Demystifying applied IoT and security considerations
Senior Lecturer in Cyber Security and IoT at Liverpool John Moores University Áine MacDermott explores the potential of further IoT innovations and the security concerns connected with this progress.
The IoT is the seamless merging of the real and digital world, with new devices created that store and share data. The IoT paradigm has rapidly evolved over the last few years and envisions the Internet as a set of intelligent, self-configuring and interconnected objects, in a dynamic and global infrastructure.
These objects refer to uniquely addressable smart devices that are generally distributed endowed with sensing and actuation capabilities and equipped with limited computing resources such as CPU, memory, and network capabilities. Additionally, Industrial Internet of Things (IIoT) describes IoT devices that monitor production processes and capture data for quality control and management. IoT/IIoT applications include healthcare, smart grids, smart homes/smart city, big data, wearable technology, remote monitoring, and the automation of day-to-day operations.
This technological progression brings everything ‘online’ in a connectedness that generates an explosion of connected devices, from fridges, cars and drones, to smart swarms, smart grids and intelligent buildings.
Application: smart grid and smart meters
Sensors play an important role in the IoT and their usage will undoubtedly increase as technology advances even further. Their uses include detecting and monitoring change in temperature, light, pressure, sound and humidity. Likewise, their uses in industry are wide reaching which include, safety and security, and within our personal gadgets and devices. The implementation of the Smart Grid brings many improvements over the traditional energy grid. One of the key differences over the existing grid is the introduction of the advanced metering infrastructure (AMI) which contains many new components such as the smart meter and the communication gateways that provide usage information to all of the grids stakeholders in real time.
The main aims of the smart grid are to provide improved reliability, efficiency and security – both physical and cyber. The very nature of the smart grid means that it is a vastly complicated system, comprising of multiple layers of architecture that are automated and interconnected from generation, distribution, and consumption. Smart meters are a key and fundamental component to the smart grid, allowing the automatic collection and storing of detailed energy usage information. In the UK, 50 million gas and electric smart meters are to be installed in both residential and commercial properties by 2020. The use of Big Data and analytics in conjunction with this can help gain profile usage based on applications, households, devices and specific energy usage. This information can also be used to establish a routine of a household by detecting the use of specific electrical devices.
Benefits
The adoption of IoT is driving the growth of sensor technology that enhance many aspects of daily life. Cloud computing and the IoT both serve to increase efficiency in everyday tasks and both have a complementary relationship. The IoT generates massive amounts of data, and cloud computing provides the processing capabilities. Smart meters upload a variety of data from the consumer’s usage to power generation, and analysis of this data is vital to help manage grid performance. However, alternative uses beyond the traditional uses of generation, distribution and generation become possible with the introduction of IoT.
“The IoT does not replace the existing ICT or operational technology networks; rather, it enhances these networks and relies on them in many ways.”
IoT is becoming the underlying technology for ambient assistive living (AAL) due to its flexibility and unobtrusiveness. AAL is the study of using technology for assistive living, and this mass collection of data has social and health benefits. Researchers at Liverpool John Moores University have conducted studies utilising this valuable data to provide an innovative remote patient monitoring system. The system interfaces directly with a patient’s smart meter, enabling it to distinguish reliably between subtle changes in energy usage in real-time. This research detects changes in energy usage patterns that are the result of an onset of a self-limiting condition, such as depression, or the sign of deterioration in a patient with a known illness, such as Alzheimer’s. The ultimate aim is to unlock the social benefits of these smart meters for uses in assistive living and healthcare. IoT devices bring many benefits while unlocking applications which where impossible using traditional computing technology.
Issues
Within the IoT paradigm, essentially anything can be connected, which is a threat in itself. That is why businesses need a robust strategy to protect themselves, and their data. As a result, IoT is creating a wider attack surface, with billions of new and emerging devices. There has been a rise in IoT malware – “Mirai” found in August 2016, is a zombie malware strain that enslaved IoT devices such as wireless routers, security cameras and digital video recorders for use in large-scale online attacks. Variations of this malware include Satori, IoTroop, Amnesia, IoT_Reaper, built to spread automatically from one infected device to another. This malware, designed to spread like computer worms, is used to launch distributed denial of service (DDoS) attacks. There are hundreds of thousands of IoT devices which use default settings, making them vulnerable to infection. Once infected, the device will monitor a command and control server, which indicates the target of an attack. Early IoT malware families like Gafgyt and the original Mirai family leveraged default or weak passwords to attack devices.
IoT inherits the same monitoring requirements from cloud computing, however the related challenges are further affected by the characteristics of volume, variety, and velocity. If smart meters, the AMI, or the provider infrastructures were targeted by DDoS attacks, the impact would be detrimental. Network-based attacks would affect the dynamic operation of the smart grid as a whole, which might have economic implications for users or providers. In extreme cases, it might even affect the energy delivery grid itself as, in the future, this will rely on real-time usage data to dynamically reconfigure the infrastructure to meet current demand.
Both smart grid and smart meter data is very informative. This information can be personalised and visualised using machine learning. You can determine the routine of an individual, but how much is too much information? The use of artificial intelligence (AI) could highlight the use of the data for a range of reasons. Using Big Data analytics, we are able to analyse the usage of devices to an individual. There are also many ethical and privacy concerns associated with the smart meter role out, which could potentially leave consumers vulnerable to exploitation. Access to smart meter data is tightly governed, but what if the data fell into the wrong hands? For example, criminals could process data that is generated by the AMI to identify when households are unoccupied, helping to facilitate burglary or other crimes. Additionally, being able to identify which appliances are in use based on smart meter data, would allow burglars to identify and target households with the most electronic devices (Chalmers et al., 2016).
Conclusion
The IoT does not replace the existing ICT or operational technology networks; rather, it enhances these networks and relies on them in many ways. IoT devices bring many benefits while unlocking applications which where impossible using traditional computing technology. Recognising all these aspects working together, cyber security and physical security solutions must also work together with a coordinated focus on threats. Cyber security policies will require revision, as each IoT device generates data that is stored in the cloud. Edge computing policies should be integrated with IoT infrastructure to have quick responses for any suspicious activity. Containing an IoT breach is increasingly challenging – evidence is no longer restricted to a PC or mobile device, but can be found in vehicles, RFID cards, and smart devices.
Addressing security concerns will rely on a new era of digital forensics and best practices to simultaneously verify and leverage physical and digital evidence within a changing regulatory landscape. Post incident evidence can be collected from fixed sensors in homes and buildings, moving sensors built into cars and wearable devices, communication devices, cloud storage and even ISP logs. We anticipate that the practical study of this emerging field will identify methods for performing IoT-based digital forensic analysis.
