As the Internet of Things (IoT) continues to grow and expand into new industries, there remains a gap between device manufacturing and security. Security is often an afterthought, and viewed as something that can be added to the device later on rather than as a foundational element of the design.
A recent survey of IT and security decision makers found that 79% of companies include the IT department when choosing industrial IoT solutions, but only 38% consult their security teams. This can be problematic as 93% of respondents acknowledged at least one threat to critical infrastructure following an IoT implementation.
Getting security involved during the design phase won’t necessarily provide a competitive advantage – but you won’t be competitive without them. And when you’re working in a mission-critical field like medical devices for example, it’s actually non-negotiable. When a pacemaker fails due to lack of security, people die. Getting security right up front with efficiency, saving money at production, proving reliability, and driving trust with consumers are today’s competitive differentiators.
These threats can be avoided by integrating security with an IoT device during the design phase. Consider some benefits of this integrated approach:
Higher User Confidence
By prioritizing security in your IoT device design, you can instill more confidence in your users. While consumers have been trained to monitor their computer security, this has not been a focus with IoT devices. IoT device manufacturers will need to comply with the IoT Cybersecurity Improvement Act and educate consumers on the importance of regularly installing patches and updates, and reporting unusual activity.
Ultimately, it’s the end users who are sharing their personal, valuable information, and they need/want to know that all the right protocols have been put in place to prevent it from being compromised. Including security considerations from the outset , makes meeting these expectations a whole lot easier, and creates a greater sense of trust between a device manufacturer and its customers.
Business Discontinuity
Change is constant. Data retrieval and visibility into device activity can help keep business operations on track, as well as drive innovation and strategic planning efforts. IoT devices that are owned today may be sold or transferred to another party in the future. There are cases when a new manager is introduced to support a fleet of devices or an external partner obtains access to a system. Any change in business ownership or structure could result in the need to modify access policies within the IoT ecosystem – and bringing devices back to the manufacturing line for reprogramming is not an option.
Crypto-Agility of Devices
One of the biggest benefits of integrating security in IoT device design is ensuring crypto-agility, which is the ability to assess and make changes to cryptographic keys and digital certificates. When algorithms mature, when breaches are faced, when new research goes live – crypto-agility is especially important for IoT devices because they are out in the field for long periods of time. Incorporating crypto-agility is a lifecycle approach to IoT design and development that focuses on preventing a device from becoming at-risk or obsolete.
When security is integrated with design, your devices will be built to last. This includes over-the-air firmware updates, identify refreshes, access controls, and more to ensure everything remains current. So, no matter what changes occur with the device’s software, security will never be outdated or inhibit the device’s usability.
Start with Security
With cybersecurity as the top concern for companies adopting IoT, it only makes sense that security be integrated into device design. Security starts with device manufacturers and the vast supply chains in which they participate. When you take this integrated approach to design, you can get more life out of your devices and proactively prevent data breaches.
Contact CSS today to learn how we can help with your IoT security integration needs, or download the white paper, IoT Security for the Future:
