IoT Security

The Key Ingredients for Success

 1. Securing the IoT:
Understanding the Landscape
1.1 Introduction: The Importance of In addition, it is critical that the value, efficiency or utility derived
from the processing of multiple data repositories and actions is
IoT Security based upon reliable data.
The IoT (Internet of Things), projected by Juniper Research to reach
an installed base of 64 billion units in 2023, has been heralded 1.2 White Paper Scope
as a revolution in the way that businesses and society will function. For some businesses, particularly those which could be
The IoT is the concept of providing a connected digital identity considered as newcomers to the core concepts of the IoT, the
to physical objects and networking those identities and their data burden of avoiding IoT cybersecurity pitfalls can seem daunting.
together. Analysis of the data that these objects produce aims to As a whole, the complexity and lack of widespread, established
improve quality of life, efficiency, create value or reduce costs. best practices in the industry create unique challenges where
However, in tandem, questions over data responsibility, cybersecurity is concerned.
governance and security give rise to new hurdles. In a Thales-commissioned survey conducted by independent
Consider a smart commercial building: in such a highly connected technology market research specialist Vanson Bourne (known
building, one can conceive of a connected smart meter, IP- henceforth as The Thales Survey), it was found that 94% of
connected security cameras, as well as software-controlled lighting enterprise decision makers saw challenges in implementing IoT
and door access. Where these systems commonly connect to a security, with just under half (44%) of those respondents citing
building hub, there is a pathway for any data to travel from a cost as a key concern.
device inside the building to any other connected device. These In the light of the challenges posed by security complexity
connections and pathways, when functioning as expected and and cost, this White Paper - developed by Juniper and Thales
reliably, offer the building owner improved efficiency and security. together - will aim to demystify the factors required to deliver a
On the other hand, should a cybercriminal somehow take successful IoT strategy.
unauthorised control over any device in that network, the very same In addition, it will seek to demonstrate how businesses can
pathways that offer the building owner value and convenience can deploy their IoT solutions securely, at a cost that is ultimately
be abused. For example, were the smart meter’s security breached, beneficial for the company in question.
an attacker might feasibly have access to the security camera
feeds, allowing him/her to observe when the building is empty. 1.3 An Overview of the IoT Ecosystem
It is clear that protection of even seemingly innocuous devices The IoT is composed of an array of devices, software and
is important to the overall security of the IoT. This is even more communications protocols that function as a whole together. The
apparent when one considers that the IoT reaches well beyond figure below highlights the numerous elements in the IoT ecosystem
the home, into businesses and industrial operations. and presents security considerations that apply to each.

Figure 1: IoT Ecosystem Element Characteristics & Security Considerations

IoT Characteristics Potential Security Weakness & Targets

 Closed/open platforms  Code

Web & Mobile Application  Variable policies  Lack of penetration testing
 High data volume handling  Weak User/Third Party Authentication
Diverse data types
and computing
 Public/private/hybrid  Code power among the
Cloud
cloud deployment  Policy management IoT devices means
that there is no ‘one
 2G, 3G,LTE, 5G size fits all’ solution
 DSL, Fibre, LPWAN to protecting the
 Insecure communications
Communications  Wi-Fi Bluetooth security of an IoT
 MQTT, IP, ZigBee, Mesh RF, Wi-Fi ect deployment.

 Policy management Each element in the

Gateways /  Variable communications protocols  Denial-of-service ecosystem comes
Smart Edge  Time-Sensitive data analysis  No / insecure updates with its own security
Devices  Poor hardware design challenges.

 Design faults Strong security

 Limited power
 Software / firmware implementation
IoT Sensors / Actuators  Low bandwidth
implementation faults will consider each
 Constrained capabilities
 Inability to update element carefully
and the ecosystem
 Sensitive data: video, audio, location, holistically.
 Users
Data Types personal information
 Policy management
 Technical data: environmental
 Data storage
Source: Juniper Research measurement, uptime reports
2
1.4 The Objectives of Security Figure 2: IoT Device & Application Security Pillars

What does a cybersecurity solution aim to achieve? The primary

objective is to reduce risk to the business, ensuring that:

 
The data and information generated is confined to the users and Confidentiality
systems that are authorised to access it;
Unauthorised access to devices, applications and data is
 
The data and information generated can be trusted; prevented

 
The service continuity is maintained
Overall cybersecurity strategy must aim to protect 3 core pillars that
underpin connected devices and services: Integrity

 
Confidentiality; Data stored, received or transmitted by devices and
application is not altered
 
Integrity;

 
Availability.
Ensuring that the objectives of the 3 security pillars are met is a Availability
question of proper security by design. By giving a unique and
private digital ID to a device and implementing Device and Device communications and management interfaces are
not disrupted; nominal service is available
Authentication management solutions, based on encryption
techniques, companies can prevent unauthorised access to data,
devices, and software. In turn, these controls help ensure data Source: Juniper Research
integrity and service availability.

1.5 IoT Security: A System of Layers

From an abstract perspective, the IoT is composed of a system of different layers. The idea of layers in cybersecurity is a fundamental concept. The
reason for this is that, should one layer fall to the efforts of a cybercriminal, other layers remain in place that helps to mitigate any potential damage
done. Each layer has its own requirements in terms of cybersecurity; these are broken down in more detail in the following section.

Figure 3: IoT Layers

Security by Design

IoT Layers

Devices Gateways, Networks & Cloud Application & Users

Connections

Device Identification & Communications

Authentication Data Encryption
Encryption
Security
Firmware/Code
Requirements Authentication Data Encryption Code Verification

Communication/Data User/System
Encryption Message Verification
Authentication

Security Lifecycle Management

Source: Juniper Research

3
 1.6 Breaking Down the Layers: Core 1.7 Ensuring the Continuity of Trust:
Security Concepts Security by Design & Security
i. Devices Lifecycle Management
Connected devices and their users (whether human or machine) The security concepts described previously are essential to
are the heartbeats of the IoT. The value created by an IoT system establishing trust in an IoT network at any given time. Yet, what if
depends on the information generated as a result of the interaction an element inside the layers is breached, or policy demands that
between these users and/or devices. trust must be reinforced?

In addition, it is highly important that the information generated can  Security by Design: This forms the basis for ensuring a continuity
be trusted. With that in mind, how can this trust be established? of trust. It is an approach rather than a specific technology that
guarantees that security is built into a project deployment from the
 evice Identification & Authentication: A core element
D ground up. To choose the right level of security implementation,
of trust in IoT layers is to make sure that users and devices at this stage, devices, systems and networks should be viewed
are who they say they are. Without this verification, holistically with associated requirements and risks in mind.
cybercriminals could potentially masquerade as someone or Properly implemented, security by design will ensure that a unique,
something thought to be trusted, access unauthorised data secure digital device ID is given at the point of manufacture and
and manipulate it. High security approaches will provide a embedded at the hardware level to prevent ID theft or misuse.
unique and private digital identity at the point of manufacture Additionally, security by design demands that scalable security
in a manner that is secure and avoids potentially malicious solutions are in place to reduce ad hoc or future risk.
interference or cloning.
ecurity Lifecycle Management: Like traditional devices
S
 
Firmware/Code Authentication: Firmware or application and software, the principle of regular software updates and
code running on a device can potentially be manipulated by password changes should also apply to IoT devices. Firmware
cybercriminals. Therefore, ensuring that firmware and code is updating, access policy management and regular exchange
genuine is another key concept of device security. of digital access keys is fundamental to strong security policy,
 
