
3.  What are the consequences?
4.  And, finally, what would you say to your boss when you have invested just 5.00 € or $ a year on a service that may have just resulted in a 10 million € or $ fine for polluting the local river?