Reader small image

You're reading from  Practical Industrial Internet of Things Security

Product typeBook
Published inJul 2018
PublisherPackt
ISBN-139781788832687
Edition1st Edition
Right arrow
Author (1)
Sravani Bhattacharjee
Sravani Bhattacharjee
author image
Sravani Bhattacharjee

Sravani Bhattacharjee was a technology leader at Cisco untill 2014, where she led the architectural planning and security evaluations of several enterprise cloud/datacenter solutions. She is currently the Principal of Irecamedia, where she collaborates with Industrial IoT innovators (incl. IBM, AT&T, Microsoft, and Intel) to strategize and create compelling whitepapers and a wide variety of editorial and technical marketing content that drives awareness and business decisions. She is a member of the IEEE IoT chapter, a writer, and a speaker. She is the Managing Editor of “The IoT Review”, a podcast and blogging platform on Industrial and Enterprise IoT (iot.irecamedia.com).
Read more about Sravani Bhattacharjee

Right arrow

Chapter 4. Endpoint Security and Trustworthiness

"Without security, there is no safety."                                               - Steve Hanna, Senior Principal, Infineon Technologies

The trustworthiness of an IIoT implementation is rooted in endpoint protection. In Chapter 1, An Unprecedented Opportunity at Stake, the tremendous business and social opportunities tied to the industrial internet were discussed at length. Inadequate trustworthiness at any point in the value chain poses a major threat to those optimistic claims. This further highlights the importance of securing IIoT endpoints.

An endpoint can be any node in the IIoT architecture that generates or receives data and/or control signals. An endpoint may also route data packets, or can be a storage device. As such, we need measurable and verifiable techniques to protect data at rest, data in use, and data in motion. Even in scenarios where the chances of a compromise are low, the importance of endpoint security cannot be underestimated...

Defining an IIoT endpoint


IIoT endpoints are often equated to the next generation of machines and IoT devices capable of network connectivity. These devices, however, are a subset of the endpoint universe in the context of security and trustworthiness. An IIoT endpoint can be any device or system in an IIoT implementation that generates, processes, routes, or stores data.

The IIC Vocabulary defines an endpoint as a "component that has computational capabilities and network connectivity." Thus, IIoT endpoints are not limited only to connected field devices, such as sensors, actuators, and plant equipment (turbines and so on), but include other nodes of an ICS/SCADA system (such as PLCs, RTUs, and DCS) and intermediator systems (such as industrial routers, firewalls, gateways, and edge devices), spanning all the way to cloud-based appliances and servers. Physical endpoints may have independent hardware and dedicated silicon fabric, or may run as virtual instances in virtualized environments...

Endpoint security enabling technologies


Endpoint security needs to span across hardware, firmware, and software, including network and application interfaces. To implement a trusted and resilient ecosystem of IIoT endpoints and subsystems, a variety of technologies come into play, as shown in the following diagram, which stacks the security technologies into hardware, intermediate, enhanced, and intelligent security layers. The main purpose of this classification is to give the reader an idea of the relative role and importance of each of these technologies that are available to protect endpoints:

Figure 4.3: Endpoint protection technologies

Subsequent sections of this chapter will further elaborate on some of these techniques.

Note

This technology stack is not designed to correlate with the levels of assurance presented in IEC 62443 3-3 and NIST SP 800-53r4. The best practices to implement assurance level based security for IIoT endpoints have been treated in IIC's Endpoint Security Best Practices...

IIoT endpoint vulnerabilities


Endpoint risk assessment and the implementation of security countermeasures require a thorough evaluation of the attack surfaces and attack vectors applicable to IIoT-specific use cases. Interested readers are encouraged to refer to the Industrial Internet Security Framework specification, which presents an elaborate analysis on "Security Threats and Vulnerabilities on Endpoints" (IIC-IISF). In this section, a few common threats and vulnerabilities associated with the various endpoint components are cited as examples:

Establishing trust in hardware


A trust anchor can be implemented in either software or hardware; the choice calls for a trade-off between the complexity and level of assurance. Compared to software-based trust, tamper-resistant hardware provides better trust performance, as it provides a RoT with the secured storage of secrets. Hardware-based trust consumes less power (IIC-IISF), which is an important consideration for resource-constrained environments. These benefits, however, come at the cost of complexities in managing firmware and crypto library updates. Hardware-based security is more rigid, and often involves static implementation. In some instances, due to a lack of update capability, hardware vulnerabilities may last throughout the life of the device. In recent years, innovations in trusted computing have significantly addressed some of these limitations.

