Kevin Kwang: My baby monitor started a cyberattack? IoT industry suffering from security growth pains
There are currently no established Internet of Things security standards, and Singapore recognises that steps need to be taken to ensure minimum standards of protections in this space, says CSA.
SINGAPORE: Remember the time when StarHub’s broadband services suffered two outages, and the telco attributed them to cyberattacks on customers' compromised Web devices such as webcams and routers?
Or reports that hackers are spying on us through our baby monitors and home cameras?
Just this February, an Austrian cybersecurity company SEC Consult warned that the baby monitor Mi-Cam by Hong Kong-based company miSafes has vulnerabilities that would allow hackers to spy on the device including video footage. The device has more than 50,000 users.
These Internet security concerns are increasingly pushing themselves to the surface as more and more devices get connected to the Internet. And many of them are home appliances like fridges, washing machines and, yes, baby monitors that were not traditionally associated with being on the World Wide Web.
For manufacturers, security is a cost, said Mr Frederic Donck, regional bureau director for Europe at Internet Society.
If they do not have a compelling reason to factor it in their process - say, from regulation - then they would not, he added, shedding more light on the state of affairs.
“These are guys who don’t know about security issues,” Mr Donck said in an interview. “If I’m a small company making children’s toys in China, why would I care about securing how these are connected to the Internet?”
It is not just the makers of these Internet-enabled devices. More thought should also be paid to when consumers discard these appliances, Mr Donck pointed out.
“What happens to that toy or device that is discarded but continues to send data?” the Internet Society executive said. “The ability to switch off (a device’s Internet connectivity) should be enabled.”
Internet of Things (IoT) network operator, Unabiz, concurred, saying that security has to be addressed across the entire production cycle.
“As a matter of fact, security is most times an afterthought (when) it should be by design,” it said.
HACK ONE, EXPOSE ALL
If we see the issue of IoT security in the context of the wider cybersecurity ecosystem, then the problem becomes more acute.
Mr Francis Prince Thangasamy, vice president of IT Services and Managed Hosting for Asia Pacific at CenturyLink, said with Singapore being an important business and technology hub in the region, its systems are “ripe targets”.
Mr Thangasamy said: “Enterprises, services and networks are interconnected with thousands of companies and billions of devices worldwide.
A single successful cyberattack on any parts of the ecosystem will open up access to the entire network and sensitive data within and beyond the organisation or country, making it complex to manage and secure.”
Additionally, the country sits in a region that botnets - networks of compromised computer systems that can be remotely controlled by hackers to conduct cyberattacks - are rife.
The CenturyLink 2018 Threat Report showed that the top 5 Asia Pacific countries with bots are China, India, Japan, Taiwan and South Korea - with China coming in second and India tenth in the global rankings.
SMART CITIES? SECURE THEM TOO
This issue of securing Internet-connected devices take on an added layer of importance and urgency when you consider how governments around the world are moving towards using these to enhance urban planning and management of their cities and countries.
Singapore, for example, has stated its intention to fit its streetlights with sensors that could potentially help with everything from monitoring the climate to implementing facial recognition tools to track errant motorists or flag when an accident has taken place.
This project is part of its Smart Nation Sensor Platform - one of five strategic national projects underpinning its Smart Nation ambitions.
Asked how the Government intends to secure these systems as they get rolled out, the Cyber Security Agency of Singapore (CSA) told Channel NewsAsia that agencies work closely to make sure that a device or project’s security design and architecture is resilient.
Elaborating, CSA said it actively advocates a “security-by-design” motto in project implementation and this involves a three-step process. The first is to conduct threat risk assessments to identify the device or network to protect and what are the potential consequences if security is compromised.
The second step is to review the system design and incorporating security considerations and requirements, while the last step is to carry out acceptance tests to make sure security measures are in place to address potential security risks.
“Subscribing to security-by-design reduces piecemeal implementation and the need for costly and often ineffective retrofitting,” the agency explained.
That said, CSA pointed out that there are currently no established IoT security standards.
This lack of standardisation is highlighted through the responses of two well-established consumer electronics giants and their stance in securing appliances.
Korean manufacturer LG, for instance, said that there are no specific guidelines, here or other markets, to securing its devices like smart TVs. It noted its smart TVs are certified by Underwriters Laboratories’ Cybersecurity Assurance Program as well as Common Criteria, an international standard for computer security.
Another major player, Samsung, pointed us to its blog that stated it has incorporated its mobile security technology Knox to its other connected devices like smart TVs and signages. “Knox technology includes a hardware security system and firmware updates to ensure devices are protected,” it wrote.
CERTIFICATION SCHEME FOR IOT DEVICES BEING EXPLORED
CSA, for its part, said Singapore “recognises that steps need to be taken” to ensure IoT products and services meet minimum standards of protection.
