Each day, businesses are connecting thousands of devices to the internet. From conference room smart TVs to thermostats, most of these devices were purpose-built to perform a single function without security in mind. While this influx of technology is instrumental to the evolution of our digital age, it also presents a new layer of risk to organizations. With Gartner projecting the number of connected devices to reach 20 billion by 2020, even a small percentage of infected devices could present a major security threat to broader systems and networks.
Review of this article
Integration of IoTIn order to enforce the security of your connected objects you must think them as nodes in your networks.
The control of their access to your networks depends of their use. You can have 2 strategies, centralized and decentralized networks.
The centralized network strategy is the one that inherits from the cloud. Devices are just terminals that have access to ressources in the cloud. This technique is useful when you are in a highly covered but not secure Internet area. Your device does not contain data by itself, only a cache of the recently used data. Be careful as this cache is active. If you delete it and it synchronises later with the cloud, your data could be erased from the cloud. Use a trash or versioning system in your cloud and a backup.
The decentralized network strategy is the one that was imagined at the beginning of the Internet. Each device carries its own data and shares them with other devices. Each device has to take care of its own access control. It is a more scalable and performant strategy than the centralized one as it removes any bottleneck but it faces greater challenges in terms of security. Monitoring is not centralized and part of the network can be very hard to supervise. This technique is useful when you are in a badly covered Internet area. Devices are more independant and can do more without having to contact the rest of the World.
Specific tools to strengthen securityFor a centralized technique, these tools can help to integrate your devices:
The Nextcloud client for Android is useful to sync and keep versioning of your files with a centralized Nextcloud instance, for example.
The DavDroid app for Android is useful to sync your calendar and addressbook with a centralized caldav instance like Nextcloud, for example.
For a decentralized technique, these tools can help to integrate your devices:
The Silence app for Android is useful to send and receive encrypted SMS without any centralized infrastructure.
The K9Mail app with the OpenKeyChain app is useful to send and receive encrypted emails with GnuPG on an Android device.
For both techniques MyCrypNet can be used to really integrate your devices in your network as if they were on the same room.