Software-based trust is used in many IT systems. It provides a lower level of assurance, and as such, it should be carefully considered...

Endpoint identity and access control


Endpoint or device identity is a foundational building block in any trust model. Identity is a prerequisite for performing authentication, authorization, secured asset management, remote monitoring, management, and maintenance. Identification and Authentication Control is one of the seven foundational requirements in IEC 62443, and associates four assurance levels to it. These assurance levels correlate to the risk profiles of endpoints in a given IIoT use case:

"If no threat exists against the endpoint, clear text credential, such as identification numbers may be used. In some rare instances, it may not be required for all endpoints to support identity, but the risks should be well understood and documented. ISO/IEC 24760-1 defines three levels of trust for identities: identity, unique identity and secure identity. Industrie 4.0 provides information on what a secure identity technology consists of, and in the case of digital identity a secure identity...

Initialization and boot process integrity


The consequences of an infection in firmware or the boot process can be drastic, and often times, hardware replacement is the only option for failure recovery.

Measuring the device boot process enables the validation of its integrity and asserts that a device has powered up in a known good state. Given that devices may not be rebooted for long periods of time in OT environments, both static and dynamic integrity assurance of the runtime need to be implemented. The boot process initializes the main hardware components and starts the operating system.

Trust must be established in the boot environment before trust in any other software or executable program can be claimed. So, the booted environment must be verified and determined to be in an uncompromised state.

The primary firmware used to initialize the system is called the Basic Input/Output System (BIOS). (Author's note: Although the term BIOS is prevalent in the "computer world", to specify firmware...

Establishing endpoint trust during operations


Integrating robust trust mechanisms during the operations phase is crucial for industrial endpoints, which are expected to run uninterrupted for extended periods. Firmware is the most fundamental piece of code that runs on any device and interfaces directly with the hardware. It is important to ensure that the firmware and software are updated on a regular basis, to incorporate security bug fixes. 

Although the consequences of loading an infected firmware are typically irreversible, it is important to secure the update process for both software and firmware. In this section, we shall delve into secure update processes, and the mechanisms to establish endpoint trust during the operations phase.

Secure updates

Software and firmware are never fully devoid of vulnerabilities and defects; thus, regular upgrades to incorporate bug fixes and security updates are required.

Attackers can exploit vulnerabilities in the update or in the update process, or can...

Endpoint data integrity


The integrity of data is the very basis of data-driven business operations. Any compromise in the integrity of context-sensitive data can potentially compromise the entire IIoT value chain. Common examples of endpoint data include raw data, configuration and log files, secrets, software libraries, and binary executables. These can be classified into:

  • Data at rest (DAR), or stored data
  • Data in use (DIU); that is, files and data resources used at runtime
  • Data in motion (DIM); that is, data leaving the device

Integrity verifications enable the detection of any intended and malicious or unintended alterations in the data. The CRC checksum has traditionally been used to verify data integrity; however, the modern threat environment demands more advanced integrity controls, because an attacker can modify the checksum to match their changes to the data.

DAR integrity can be achieved by securely storing the secrets in hardware/TPM, or by using specialized software-enabled stores...

Endpoint security using isolation techniques


A practical acknowledgement of the information world is that vulnerabilities can be minimized, but their 100% eradication is only as real as catching the horizon. When the probability of an exploit cannot be totally eliminated, a practical prevention technique is to contain the impact of the exploit. Isolation techniques implemented in the hardware, software, and virtualized environments allow for minimizing the impact from an attack by a separation of territories.

To provide the reader with deeper insights into various isolation techniques, some of the common options are discussed in the following sections.

Process isolation

In process isolation, at runtime, the operating system isolates business and operational functional components from security components. Using a privilege-based hierarchy of protection domains, functions and data in more privileged layers are protected from an unintended or malicious failure in a less privileged layer (IIC-IISF...