Already, at the national level, several technical references relating to this have been published. For instance, TR64 was recently developed and published by the IT Standards Committee, under the ambit of the Singapore Standards Council, and it provides guidelines to safeguard the confidentiality, integrity and availability of large-scale IoT systems.
It will also be exploring an evaluation and certification scheme to provide a security hygiene benchmark for IoT devices, the agency revealed.
This was a suggestion made by Internet Society’s Mr Donck too, who said IoT manufacturers need to be more accountable and invest in security.
The organisation, in its IoT security for policymakers paper published this April, recommended credible security certification schemes as a means to increase the incentives to invest in security.
“Certification, by which an organisation signals that a product, service or system has passed a set of quality or performance tests, can be a powerful and visible signal of compliance to know whether an IoT device uses best practices or standards,” it said.
Mr Donck suggested a certification scheme similar to what consumers see with washing machines, TVs and air-conditioners today: A visible indicator to show how water or power efficient the devices are, so consumers can make a more informed choice.
At the end of the day, having a secure IoT ecosystem benefits everyone - from the parent using a baby monitor to the government looking to tap on sensor data to better manage the country.
“Security is one of the key factors driving IoT adoption,” CSA said.
“Without the assurance of security, Singapore will not be able to ride on the IoT wave and benefit from its far-reaching possibilities.”Source: channelnewsasia
- Security Monitoring and Vulnerability Analyst, End User. PCI Level 1 Service Provider.
CH7843 Security Monitoring and Vulnerability Analyst, End User. Level 1 Service Provider. £50,000 London Security Monitoring and Vulnerability Analyst needed to join an Level 1 Service Provider. The Security Analyst will be responsible monitoring, configuring, fine tuning and generally improving the security tool capability. Specific experience with Tripwire Log Center and Tripwire Enterprise is highly desirable. Other security tools experience should include the managing and monitoring of firewalls, Anti Phishing, AV, vulnerability management, IAM etc. Current experience with Vulnerability management and penetration testing is highly desirable. Specifically the ability to effectively manage 3rd party pen tests. Hands on penetration testing is a very nice to have. You will be working within a specialist security team reporting to the CISO. Experience working within an end user environment within financial services is highly desirable. Flexible location. This is an exclusive role to DCL Search & Selection. https://calendly.com/chris-holt/arranged-call-with-chris-holt-soc-role-clone
- Internal Security Auditor, Level 1 Service Provider (ISO27001)
- Upto 65,000 plus benefits
Internal Security Auditor ISO 27001, PCI, needed to join a Cyber team within this expanding Fintech business. The Internal Security Auditor will have end to end responsibility for planning, delivering, remediating any findings etc. Experience working within financial services is highly desirable. This Is a great time to join a newly formed and growing Cyber team within a rapidly expanding fintech, that is taking a major share of its market. We are looking for someone with experience, (but not to be limited to) a mix of Information Security standards, frameworks, audit principles, controls / policies and the management and use of the technical tooling etc. ISO 22301, ISO 27001, NIST Cybersecurity Framework etc An ideal candidate will be working within an end user environment with a cyber consultancy background. Experience taking a company through accreditation is highly desirable Experience managing internal stakeholders, technical teams and external third parties essential Flexible working, but with the ability to get into London. This is an exclusive role to DCL Search & Selection.
- DevOps Engineer with IdAM
- Upto £80,000 plus benefits
We are ooking for an DevOps engineer, idealy with IdAM (identity access Management) experience, this is a senior role for someone that can be the lead hands on person on a project. Your role will be to work on the deployment project implementing the solution into the exsiting application so will be used to connect an applications into mulipe 3rd party appliactions. We Would look at someone who has done DevOps with Security and can cross train into IdaM, but preference would be given to someone with the IdAM experience this is a great opportunity to join a consultancy that work on some truely amazing and differnet solutions
- Senior SOC Analyst. Level 3 Palo Alto Wildfire, Rapid 7, Fortify, Splunk.
REF CH7840 Senior SOC analyst (Palo Alto Wildfire, Rapid 7, Fortify AND Splunk) Flexible location £55,000 + Senior SOC analyst needed (Level 3) that can achieve SC clearance for a permanent role. We are looking for Level 3 SOC Analysts with two or more of the following; Palo Alto Networks Wildfire (#malware) Rapid7 Nexpose Micro Focus Fortify (#automated #applicationsecurity) AND ideally Splunk. The role will include, but not be limited to; managing and handling incidents end to end, supporting and mentoring level 1 / level 2 staff, supporting the SOC manager in the delivery of the SOC roadmap, engaging with the client stakeholders (other technical teams) as and where needed, use case development, advanced search and reporting etc. Flexible location, commutable in the future to London or Birmingham This role will sit within a public sector client so the individual must be able to achieve SC clearance. To arrange a call with Chris Holt use this calendy link https://calendly.com/chris-holt/arranged-call-with-chris-holt-remote-soc-role Chris.Holt@dclsearch.com 07884666351