When it comes to connectivity options for IoT solutions, WiFi, LoRa and Cellular connectivity are typically the most discussed options. Though it undoubtedly depends on the use case, traditional day-to-day WiFi is usually dismissed first–at least for any use cases other than consumer applications like the smart home. Though ideal for streaming video, for example, everyday WiFi is very impractical for anything out in the so-called customer field. That said, there is more to WiFi than what we use every day in a private or consumer setting.

Though they each have their pros and cons, WiFi, LoRa, and Cellular connectivity are all vulnerable to security risks and potentially serious consequences following a breach. Regardless of connectivity choice, focused attention should be given to considering robust IoT security features whatever the IoT solution.

An analysis of different short- and long-range wireless options based on their transmission characteristics when deploying an IoT solution at a customer site has provided us with several conclusions about connectivity. One conclusion is the general advantage of a cellular connection. But beyond the general benefits, what are the specific security benefits of cellular IoT connectivity compared to other connectivity options?

IoT Connectivity Options

Below we will review three of the most-used IoT connectivity options–WiFi, LoRa, and Cellular–and compare them from a security perspective. Specifically, we will compare the following four setups:

1. Shared WiFi: when deploying the device at a remote site, it can be integrated into the customer’s WiFi network
2. Dedicated WiFi: where WiFi routers are deployed together with the device(s)
3. LoRa Network: we will consider shared LoRaWAN networks (like Loriot or The Things Network) where the Gateway, Network, Join and LoRaWAN application server is offered by a provider, as well as dedicated LoRaWAN networks where these components are deployed by the customer
4. Cellular Connectivity: enables devices to be used at the edge, offering longer battery life and reliable connectivity

Comparison Based on Four Security Features

To begin, a quick snapshot below of how these four set-ups compare on four common security features:

Botnet Attack From a Compromised Device

There were 800 percent more Mirai attacks in the first half of 2019 compared to the first half of 2018. The Mirai malware has infected many IoT devices, creating a botnet that started distributed denial of service attacks on their victims. Worth noting (and perhaps unsurprising based on the above comparison chart) is that these IoT devices were mainly connected to the public internet or over shared WiFi and were able to reach any destination.

When choosing dedicated WiFi hardware, businesses should select routers with integrated firewalls that can be used to limit the number of IP addresses that the devices can reach, thus making it impossible for the device to attack another target or be commanded from a hacker’s control center.

LoRa devices cannot be directly reached and communicate with the Internet because they do not utilize the Internet protocol. LoRa devices can only talk to LoRaWAN applications to which they have been registered – and the management is done on the LoRa network server. 

While there are reports of the danger of LoRa devices being able to execute DDoS attacks against other LoRaWAN devices or servers, these cases are due to poor implementation or addressed in future LoRaWAN specifications.   

By using a cellular network firewall, IoT businesses can ensure that a device can only send data to its application target; thus, blocking all malicious traffic already on the network level.   

Remote Device Access 

Another vulnerability that the Mirai malware took advantage of is the unsecured remote device access of IoT devices on the public internet. Remote access is often necessary to do remote reconfigurations, retrieve data from the device and allow troubleshooting for support personnel. LoRaWAN does not have a concept for remote access and is therefore not judged on this feature.  

Using standard WiFi routers, the IoT device gets a private address and is not visible from the public internet.

Remote device access is activated using port forwarding (and with DynamicDNS in case of dynamic IPs)–which Mirai has been using to infect even WiFi IoT devices within the private WiFi network. 

With advanced WiFi infrastructure that allows setup of a virtual private network (VPN), remote device access can be secured – as only authenticated devices with the right VPN credentials will get access to the network. While this works with single, local deployments – managing multiple VPNs at different customer locations with the same private networks is challenging. 

Cellular connectivity with private static IP addresses enables simple remote access via one virtual private network across all customer locations. The devices are not visible from the Internet and can be accessed by a VPN connection to the mobile network operator gateway.  

