UNIK Measurable Security for the Internet of Things L1 Introduction

Transcription

1 UNIK Measurabe Security for the Internet of Things L1 Introduction György Kámán, Mnemonic/CCIS/UNIK gyorgy@unik.no Josef No UiO/UNIK josef@unik.no #IoTSec, #IoTSecNO

2 Overview Expectations Lecture overview Exam Topic introduction Expected outcome: security impact of components and subsystems, and perform a muti-metrics anaysis to estabish the system security Anayse appication goa versus system security and suggest improvements Describe appication-driven security and estabish chaenges of sensor-driven systems Provide industria exampes, e.g. Smart Grid and automatic meter readings Estabish appication-driven security goas as we as the semantics of your system Generate matrices to describe the UNIK4750, Measurabe Security for IoT - #IoTSec Jan 2016, György Kámán, Josef No 2

3 UNIK4750: Lecture pan 21Jan - L1: Introduction 28Jan - L2: Internet of Things 4Feb - L3: Security of IoT- Paper seection 11Feb - L4: Smart Grid, Automatic Meter Readings (AMR) 18Feb - L5: Service impications on functiona requirements 25Feb - vinterferie 3Mar - L6: Technoogy mapping 10Mar - L7: Paper anaysis with min presentation 17Mar - L8: Practica impementation of ontoogies 24Mar - Easter Hoidays 31Mar - L9: Logica binding - industria exampe - possibe guest ecture 7Apr - L10: Muti-Metrics Method for measurabe Security 14Apr - L11: Muti-Metrics Weighting of an AMR sub-system 21Apr - L12: System Security and Privacy anaysis 28Apr - L13: Phenomena "intrusiondetection", possibe guest ecture 5May - Kristi Himmefart - fridag 12May - L14: Rea word exampes - IoTSec infrastructure 19May - L15: Rea word IoT service evauation group work 26May - Exam UNIK4750, Measurabe Security for IoT - #IoTSec Jan 2016, György Kámán, Josef No 3

4 How come these guys didn t think of security?... and the Internet 1973 Kjeer Steve Crocker The buiding where the Internet (Arpanet) came to Europe in June 1973 Jon Poste 1972 Vinton Cerf Source: UNIK4750 #IoTSecNO Jan 2016, György Kámán, Josef No 4

5 The threat dimension Hoande (FR), Merke (DE) had their mobie being monitored «and we beieve it is not happening in Norway? [source: [source: Süddeutsche Zeitung, 18Dec2014] UNIK4750 #IoTSecNO Jan 2016, György Kámán, Josef No 5

6 L1 - L3: Introduction to se This first part wi provide the introduction into the Internet of Things (Lecture 1 - L2), with industria exampes Smart Grid and automatic meter system (AMS) Smart Homes with sensors Wireess System upgrade of cars The part wi further address potentia security threats (L3), as exampe for the future smart grid. Smart grid with prosumers UNIK4750, Measurabe Security for IoT - #IoTSec various contro mechanisms attack scenarios critica infrastructure Jan 2016, György Kámán, Josef No 6

7 Knowedge and coaboration space - #IoTSec, #IoTSecNO «Open Word Gjøvik Kjeer Oso Haden Approach» everything that is not decared cosed is open UNIK4750 #IoTSecNO Jan 2016, György Kámán, Josef No 7

8 Internet of Things Security UNIK4750 #IoTSecNO Jan 2016, György Kámán, Josef No 8

9 L4-L6 Security and Privacy chaenges Exampe: automatic meter reading (AMR) and -system (AMS) Mapping from functiona requirements towards mapping into technoogy. Exampe: transation of privacy requirements - can somebody see from my meter reading if I'm at home - towards technoogy parameters ike how often are vaues read and pubished. Smart Meter Internet UNIK4750, Measurabe Security for IoT - #IoTSec [source: seminarsony.com] Jan 2016, György Kámán, Josef No 9

10 L6-L8 Machine-readabe descriptions Describe a system based on security attributes Introduction to the Semantic Web Ontoogies Web-Protégé Rues & Reasoning make decisions UNIK4750, Measurabe Security for IoT - #IoTSec Jan 2016, György Kámán, Josef No 10

