The Internet of Secure Things: Vulnerabilities Beware!
By Rob Black, CISSP
I hope you are enjoying the summer as much as I am, and that you have some well-deserved time off ahead of you. But before you take off, I’d like to play out a security scenario with you. Imagine your company manufactures mission critical machines and a couple of days before you depart on your dream vacation you discover that 10,000 machines deployed across hundreds of customer locations have a software flaw, the result of which could be a serious security problem for your customers and a significant risk to your organization. The engineers on your team have developed a patch for the vulnerability. Do you:
- Send out an email advisory of the problem and hope that customers will download the patch while you are on vacation, and there will be no major headaches for customer support during your absence. (If this is the case, you should worry if you will have a job when you return.)
- Cancel your vacation and start copying the patch to thousands of USB memory sticks to be mailed out to every customer location. (If this is the case, that “well-deserved” vacation doesn’t seem to apply)
- Something else.
Given that you are reading a blog on an IoT and you are interested in security, I am betting that you picked c) Something else.
That something else is the IoT. The ability to connect to a machine is critical to being able to ensure that it is secure. An unconnected machine is one that is likely unpatched and therefore vulnerable.
While connecting to your machines is laudable, it is not enough. There are many components to a IoT project including the means to update the software, what we at Axeda call Connected Content.
Not only does your solution need to be aware of the version, the right steps to perform, what to do if an error occurs, but also needs to consider what network bandwidth constraints may exist. Unless your customers have unlimited bandwidth you might want to limit how many are being deployed at a given moment in time.
Now what if the machine is performing a critical operation like for instance “in surgery” literally opening up someone’s chest in an operating room? It might not be a good time to perform a software update. You need the ability to put the device into a mode that prohibits it from doing the update at that time.
Up to this point we have assumed that all machines were the same. What if machines have different configuration, different boards, different chips, different modules, or different software? Can the same patch be applied identically to all your machines? You need software that can differentiate between the various versions and apply the appropriate software.
Now that we have sent out updates to thousands of machines we need the ability to audit, monitor, and report on the results and identify any problematic machines that might need additional intervention. The software has to have the tools to track which machines were updated and which ones had problems that require manual intervention.
It sounds like a tall order for any solution to be able to meet all of these requirements. And it is. The Axeda Connected Content solution was designed for product manufacturers to be able to meet the rigorous requirements outlined above. Our customers that utilize Axeda Connected Content are able to update content on thousands of machines managing vulnerability fixes, other software updates, as well as pushing configuration data. You can learn more about how Axeda Connected Content is solving real world problems with ecoATM from the posted webinar.
With Axeda Connected Content helping to protect your machines you can enjoy your summer!