3

I want to experiment with the use of sensors for data logging and potentially for automated actions based on data properties. An example of the latter is if a value being monitored exceeds a threshold for X amount of intervals, some kind of notification or response is triggered, whether an LED lighting up or email being sent out.

I'm not an expert about sensors, networking, IoT, robotics, scripting, machine learning, or programming in general. That's all part of the learning process. I know enough to know security is important and easier to achieve if it's a goal from the beginning. So my question as I embark on this learning excursion is, what do I need to be aware of or control for to keep these systems safe as I create and experiment with them? If that question is so broad a book answers it, could you recommend a learning resource? Where does one start for learning how to keep home brewed IoT systems secure?

I realize this depends on two major things: security is harder as complexity increases; and security depends on threat models. Well, my simple sensor systems are bound to get more complex if I pursue more significant projects with them, thus the importance of good security that scales from the start. As for threat models, I don't anticipate enemies and these would all be relatively low-value and plentiful targets (many sensors monitoring basic things) but I do expect there are malicious agents seeking to control any processing power they can or disrupt systems just for the sake of chaos. Lastly as an importart part of the threat model is physical security, because if I put a sensor outside with a solar panel to power it, how do I stop mischievous kids or crooks from destroying or stealing the technology?

cr0
  • 373
  • 2
  • 4
  • 15
  • 2
    IoT is a really fascinating topic with a lot of growth in it and certainly interesting for this site. I'd suggest that this question needs to be refined, however, to be answerable here. Generally requests for resources or starting points are considered too broad, for instance. Perhaps a better question would be to take the research you have done and pose specific questions on that. – baldPrussian Feb 02 '18 at 21:06
  • Great question and I am not an IoT expert so I don't wanna attempt a full answer. Never the less, the biggest issue with IoT is the devices being enslaved and used in Botnets for DDoS attacks (Mirai anyone?). To counter that particular threat, ensure your devices have strong username-password combos on their Telnet and/or SSH port's and shut down all un-necessary ports. NEVER use default password, your IoT device will be enslaved. – dFrancisco Feb 02 '18 at 21:08

5 Answers5

2

You start by not giving them access to the Internet. If your Intranet of Things devices have no direct contact with the outside world (eg. your IoT sprinkler controller is firewalled off from the Internet and needs to go through a proxy when requesting a weather forecast), it becomes much harder for an attacker to do anything. If there's no connection whatsoever, any attacker needs to be physically present.

Mark
  • 34,646
  • 9
  • 87
  • 137
  • Right, staying offline prevents a lot of problems. How about being on an intranet with other devices that do connect to the internet? For example, how much more vulnerable is an IoT system if it has a raspberry pi as part of its internal network, which in turn is connecting to an internet connected smart phone via bluetooth? – cr0 Feb 03 '18 at 03:58
  • 1
    @cr0, "device hopping" is a real concern. But consider, the bad actor would have to get through internet, bluetooth, and then exploit the RPi and finally exploit the IoT device. This isn't any different than issues faced by non-IoT intranet devices. – Nathan Goings Feb 05 '18 at 19:48
1

You didn't mention the first rule of IoT security. Change the admin password. If possible make it complex. I have witnessed hundreds, if not thousands, of penetration attempts and most of them are attempting to compromise some form of administration account with guessable passwords.

Another thing that you can do is register it with a directory. You may have AD available to you but there are also dozens of online cloud versions available too.

If you are going to have multiple devices this can simplify any administrative activities as well.

scopedial
  • 216
  • 1
  • 6
1

IoT is a loaded term. I'm going to assume the topic is about "How to keep self-configured IoT devices secure" and disregard cloud-based IoT devices.

The best way to learn about securing IoT devices is to learn how generic security works. IoT devices are by definition, internet connected devices. They are no different than computers, servers, network printers, routers, switches, etc. They face all the same problems that those devices face when it comes to security.

You can find a ton of information on how to secure network infrastructure online. There are many other resources as well, such as academic classes.

I personally, run a firewall on my router that segments my network and white-list locations I access it from.

To disregard my disregard, cloud-IoT devices are at the mercy of their cloud services.

Nathan Goings
  • 888
  • 1
  • 6
  • 14
1

Lastly as an importart part of the threat model is physical security, because if I put a sensor outside with a solar panel to power it, how do I stop mischievous kids or crooks from destroying or stealing the technology?

You, essentially, have to build a better mouse trap. Consider your physical security situation - is the street side of your house safe, but kids out of view of the streets will wreck things? Perhaps the opposite is true - position the sensors within view of the street (or vice versa). Next, consider replace-ability - is this a cheap sensor or a $150 weather station type deal? Consider pairing down the features of outdoor sensors to lower the cost of replacement. If it takes you five minutes and five dollars to replace the sensor, who cares if it's broken or stolen every three months. Thirdly, consider hardening - is your sensor on the top of a 30 ft roof? Is it resistant to a baseball or rock? Do you need to walk up to it and wail on it with a golf club for a few minutes to break it? Can you make it that resistant?

All security is about making compromise "not worth it" for the attacker. It's hard to overcome the "worth it" factor for teenagers - the destruction itself is the reward, and making a harder target makes the destruction more fun. You'll have to think critically about what you need to do to make the sensors unlikely to be damaged, or make them easier to replace when damage occurs.

Monica Apologists Get Out
  • 4,051
  • 1
  • 16
  • 22
  • P.S. I know that that's not how "Build a better mousetrap" is usually used. – Monica Apologists Get Out Feb 05 '18 at 20:36
  • This is helpful about physical security - all good things to consider. In my case I'm somewhat new to the area so I don't know risks first hand. Neighbors report theft in the area due to local teenagers. I see teenagers hanging out in the neighborhood but haven't had problems yet. As you said, it's about making targets "not worth it" to potential attackers – cr0 Feb 06 '18 at 16:36
1

If your devices need Internet access, use a three router Y-configuration to separate your 'ordinary' (home/work) network from the one containing your IOT devices.

There are plenty of resources about that on the Internet.

This article goes in-depth describing the disadvantages of simpler configurations, leading up to the Y concept. The author even has a walkthrough showing how he set this up for himself.

Note: Many modern router devices let you mimic this configuration with one box only, but talking about three physical ones makes you understand it better. You may even have some old routers laying around that you now have a purpose for.