Data Encryption: It is important to encrypt data during its alongside the ability to react to evolving security threats and
complete journey through an IoT ecosystem: both at rest changing regulation. If access is somehow compromised, such
as well as during data transmission, particularly when this is mechanisms will prevent future unauthorised access. Security
done wirelessly. Sending information in plaintext (raw format) lifecycle management solutions should be in place to meet these
should therefore be avoided, as it is susceptible to interception. needs, with the ability to receive alerts and remotely address large
Encryption is a fundamental tool to keep data hidden. scale device fleets, avoiding time-consuming and costly services
in the field. Implementing a scalable security infrastructure at the
ii. Gateways, Networks & Connections design stage is thus essential against approaches that could
Devices and systems in this layer of the IoT enable data to be expose IoT systems to damaging security attacks.
shared between networks, other devices and applications. They
form the fundamental bridge between one network and another,
1.8 A Complex Landscape: The Need
often connecting the consumer of the data with the source. for an IoT Security Specialist
With IoT sensors and actuators often lacking on-board storage, The diversity of devices and systems in the IoT, alongside its large
long-range communications and computing power, gateways and footprint, can create a complex environment for those seeking
other devices on the network (such as smart edge devices) can to establish and deploy security best practices. Indeed, a key
be used to provide functions such as data consolidation hubs and message to understand at this point is that there are no ‘one size
communications encryption, for further data transfer. fits all’ solutions for players in the IoT. This applies both to project
deployment, as well as the manner by which it is secured. A further
Ideally, data encryption is performed on the IoT sensor, but this is
message is that security is an ongoing process, owing to ever-
not always possible. However, devices in this layer can verify the
changing threats and requirements.
authenticity of users or other devices by virtue of the mechanisms
such as message verification and routing. Juniper recommends that the following approach be taken while
considering the right security strategy:
iii. Cloud Applications & Users
 
Security must be planned from the ground up, with built-in
This layer of the IoT offers the ‘heavy lifting’ computing resources of
flexibility for future requirements and updates, as part of the
the cloud. Large swathes of data can be retrospectively analysed,
security by design process.
used to improve performance of devices and systems in other
layers and provide valuable insights to the market and business.  
Devices’ identity and authenticity must be made secure and
Applications that make use of IoT data are typically deployed in reliable, via the security lifecycle management process.
this layer.  Code, firmware and users or systems should be authenticated to
ensure that they are of genuine origin.
It is therefore important that applications are verified as genuine
in a similar fashion as at the device layer. Additionally, users of  Data should be encrypted where possible to prevent theft, or
platforms, systems and applications must be verified as genuine to tampering.
prevent any data manipulation or system misuse. Achieving these goals requires a thorough understanding of security
best practices. Companies with a long history of cybersecurity
Data encryption must be seen as standard in this layer. implementation, as well as dedicated teams addressing design and
approach, will undoubtedly already be familiar with the requirements.

4
On the Small & Medium-sized Enterprise side, or for corporate Figure 4: IoT Decision-Maker Security Approaches Surveys
players only beginning to undergo their digital transformation, this
may not always be the case. For these companies, the services 60%

50%
of a security specialist are recommended. This is for the simple
40%
reason that a third party specialist will already be familiar with
30%
best practice requirements, as well as concepts such as security 20%
by design. A specialist can ensure that an appropriate solution is 10%
deployed from the outset, thereby reducing time, and TCO (Total 0%
Cost of Ownership). Yes, we have Yes, we strive No, but it No, and it Don’t know
adopted towards should be should not be
With the importance of security by design in mind, the results of a ‘security ‘security by
The Thales Survey are revealing: only 50% of IoT manufacturing, by design’ design’
approach Q: Is security a consideration when
software or services players have adopted such an approach, with your organization designs its IoT
42% of respondents striving towards that goal. Undoubtedly, these product/offering?
organisations would benefit from additional security expertise.
Source: Thales/Vanson Bourne Survery

2. Protecting My Infrastructure:
Strategies for Successful IoT
Security Deployment
2.1 Security Solution Overview With that in mind, this section will provide an overview of security
solutions in terms of the security pillars they aim to protect.
There are several solutions available to secure devices, networks
and software systems. These focus on establishing a foundation of i. Confidentiality
trust for future data exchange through device authentication, data Unauthorised access to devices, applications or data is often due
confidentiality as well as data integrity.
to poor device security, credential theft or ‘zero day’ (previously
As we noted previously, the objectives of security solutions are to undiscovered) vulnerabilities in application code or firmware.
protect Confidentiality, Integrity and Availability. Key tools are tabulated below, with expanded commentary for
more technical aspects.

