Big question marks still hang over Internet of Things (IoT) security. Ever since the unprecedented Distributed Denial of Service (DDoS) attack – the Mirai botnet – that compromised as many as 100,000 connected devices in 2016, nearly bringing the internet to its knees in the process, IoT security has remained a huge concern for businesses the world over. Could blockchain be the answer?
According to a recent report by Armis – a provider of IoT security software for enterprises that focuses on detecting threats in IoT devices at workplaces – nearly half a billion connected business devices around the globe are currently sitting vulnerable to a ten-year-old security flaw. The web exploit in question is known as DNS rebinding, which allows an attacker to bypass a network firewall and use a victim’s web browser to access other vulnerable devices on the network. A vulnerable device, Armis explains, is one that is running an unauthenticated protocol like Universal Plug and Play (UPnP) or HTTP (used on unencrypted web servers). According to Armis, these protocols are pervasive in businesses, as they are commonly used to host administrative consoles (for routers, printers, IP cameras, etc.) or to allow easy access to the device’s services (for example, streaming video players).
Armis found that large enterprises are currently very exposed to DNS rebinding attacks. In fact, the research team uncovered that the majority of manufacturers who make commonly-used IoT devices for enterprise environments ship devices that are inherently vulnerable. According to the report, the impacted devices include 87% of switches, routers and access points, 78% of streaming media players and speakers, 77% of IP phones, 75% of IP cameras, 66% of printers, and 57% of smart TVs. In all, this equates to around 496 million devices – which Armis says is a conservative estimate.
(Image source: armis.com)
Blockchain and IoT
In order for the internet to work effectively – i.e. for it to route user’s requests to the right server and return the correct results in a timely manner – it relies on Domain Name Systems (DNSs). It was these services that were attacked by the Mirai malware. Hackers used massive networks of botnets to attack systems operated by DNS provider Dyn, whose clients included internet giants Neflix, Twitter, LinkedIn, Salesforce and others, causing massive global disruption.
And it’s this very centralized architecture that’s the problem for security experts – and such a big opportunity for cybercriminals. As long as the internet relies on a concentrated number of services to keep everything running smoothly, these services will always be an attractive target. What’s more, due to the nature of DDoS attacks – which flood users’ systems with millions of requests from compromised IoT devices – companies the world over will always be left exposed, hoping that they aren’t the next to be targeted.
And this is where blockchain could come into play. The IoT’s ability to secure billions of devices connected to the unwieldy internet has always been a concern. But blockchain technology could significantly reduce the risk of IoT devices becoming compromised via a central authority. Unlike today’s centralized systems, blockchain is completely distributed, meaning it’s much, much harder to attack, let alone take down. So, the theory is that if you can create a decentralized DNS system, DDoS attacks would become impossible to instigate.
Tightened Security
Best known for being the technology that underpins cryptocurrencies – most notably bitcoin – blockchain, in fact, has many applications in many industries the world over. In retail, for instance, technology is used to simplify and secure the movement of products through supply chains. And in the pharmaceutical industry, blockchain ensures the integrity of clinical trials, contracts, the drugs themselves, and the supply chain once again.
How? Well, blockchain works as a decentralized distributed ledger, designed to create tamper-proof and real-time records. It allows multiple parties to record transactions between each other efficiently, securely, and permanently – once recorded, it’s impossible to manipulate information within the chain. As more entries – i.e. blocks – are entered into it, a longer chain of events is created. As such, the distributed ledger becomes a single source of truth for all transactions, bypassing the need for third-party verification.
When it comes to enterprise IoT security, blockchain can significantly reduce the risk of DDoS attacks that affect multiple devices at once. In order for IoT data to be trusted, all trust requests are aggregated in a single location, creating just one single point of security intelligence that can compromise IoT security and lead to botnet attacks. During these attacks, IoT devices are unable to adapt their behavior, as they are unable to make security decisions without the authorization of a central authority.
Blockchain’s decentralized approach eliminates this single point of decision-making that ultimately leads to security failure. This is because the technology enables device networks to protect themselves by allowing devices to form group consensus about what is considered normal behavior within a given network, and to subsequently quarantine any nodes that are deemed to be performing irregularly. In theory, this would prevent a compromised device from pushing false information to others, thusly preventing massive disruption to the network.
Merging blockchain with IoT can also address the issue of forming trust in IoT data. For starters, with blockchain, each IoT device would have strong cryptography, which ensures both secure and anonymous communication with other devices. In addition, data in a distributed ledger is stored in many locations, and is always accessible to users. What’s more, because all data stored on a blockchain is accompanied by a digital signature that can never be changed or deleted, each device is accountable for its actions and a complete chain of events is permanently logged. Not only will this restore trust in IoT data, but also, in the event of an attempted attack, the blockchain record would be able to identify the point – a device or a sensor – where something is going wrong, and the business can take immediate action.
Final Thoughts
Blockchain for IoT security is already gaining some momentum. Xage Security, for example, touts itself as the world’s first security platform for Industrial IoT (IIoT). Xage’s solution for creating a security fabric for IoT is to build a trusted network of people, machines and applications on a distributed ledger, forging an irrefutable connection between all entities and preventing anyone who has not been given explicit permission from gaining access. “The blockchain is operating like a distributed, redundant tamper-proof data store. It connects with policies pushed from the cloud or configured locally. The [security] fabric enables the devices and AI and people to communicate with each other and controls the flow of information,” explained Xage CEO Duncan Greatwood. If the blockchain at its core is a trusted mechanism, then it can give companies the confidence that their IoT devices can’t be compromised, he added.
Whether blockchain eventually proves to be the answer to IoT security concerns remains to be seen – though it certainly looks promising. The technology is ideally suited to IoT’s needs. With the ability to coordinate and track billions of connected devices and securely process transactions between them, a decentralized distributed ledger approach eliminates single points of failure, creating a more resilient ecosystem for IoT devices to run on. The missing link for secure enterprise IoT deployment? It might just be.
Securing the Internet of Things
Big question marks still hang over Internet of Things (IoT) security. The IoT’s ability to secure billions of devices connected to the unwieldy internet has always been a concern. But blockchain technology could significantly reduce the risk of IoT devices becoming compromised via a central authority. Unlike today’s centralized systems, blockchain is completely distributed, meaning it’s much, much harder to attack, let alone take down. So, the theory is that if you can create a decentralized DNS system, DDoS attacks would become impossible to instigate. Best known for being the technology that underpins cryptocurrencies – most notably bitcoin – blockchain, in fact, has many applications in many industries the world over. In retail, for instance, technology is used to simplify and secure the movement of products through supply chains. And in the pharmaceutical industry, blockchain ensures the integrity of clinical trials, contracts, the drugs themselves, and the supply chain once again. Blockchain works as a decentralized distributed ledger, designed to create tamper-proof and real-time records. It allows multiple parties to record transactions between each other efficiently, securely, and permanently – once recorded, it’s impossible to manipulate information within the chain. As more entries – i.e. blocks – are entered into it, a longer chain of events is created. As such, the distributed ledger becomes a single source of truth for all transactions, bypassing the need for third-party verification.