11 L7 - Paper presentation Methodoogy: Seect (or search) for scientific papers Present the paper Discuss issues which you find interesting Outcome Learn to read (and criticise) scientific iterature UNIK4750, Measurabe Security for IoT - #IoTSec Jan 2016, György Kámán, Josef No 11

12 L9-L12: Muti-Metrics method System consists of sub-systems consists of components security privacy criticaity dependabiity Computer anaysis idea good accep. critica faiure UNIK4750 #IoTSecNO Jan 2016, György Kámán, Josef No 12

13 L13 - L15 Rea Word Exampes Rea word exampes taken from industry, e.g. Smart Meter biing, controing Your own anaysis seect system of choice perform an anaysis suggest: group work Smart Meter [source: seminarsony.com] UNIK4750, Measurabe Security for IoT - #IoTSec Jan 2016, György Kámán, Josef No 13

14 UNIK4750 exam The fina grade is based on a portfoio assessment (40%) questions to the group work topics of the course an ora exam (60%). In the case of many students, the fina exam may be hed as a written exam; this wi be decided eary in the semester. Portfoio your paper presentation group work Ora exam expain your group work UNIK4750, Measurabe Security for IoT - #IoTSec Jan 2016, György Kámán, Josef No 14

15 Internet of Things Heading toward a fuy connected word In a more focused way, in this course we speak about industria internet of things The substantia difference is, that these systems have a physica dimension Considered as the next industria revoution Automation to a new connectivity eve the internet is coming to automation Main chaenges: how to join the physica and the ogica word, how to achieve interoperabiity in a heterogeneous and conservative industry? UNIK4750, Measurabe Security for IoT - #IoTSec Jan 2016, György Kámán, Josef No 15

16 Internet as we know it Inteigence in the end nodes Best effort traffic Infrastructure = network equipment Operated by IT or teecom No direct physica dimension Mosty buit to serve human-generated traffic QoS: best effort, adopted to the human consumer: 10s of ms of drop is not a probem, stabe deay is accepted, majority of appications are bursty Reaction time in 0.5-1s range Stochastic à services do expoit this (ike Erang-B formua for capacity estimation or ossy compression in neary everything) UNIK4750, Measurabe Security for IoT - #IoTSec Jan 2016, György Kámán, Josef No 16

17 Automation as we know it Centraized inteigence Traditionay operated as isands by operations Direct connection with the physica word Is made for information gathering and processing by machines Has a ag of approx years (one generation of devices) Sti a current question: coisions on Ethernet, what happens if one has to share infrastructure with others, how to operate a ink with ong step-out distance Economic press eads to adoption of internet-based services which require a paradigm change Mine (Boiden) ABB robots UNIK4750, Measurabe Security for IoT - #IoTSec Jan 2016, György Kámán, Josef No 17

18 Typica traditiona industria network UNIK4750, Measurabe Security for IoT - #IoTSec Jan 2016, György Kámán, Josef No 18

19 Merging these two Internet is the infrastructure sensor, actuator, controer not on the same physica network any more dissoves the automation system in the internet Automation processes run over an unknown communication infrastructure Network communication gets physica impact Automation meets rea internet-type depoyment Aready happening The rea vaue of IoT: data. Coud and big data wi enabe new services UNIK4750, Measurabe Security for IoT - #IoTSec Jan 2016, György Kámán, Josef No 19

20 Interesting chaenges Architecture: physica impact, end-to-end resource reservation, discovery, safety, security and privacy Governance, interoperabiity, standardization Managing risk in a system with impact on both ogica and physica eve Provide QoS over a best effort infrastructure with a price pressure Aggregation of data: here ies the added vaue, enabes nove services and higher efficiency Distribution of inteigence: make the automation system more internet-ike: inteigence in the endnodes. Support it with the recent it trends of coud and big data. Chaenge for traditiona automation mindset. Open architectura mode Security concerns are a critica barrier for wide scae adoption of IoT See when IT has arrived to the phone industry. Or when IT has arrived into teco backhau. IT is arriving to automation. UNIK4750, Measurabe Security for IoT - #IoTSec Jan 2016, György Kámán, Josef No 20