Table 1: Protecting Confidentiality - Solutions

Protects Position in
Security Tool Function Notes
Against IoT Layers

Cryptographic Secure mutual authentication Unauthorised access to data

All
Authentication between authorised parties and services

Depending on business risk,

TEE (Trusted Execution Isolates cryptographic functions
Access to sensitive code Devices can be used with/without
Environment) from software applications
a SE

On-device hardware security

Isolates cryptographic functions Theft of device ID, Devices,
SE (Secure Element) and lifecycle management
via dedicated hardware application access Gateways
enabler

HSM (Hardware Security Secure key management and Cloud & Cloud/server enabler for
Theft of device ID
Module) crypto-processing Applications lifecycle management

Platform to provision,
Lifecycle Management Regular renewal of credentials, Theft of device ID,
All decommission and update
Platform firmware and policies unauthorised device access
devices

Ensures data is only readable to

Data Encryption Theft of data (eavesdropper) All
authorised parties

User & Developer Promotes cybersecurity best Device/system/ application

All
Education practices access

Source: Juniper Research

5
 Cryptographic Authentication ensures that data exchange  The Lifecycle Management Platform brings the SE/TEE and
and handling is enabled only to authorised entities. This the HSM together, with the platform used to issue or revoke
process uses cryptography based on secret keys and digital credentials and regularly update software and firmware. This
certificates to ensure that exchanged data is coming from, process effectively time-limits any potential attacks or undetected
and delivered to, trusted entities. breaches and restores a secure state. This is also key for devices
which operate in the field for many years and need to update
A SE (Secure Element) is a hardware component soldered
 
security elements regularly, to mitigate new cyber threats.
onto the device. Its primary function is to act as an enclave
for sensitive data storage (such as the device access key)  Data Encryption consists of encoding a message, to make it
and encryption functions, that is unreachable by the main unreadable to any entity who would not have access to the
operating system on the device. It is a key part of ensuring decoding key. The data itself as well as the communications
a device’s identity protection and only authorised access to channel are ideally encrypted, although for power-constraint
applications. As a tamper-resistant component, it offers a IoT devices, encryption is typically performed by a gateway or
very high level of security. smart edge device.
A TEE (Trusted Execution Environment) is used in place
   User & Developer Education is not a security solution per
of, or in conjunction with, a SE, depending on the level of se, but should be viewed as important in conjunction to the
business risk. Here, a hardware and software component security solution. In short, user education enables employees
are combined to separate code execution from the main to understand that, for example, passwords should not be
operating system in a similar manner to the SE. In low-risk sent in plaintext over the company email system. Meanwhile
scenarios, neither an SE nor a TEE will be used, with the data it might teach employees to recognise signs of social
protection applied using a software-only approach. engineering attacks designed to make employees unwittingly
supply cybercriminals with sensitive information.
 HSM (Hardware Security Modules) are specialised tamper-
resistant units, adding an extra protection layer to safeguard ii. Integrity
centrally stored device access keys. They enable remote security The protection of data integrity is very much linked to the notion
lifecycle management, protecting the most sensitive keys from of confidentiality. That is to say, if the device or system is well
compromise (government infrastructures, energy or automotive protected, it will be very difficult for an attacker to access the data
assets etc.) produced by that device or system, and then to manipulate it.

Table 2: Protecting Integrity - Solutions

Protects Position in
Security Tool Function
Against IoT Layers

Ensures device boots only using valid

Secure Boot Firmware/operating system tampering Devices
software

MAC (Message
Proves origin and integrity of a message Data alteration/tampering All
Authentication Code)

Data Encryption Complicate tampering attempts Message details access All

Digital Certificates Execution of unauthorised code

Provides proof of message origin Mainly devices
& Signatures and fake data injection

Source: Juniper Research

 ecure Boot is in widespread use across a range of devices

S any software. They use cryptographic mechanisms to ensure
and, as the name suggests, is used to verify that the software that firmware or application code are genuine before being
running on the device has not been tampered with, or injected allowed to run on the device or system. In parallel, HSMs
with malicious code. Cryptography helps check each software may be used to ensure that such code-signing certificates are
element validity before it starts, avoiding malevolent code stored in the most secure manner possible.
execution that would compromise the device.
iii. Availability
 AC (Message Authentication Code) is an unforgeable code
M Solutions to maintain service availability, or ‘uptime’ aim to ensure
that is attached to a message to prove its origin and integrity. that unforeseen attacks from both external and internal sources are
The sender and recipient of the message both possess a code shielded.
that algorithmically proves that the MAC is genuine.
Common threats directly attributable to external actors include DDoS
 ata Encryption is a process that encodes a message in a
D (Distributed Denial-of-Service) attacks. Here, an attacker will direct
manner that renders it unreadable to an unauthorised party. an overwhelming amount of network traffic to the victim; devices,
It protects both against eavesdropping and data tampering. servers and services become unable to respond to normal requests.
 igital Certificates are essentially used to validate digital
D Meanwhile, internal threats can take the form of disgruntled
signatures (alphanumeric codes) that can be attached to employees themselves, or of malware (which typically originates