Endpoint physical security


IIoT endpoints deployed as field devices can be exposed to extreme weather conditions, and are vulnerable to theft, hardware tampering, vandalism, and so on. Physical security mechanisms are discussed in greater detail in Chapter 5, Securing Connectivity and Communications. The interested reader may also refer to existing guidelines on endpoint physical security. Physical and Environmental Protection of NIST SP 800-53 (NIST-PE) provides information on methods for physical protection, access control, and monitoring. The Industrial Internet Security Framework (IIC-IISF) can also be referred to, to obtain detailed guidance on this topic.

 

Machine learning enabled endpoint security


Cybersecurity countermeasures have traditionally been reactive; in other words, the vaccine comes only after the virus has infected the system. The countermeasure typically follows the evaluation and remedy of a security incident. Cryptographic measurements and controls (to create trusted IIoT ecosystems) and anomaly detection functions address this reactive behavior. Host intrusion detection (HID) and host intrusion protection (HIP) are examples of dynamic integrity attestation controls to proactively secure an endpoint.

In IT environments, network and application blacklisting policies are commonly used. Whitelisting is more common in OT environments. But, when new exploits of zero-day vulnerabilities are detected, these policies are updated after the fact. AI/machine learning allows us to dynamically update blacklisting and whitelisting policies, based on anomalous behavior.

Machine learning extensively uses mathematical models based on historic...

Endpoint security testing and certification


For IIoT end users, equipment owners, and operators, it is crucial to ensure that the endpoint is adequately tested for security conformance. For device manufactures and OEMs, it is crucial to ensure that their equipment is trustworthy, in terms of both hardware and software. Often, time-to-market pressures and accelerated development cycles compete with adequate security testing. However, security verifications should be integral to the product development life cycle. While some vulnerabilities may still escape, proper security testing can significantly reduce their number. The sooner a vulnerability is detected in the product life cycle, the lower the cost of its repair, which also improves operational savings and brand reputation.

Some of the security test approaches for embedded systems include:

Endpoint protection industry standards


The various industry standards and references relevant to industrial endpoint security are provided in Table 4.3:

Table 4.3: Standards and references related to industrial endpoint security

 

 

Summary


This chapter covers the essential dimensions of IIoT endpoint security. It establishes an working definition of IIoT endpoints and discusses various use-case specific considerations for securing them. A real-world case study is cited to illustrate the vulnerabilities of typical industrial device endpoints. In this chapter the reader also finds an elaborate treatment of the endpoint security enabler technologies which spans the silicon, software and processes. The increasing use of machine learning and the importance of testing and certifications using industry standards have also been discussed in this chapter.

Chapter 5, Securing Connectivity and Communications, focuses on the next level of the 4-tier IIoT security model. 

lock icon
The rest of the chapter is locked
You have been reading a chapter from
Practical Industrial Internet of Things Security
Published in: Jul 2018Publisher: PacktISBN-13: 9781788832687
Register for a free Packt account to unlock a world of extra content!
A free Packt account unlocks extra newsletters, articles, discounted offers, and much more. Start advancing your knowledge today.
undefined
Unlock this book and the full library FREE for 7 days
Get unlimited access to 7000+ expert-authored eBooks and videos courses covering every tech area you can think of
Renews at $15.99/month. Cancel anytime

Author (1)

author image
Sravani Bhattacharjee

Sravani Bhattacharjee was a technology leader at Cisco untill 2014, where she led the architectural planning and security evaluations of several enterprise cloud/datacenter solutions. She is currently the Principal of Irecamedia, where she collaborates with Industrial IoT innovators (incl. IBM, AT&T, Microsoft, and Intel) to strategize and create compelling whitepapers and a wide variety of editorial and technical marketing content that drives awareness and business decisions. She is a member of the IEEE IoT chapter, a writer, and a speaker. She is the Managing Editor of “The IoT Review”, a podcast and blogging platform on Industrial and Enterprise IoT (iot.irecamedia.com).
Read more about Sravani Bhattacharjee

Endpoint component

Threats and Vulnerability

 

 

Hardware

  • Unauthorized seizure of system resources, such as memory, processing cycles, and privileged access modes (privilege escalation exploit)
  • Improper endpoint initialization by corrupting UEFI/BIOS and corrupting the boot process

 

 

 

Firmware

  • Steal code signing key or inject corrupted firmware through tampering
  • Exploit vulnerabilities in code signing and firmware update process
  • Rewrite firmware through...