Firmware Updates 

Remote firmware updates are a critical part of keeping device security up to date. Security vulnerabilities can originate from customer-owned device firmware bugs, as well as from 3rd party libraries. Updating the device can be challenging; the remote update process must be guarded against attackers while also guaranteeing an easy roll-back in case of error.

Due to the downlink limitation of 10 messages per day, LoRa can only be used for updating very simple devices and even then, the update process can take days to weeks to complete. Initially, updates were only possible device by device, but multicast support for remote updates over LoRa has since been specified. 

There are a wide range of solutions available for remotely updating firmware over Wi-Fi and cellular. Cloud platform providers like AWS, Azure and Google offer remote device management services, but there are also other providers like Balena or AV System.  

Abnormality Monitoring 

A central part in any security design is the ability to monitor for abnormalities. For all wireless connectivity technologies, the change of traffic log parameters can help to detect device tampering and serves as a safeguard against human error.

LoRaWan data is centrally managed within the application and network server – not only making payload data (e.g. the temperature measurement) available, but also important connectivity information like signal strength and packet loss.  

Standard WiFi routers have a basic set of traffic logs that provide limited visibility. To effectively monitor abnormalities, the WiFi router not only needs to support detailed traffic information but also to centrally monitor and manage multiple customer sites.  

With a cellular connectivity solution, detailed connectivity information, such as network signaling events and data volume, are available for all devices in real-time within the web-portal. This data can also be streamed to cloud platforms (AWS, Azure, Google Cloud) or third-party platforms (DataDog, DevicePilot) that already provide abnormality monitoring as a service. 

Summary

As shown above, installing IoT devices using the customer’s WiFi infrastructure comes with several security risks. For this reason, it is advised to use one network for IoT devices and a separate network for normal operations, in order to safeguard both device types from each other. This way, IoT devices can’t impact normal devices, and outdated personal computers on shared LAN, for example, can’t serve as entry points for IoT devices. 

LoRaWAN has very tight security concepts – coupling device to network and each application. It is best suited for low bandwidth applications, including in hard to reach locations, such as temperature sensors in a manufacturing setting. Often the LoRa gateways are connected via cellular connectivity to the public internet so data can be processed in a central place. 

Dedicated WiFi infrastructure and cellular connectivity are the most-used wireless technologies for industrial IoT. By using a firewall, remote access, firmware updates, and monitoring, IoT businesses can benefit from a comprehensive security feature already on the network level.  

For deployments at multiple customer sites and for mobile use cases, cellular connectivity not only provides seamless coverage but also makes it easier for an IoT service provider to manage the different installations. These are just two of numerous advantages of cellular connectivity over other options. Additional advantages are:

• Network coverage is available almost everywhere
• The device works immediately at the customer site
• No additional infrastructure and integration are required
• Low power technologies for pro-longed battery life (LTE-M/NB-IoT)
• Supports low and high transmission bandwidth in up- and downlink

The above advantages are quickly rendered useless in the event of poor security though. So, whatever connectivity option you decide is right for your IoT solution–make sure you take the recommended steps to robustly secure it.

Source: https://www.iotforall.com/iot-device-security-comparing-cellular-lora-wifi/

The adoption of Industrial IoT (IIoT) technologies by manufacturers continues to accelerate. By 2030, Accenture forecasts that the IIoT could add $14.2 trillion to the global economy. Already, manufacturers ranging from Harley Davidson to Rolls Royce have shown that connecting industrial assets’ Operational Technology (OT) systems to Information Technology (IT) systems can help streamline operations, reduce downtime, improve productivity, generate new revenues streams, and fuel innovation.

Unfortunately, many manufacturers have had difficulty charting a path to IIoT success. For example, in a recent report, Beecham Research published a survey of IoT adopters which found that 58 percent of respondents stated their IoT project was either mostly unsuccessful or not successful.

As these survey results show, while some manufacturers do reap significant benefits from IIoT applications, many others have found that developing and then scaling IIoT applications from proof of concept (POC) to commercialization is a project that is difficult to complete successfully.