21 IoT services Enabed by wide scae data gathering Monitoring of massive systems Rea-time insight to processes Observation of systems Performance measurement and optimization Proactive and predictive methods To serve the automation goas, the services provided must be: scaabe, distributed, have a rea reference to the phyisica word (e.g. time), must ensure security and privacy of the users Just using existing security soutions is not eading to secure IoT depoyments Composed by IT, operations and the IoT enabed objects * Foowing sides are from the presentation of Mikhai Kader, DSE, Cisco, presented on the ITU Workshop on ICT Security Standardization for Deveoping Countries UNIK4750, Measurabe Security for IoT - #IoTSec Jan 2016, György Kámán, Josef No 21

22 Connected Rai Operations * PASSENGER SECURITY In-station and onboard safety Visibiity into key events ROUTE OPTIMIZATION Enhanced Customer Service Increased efficiency Coision avoidance Fue savings CRITICAL SENSING Transform data to actionabe inteigence Proactive maintenance Accident avoidance Cost savings, improved safety, superior service UNIK4750, Measurabe Security for IoT - #IoTSec Jan 2016, György Kámán, Josef No 22

23 Smart City * CONNECTED TRAFFIC SIGNALS Reduced congestion Improved emergency services response times Lower fue usage PARKING AND LIGHTING Increased efficiency Power and cost savings New revenue opportunities CITY SERVICES Efficient service deivery Increased revenues Enhanced environmenta monitoring capabiities UNIK4750, Measurabe Security for IoT - #IoTSec Jan 2016, György Kámán, Josef No 23

24 The Connected Car * WIRELESS ROUTER Onine entertainment Mapping, dynamic re-routing, safety and security CONNECTED SENSORS Transform data to actionabe inteigence Enabe proactive maintenance Coision avoidance Fue efficiency URBAN CONNECTIVITY Reduced congestion Increased efficiency Safety (hazard avoidance) UNIK4750, Measurabe Security for IoT - #IoTSec Jan 2016, György Kámán, Josef No 24

25 IoT Expands Security Needs * Increased Attack Surface Threat Diversity Impact and Risk Remediation Protocos Compiance and Reguation Converged, Managed Network Resiience at Scae Security Distributed Inteigence Appication Enabement UNIK4750, Measurabe Security for IoT - #IoTSec Jan 2016, György Kámán, Josef No 25

26 IT/OT Converged Security Mode * IT DMZ OT Enterprise Network Demiitarized Zone Supervisory Coud Network Security Appication Contro Identity Services Secure Access Automation & Contro Config Mgmt UNIK4750, Measurabe Security for IoT - #IoTSec Jan 2016, György Kámán, Josef No 26

27 IT and OT are Inherenty Different * IT OT Connectivity: Any-to-Any Network Posture: Confidentiaity, Integrity, Avaiabiity (CIA) Security Soutions: Cybersecurity; Data Protection Response to Attacks: Quarantine/Shutdown to Mitigate Connectivity: Hierarchica Network Posture: Avaiabiity, Integrity, Confidentiaity (AIC) Security Soutions: Physica Access Contro; Safety Response to Attacks: Non-stop Operations/Mission Critica Never Stop, Even if Breached UNIK4750, Measurabe Security for IoT - #IoTSec Jan 2016, György Kámán, Josef No 27

28 What Can Breach IoT Networks? What can t? Biions of connected devices Secure and insecure ocations Security may or may not be buit in Life cyce mismatch between IT and automation devices Instaed base Cash between IT and OT, IT has to accept the traffic Any node on your network can potentiay provide access to the core UNIK4750, Measurabe Security for IoT - #IoTSec Jan 2016, György Kámán, Josef No 28

29 L1 Concusions Overview over ectures Expanation of portfoio and exam Introduction to topic bocks Discussion [Source: Monique Morrow, Cisco] UNIK4750 #IoTSecNO Jan 2016, György Kámán, Josef No 29