6
externally, but propagates internally). Naturally the threat of architectures), which must be dealt with as a concern alongside
power outages, natural disasters and so on raises the question of security. High Availability systems should also be in place to support
failover and disaster recovery mechanisms (back-ups, redundant exceptionally high traffic peaks and prevent service disruption.

Table 3: Protecting Availability - Solutions

Protects Position in
Security Tool Function Notes
Against IoT Layers

Validates or blocks inbound and Gateways,

DDoS, potentially malicious traffic DDoS protection
Firewall outbound connections according Networks &
from external sources. is limited
to ruleset Connections

Attempts to prevent malicious Gateways,

IPS (Intrusion Prevention DDoS, malware and malicious Actively blocks
attackers from accessing or Networks &
System) network activity suspicious traffic
disrupting a network Connections

Gateways,
IDS (Intrusion Detection Attempts to detect unusual activity Malware and malicious network Events flagged,
Networks &
System) associated with malicious entities activity not prevented
Connections

Establishes hardened infrastructure Gateways, Third party

DDoS Prevention Service to enable continuity in the event of High volume DDoS Networks & provided
a DDoS attack Connections service

Source: Juniper Research

2.2 What Level of Security do I Need? devices, systems, users and customers in both current and future
IoT deployments. Each risk must be evaluated in terms of; the
The first thing readers must understand before deployment of a security pillar impacted, its likelihood of occurring, the severity
security solution is that cybersecurity is an exercise in risk mitigation. of any breach and if there are solutions in place to mitigate the
Cybercriminals, given enough time, determination and financial impact of said risk. The resultant risk scores will enable IoT device
backing, will penetrate even the best protected mechanism. It is manufacturers and service providers to appropriately rank threats
important that the cybersecurity solution in place is one that combines and their associated risks; some risks may be acceptable and thus
several layers of security mechanisms and that is appropriate to the require no action. Others may be a risk that should be allocated
level of risk posed to the business. resources to mitigate, with the possibility of diverting resources to
more critical issues should the need arise. Finally, there will be risks
In practice, this means that the first step for any business is to that should be considered as critical in nature and thus will require
undergo a risk assessment, taking into account the profile of immediate action.

Table 4: What Level of Security Do I Need? IoT Risk Score Modelling Exemplar (Non Exhaustive): Devices

Probability
Mitigation Threat
Threat Threat Class Impact of Threat Mitigation Risk Score
Measures Severity
Occurrence

What will happen to the network

if the device, or group of devices is Availability (a) (b) (m) [(a) - (m)] x (b)
inadvertently taken offline?

Are component suppliers

trustworthy and are associated Confidentiality (a) (b) (m) [(a) - (m)] x (b)
software components updateable? What is the
impact of the Are there
threat? How elements
Can devices be securely
Confidentiality far does it across the (a) (b) (m) [(a) - (m)] x (b)
authenticated on the network?
reach? Will ecosystem
it impact that will
customer trust, reduce the
Can data on the device be
Integrity compliance probability (a) (b) (m) [(a) - (m)] x (b)
encrypted at rest?
adherence, of a threat
income or occurrence?
What will happen to the service revenues?
if the device, or group of devices, Integrity (a) (b) (m) [(a) - (m)] x (b)
reports false data?

What will happen if data

stored on the device is stolen or Integrity (a) (b) (m) [(a) - (m)] x (b)
mishandled?