Complexity: The Key Barrier to IIoT Success

What is the key reason why IIoT projects fail or are less successful than manufacturers hoped? Complexity. Specifically, infrastructure manufacturers need to successfully develop, deploy, and scale IIoT applications which require a broad set of expertise in a wide variety of complex subjects. For example, manufacturers need expertise in subjects including IoT hardware, embedded software, wireless connectivity, back-end cloud software, IoT protocols, and IoT cybersecurity (just to name a few) to build their own IIoT infrastructure.

How does this complexity manifest itself? Consider what is necessary when a manufacturer tries to develop the infrastructure needed for an IIoT application that will use edge devices connected to cellular wireless networks to collect and send data from a certain type of industrial equipment – for example, industrial air compressors to the cloud.

Manufacturing Complexities

First, the manufacturer requires expertise in a variety of communications protocols if it hopes to efficiently connect embedded modules, gateways, or other edge IoT devices to the OT systems of various types of air compressors. In addition, it needs to connect these edge devices to a Mobile Network Operator’s (MNO’s) cellular network while managing this connection in ways that minimize data transmission costs and, for battery-powered edge devices attached to these air compressors, energy use.

On top of these challenges, the manufacturer will need to build or find APIs that enable them to integrate their air compressor OT data into their cloud-based IT systems. It will also have to familiarize itself with edge device, network connectivity, and cloud security mechanisms, and use these mechanisms to orchestrate a “Defense in Depth” IoT security strategy that ensures that even if one of these types of security mechanisms is compromised, other security mechanisms will still be able to protect their IoT data from malicious actors.

These are just a few of the complexities manufacturers have to overcome as they try to build the infrastructure needed to support the development and launch of a new IIoT application that converges their IT systems with their OT systems.

Other infrastructure complexities raise their ugly head when the manufacturer moves to scale an IIoT project from POC or a local deployment to a global roll-out. The manufacturer now has to contract for connectivity from MNOs in all the countries where its air compressors are used – each of which has their own complicated IoT data pricing plans. For each network provider, the manufacturer also needs to physically install a different SIM in the edge devices connected to their air compressors. If they want to upgrade, improve, or otherwise change their IIoT application’s security or functionality over time, they need to figure out a way to remotely update firmware and rules in their edge devices.

Simplify IIoT with an Edge-to-Cloud Approach

How can manufacturers cut through this complexity and make their IIoT projects more successful? The cloud provides a clue on how they can solve this challenge. Manufacturers should stop trying to build and maintain all the infrastructure they need for their IIoT applications themselves. After all, they’ve already stopped trying to build and maintain all the infrastructure required to support the cloud-based IT applications they use to run their businesses today.

Rather than acquire the expertise needed to build their own IIoT infrastructure, manufacturers should look to adopt edge-to-cloud infrastructure solutions and services that have this expertise embedded in them. For example, today there are a variety of edge-to-cloud IIoT solutions and services available that can provide manufacturers with:

• The protocols they need to efficiently connect edge devices to their industrial equipment’s OT systems.
• Wireless connectivity services with pre-provisioned SIM cards for their edge devices that enable these devices to automatically connect to hundreds of cellular wireless networks located around the world.
• Data orchestration technologies that enable manufacturers to minimize the energy used by battery-powered edge devices, change their IIoT application as their business needs change, and automate the delivery of security patches to edge devices.
• Cloud APIs that make it easy for them to integrate industrial equipment’s OT data into cloud-based IT services.
• Security orchestration technologies that coordinate and automate the deployment of edge device, network connectivity, and cloud security mechanisms – allowing them to simplify the implementation and management of a robust Defense in Depth IoT security strategy that includes multiple layers of security mechanisms.

The cloud has already demonstrated the tremendous value that comes from abstracting away the complexity associated with IT computing, networking and storage infrastructure. With the cloud, manufacturers have been able to focus just on developing and deploying web applications that improve business outcomes.

Edge to Cloud Solutions

The same holds true for the IIoT – manufacturers should turn to edge-to-cloud solutions and services that allow them to focus on their IIoT applications and the data they generate, not the edge device, wireless connectivity, cloud APIs, and other infrastructure needed to support these applications.