Source: Juniper Research

7
 The risk score is the calculation between the variables a, b and m T hreat severity ranges from insignificant (1), minor (2), moderate
as previously shown. Typically each variable is assigned a score (3), major (4) and catastrophic (5);
from 1 to 5, where:
 itigation ranges from negligible impact (1), low impact (2),
M
T hreat probability ranges from rare (1), unlikely (2), possible (3), moderate impact (3), major impact (4), highest impact (5).
likely (4) and almost certain (5);

Case Study: Smart Buildings in the IoT Era

Juniper interviewed Guillaume Djourabtchi, IoT Services From a cybersecurity perspective, this creates several challenges.
Marketing Director at Thales, April 2018 ‘If we consider the attack surface here, the facilities manager
has access to data for building performance, device makers
Facilities managers today are faced with several challenges
may access data for predictive maintenance while a service
where their companies’ buildings are concerned. For example,
provider might be responsible for security camera data storage.
there is an expectation that modern buildings must not only be
Strict controls over the access of collected data must be in place,
more comfortable than those of yesteryear, but also be more
to ensure only authorised users and systems have access to the
convenient, secure and achieve a lower carbon footprint.
information they need. This is necessary to avoid data privacy
Indeed, the fact that buildings are the second highest emitters
breaches and cybercriminals taking control of connected
of greenhouse gases globally has created a strong case for
devices. Evidently, there are several aspects to consider when
optimising energy consumption. Naturally, businesses can
creating a global security solution; it is a complex challenge.’
benefit directly too; optimisation can realise cost-savings.
Meanwhile, Djourabtchi noted that building digitisation in
As a result, several areas of the building are now connected,
the name of convenience requires careful consideration. He
with data aggregated into a central control system. These
cited an example of a luxury hotel in Austria that, due to a
data collection points can include smart meters, to measure
ransomware attack, lost the ability to issue arriving guests
real-time energy consumption, video cameras to detect
with keys to access their rooms. ‘What are the consequences
building occupancy levels, as well as other sensors to measure
of that? At the very least, inconvenience and a dim view of
environmental variables, such as temperature and CO2
customer service. Worse, the brand is negatively impacted,
levels. Aggregation and analysis of this data is advantageous
affecting future customer loyalty.’
at several levels. For example, it enables buildings not only
to optimise their energy consumption, by regulating heating When asked to outline how best to approach these kinds
according to occupancy, but it can also act as a building of issues, Djourabtchi was clear: ‘There is no one-size-fits-all
security aid. ‘During a weekend, for example, a smart building approach. Each use case is different, in terms of its risks and
system can not only alert facilities management to some unusual vulnerabilities, so the security solution should be appropriate
energy consumption measurements, but also detect if the fault is to those considerations. That said, if there is one over-riding
due to an electrical issue or an intrusion by gathering data from element to cybersecurity in any deployment, it is that it must be
connected cameras. In this manner, the system itself can initiate adaptable, especially in the IoT where devices could be out
the appropriate action’ notes Guillaume Djourabtchi. there for 10, 20 years…’

3. Examining
The True Cost of IoT Security
It should be clear from the outset that a properly implemented  isruption: what is the cost and associated revenue loss of a
D
security solution is not something that can be achieved at very low service falling offline?
cost.
 ata theft: how valuable is the data and what is the cost of lost
D
This, combined with the fact that cybersecurity in companies will be or compromised information? Are there regulatory implications?
defined as a cost centre, means that there has, in many instances,
been an inertia by at-risk companies to spend appropriate sums  nauthorised device access: what is the cost of implementing
U
on ensuring that their security is robust. Indeed, The Thales Survey new access credentials in the field as a result of malicious
revealed that 44% of respondents felt that the cost of cybersecurity activity?
implementation is high and created a barrier.  rand damage: what is the cost of the customer base losing
B
brand loyalty, and the cost of acquiring new customers as a
3.1 The Cost of Failure result of a tainted brand?
That said, it should also be clear that cybersecurity is an investment
Costs to the business can be very high. As an example, the
that serves to protect the business. Consider, for a moment, the
‘NotPetya’ malware that emerged in 2017 affected Danish
potential impacts of a cybersecurity breach:
8
shipping company Maersk, with the result that service disruption 3.2 In-house or Cybersecurity
and delays in its operations lasted several weeks. The company
estimates that the total financial damage from the attack is worth Specialist? Modelling
approximately $200-$300 million. Implementation & Operational Costs
Thales’s Breach Level Index, which tracks annual reported Security deployment can either be handled as a ‘DIY’ (do-it-yourself)
security breaches, found that over 2.6 billion records (database undertaking or in partnership with an experienced security service
entries) were compromised in 2017. Juniper has calculated that provider. Which route a company decides to take will typically
the average cost attached to a compromised record was worth be influenced by perceived cost, in conjunction with the level
approximately $250 in 2017, equating to over $650 billion in of perceived risk to the business. Naturally, the level of in-house
losses attributable to data compromises. expertise is a key consideration, although a team’s ability to
implement an appropriate solution should be factored into the risk
Interestingly, Thales’s Index highlights that only 4% of recorded
assessment. Clearly, then, professionally gauging business risk is to
breaches contained data that was secured by encryption and
be advised for all companies.
thus rendered useless to an attacker. Previously highlighted best
practices cannot therefore be emphasised enough. When comparing DIY or security specialist routes, one must
examine how cost, and risk, will develop in the long run.