Over the past decade, manufacturing and other companies have been able to use cloud solutions and services to develop and deploy web applications that have transformed their businesses – all without becoming experts in building complex cloud infrastructure themselves.

In the same way, over the coming decade, manufacturers should use new edge-to-cloud IIoT infrastructure solutions and services to simplify their IIoT projects. By bringing the lessons on infrastructure they have learned from the cloud to the IIoT, these companies can blaze a path to IIoT project success.

Source: https://www.iotforall.com/why-iiot-projects-fail/

It seems increasingly likely that remote working is set to stay in the wake of Covid-19, with leading brands such as Twitter having announced that its employees will be allowed to work from home indefinitely.

This trend is likely to prevail throughout the labor market too, with a report from Gartner finding that up to 41% of employees are likely to work remotely for at least a limited period post-COVID-19. This number has increased from 30% prior to the pandemic, and there’s no doubt that lockdown has forced brands to consider how their employees work best.

Interestingly, this trend is also impacting on a growing range of markets, with technologies such as the Internet of Things (IoT) empowering individuals to work remotely in fields such as manufacturing and healthcare. In this post, we’ll discuss some of the top IoT cybersecurity tips for stay at home workers.

1. Turn on Security Features and Use Appropriately

In the manufacturing space, IoT is enabling on-site teams to now perform some tasks from distributed locations. This typically involves the use of secure remote sensors, which monitor key on-site metrics and ensure that plants are able to operate safely and efficiently.

However, it’s interesting to note that many such IoT devices have security features that may be disabled or switched off, usually because this empowers ease of use from the perspective of workers. If you consider this alongside default security credentials that are never updated, creates a huge cybersecurity risk that puts sensitive and critical data at risk.

With this in mind, we’d recommend that you enable as many security features as possible when working from home, while also regularly updating your passwords and optimising the protections for individual devices.

2. Use Multi-Factor Authentication Where Possible

When working from home, you’ll have the opportunity to configure individual IoT devices on your home network. This enables you to deploy two or multi-factor authentication in some instances, which creates an additional layer of security by sourcing multiple user credentials from different devices (such as your smartphone).

Typically, multi-factor authentication will focus on a combination of numerical codes, passwords, and biometrics, and this can be particularly useful when accessing company laptops, (which are often provided by employers to allow for flexible working and seamless remote maintenance).

Even on a fundamental level, the ability to leverage multiple security controls as opposed to one can create more secure and robust login processes, while also safeguarding the huge swathes of data that are often collated and shared by IoT devices.

3. Read the Relevant Instructions

This may sound like an obvious observation, but it’s important to note that IoT devices are diverse and can feature a wide range of potential risk and vulnerabilities. With this in mind, you need to take the time to read the relevant instructions when setting up and configuring a new IoT device from home, in order that you can take the relevant steps to optimise security.

One of the key considerations is the specific purpose of the devices, and whether or not it includes features such as a microphone or webcam. Some may also come with default usernames and passwords, which will need to be changed the very first time that you power the device on.

In the case of a webcam, you may need to determine whether this is a necessary feature, depending on your location and the nature of the work that you undertake. If you do find that it’s something of an unnecessary luxury, we’d recommend disabling it through the device settings.

4. Shut Down Devices Before You Head Offline

We recognize that some IoT devices (particularly those charged with monitoring on-site processes and tools) may need to be switched on almost constantly. However, there are others that may have sustained periods when they’re not in use, and in this case, you’ll need to ensure that they’re shut down and switched off while idle.

This is important, as leaving devices switched on accessible when they’re not in use make them inherently vulnerable to hacking, abuse or cyber-theft.

You may decide that it’s enough to put a specific IoT device in standby mode, but this only serves to reduce risks rather than curtailing them completely. This is particularly true if the device in question has a security camera, so it’s far better to be safe than sorry and on the side of caution by enacting a complete shutdown wherever possible.

This is arguably more important for remote healthcare workers who often access and share electronic patient records, as every step must be taken to secure this type of data.

Source: https://www.iotforall.com/iot-cybersecurity-tips-for-stay-at-home-workers/