Figure 5: DIY or IoT Security Specialist? Cost Consideration Model

IoT Security Implementation - A Comparison Key Takeaways

IoT Specialist Approach DIY Approach

Delivered as a package, with shared Self-sourced, requiring expert in-house
infrastructure knowledge
“Contrary to perception, the specialist
Objective Security Risk Assessment Gain In-House Expertise
approach may not only be cheaper
Accounting for customer industry & By hiring & training security experts
ecosystem to implement from the outset, but the
established expertise brought by the
Secure the Supply chain provider will serve to reduce time,
Market-Specific Solution Through generation & provision of
errors, and complexity. It will ensure
Scalable, end-to-end security unique digital IDs. Design & deploy
architecture, protecting from the edge appropriate security containers & ID that security implementation is well
up to the cloud management for devices & users done and that the infrastructure in
place is scalable, to face evolving
threats and new stakeholders.
Faster Time-to-Market Deploy Cryptography Infrastructure
Via industry best-practice knowledge Either as an in-house effort, or find Where risk is high, or security
and shared encryption infrastructure ‘as-a-service’ HSM / PKI provider for
expectations are high, this type of
security lifecycle management
approach should be given serious
Conformity with Industry Standards consideration.
In-depth knowledge of regulatory Slower Time-to-Market
requirements and protocols By replicating specialist approach & For low risk devices, or markets
avoiding risks associated with poor in which there is low expectations
implementation in terms of device security, a DIY
Scalable Architecture
approach which employs a software-
Regular updates via remote security
lifecycle management, to ensure Poor Implementation Risks first approach to security (as opposed
business continuity to an hardware approach) will
Business Brand
Disruption Damage serve to reduce overall security
implementation costs.”
Regulatory
Data theft
Fines

Loss of
Ransomware
Revenue

Costs Costs

Source: Juniper Research

9
 4. Conclusion:
IoT is a Critical Security Investment
This study has examined the key challenges involved in IoT  
The costs of failing to protect one’s infrastructure, as we have
security, as well as the considerations and strategic approach for seen, can be high. Certainly, the side effects are not limited to
best-practice implementation. Thales & Juniper’s key findings are direct revenue loss; eroded trust, in turn allowing a competitor
highlighted below. to increase their market share, can be expected to have a long-
term negative impact on the business.
 
As we have seen, IoT security can be complex, particularly for
those without considerable experience in the sector. Assessing  
Meanwhile, having a reputation for operating a secure business
business risk, and sourcing security products that meet both short- is, undoubtedly, a key differentiation point where the IoT is
and long-term business requirements is no easy task given that concerned. Even now, savvy IoT device manufacturers are
each business has unique needs. It is clear that customers stand searching out secure partners, suppliers and service providers.
to benefit from integrated security service provider expertise in The Thales Survey revealed that 92% of respondents have seen
terms of long-term costs and fewer potential points of failure in an increase in sales owing IoT security measures, highlighting
high- to medium-risk IoT deployments as a result of applying the the need to establish a chain of trust.
appropriate solution for the customer’s requirements.

 
The Thales Survey revealed that 57% of respondents think that
better guidance by IoT security experts is the best way to help
the manner by which they partner with other organisations for
IoT. This suggests that, once an IoT project is embarked upon,
expertise is actively sought to assess risk in the context of security
by design.

10
Notes

11
 > Thalesgroup.com <
© Thales 2020. All rights reserved. Thales, the Thales logo, are trademarks and service marks of Thales and are registered in certain countries. 19 August 2020.