Cybersecurity Concepts

IoT designers and engineers need to understand cybersecurity concepts. This will help them understand the various attacks that can be conducted against IoT devices and how to implement security mechanisms to protect them against cyber attacks. This section discusses some cybersecurity concepts required to understand IoT security.

Cybersecurity refers to the technologies, strategies, and practices designed to prevent cyberattacks and mitigate the risk posed by cyberattacks on information systems and other cyber-physical systems. It is sometimes called information technology security, which involves developing and implementing technologies, protocols, and policies to protect information systems against data theft, illegal manipulation, and service interruption. The main goal of cybersecurity systems is to protect the hardware and software systems, networks, and data of individuals and organisations against cybersecurity attacks that may bridge these systems' confidentiality, integrity, and availability.

After understanding cybersecurity, it is also essential to understand what a cyberattack is. A cyberattack can be considered any deliberate compromise of an information system's confidentiality, integrity, or availability. That is unauthorised access to a network, computer system or digital device with a malicious intention to steal, expose, alter, disable, or destroy data, applications or other assets. A successful cyberattack can cause a lot of damage to its victims, ranging from loss of data to financial losses. An organisation whose systems have been compromised by a successful cyber attack could lose its reputation and be forced to pay for damages incurred by customers due to a successful cybersecurity attack.

The question is why should we be worried about cybersecurity attacks, especially in the context of IoT. The widespread adoption of IoT to improve business processes and personal well-being has exponentially increased the options available to cybercriminals to conduct cybersecurity attacks, increasing cybersecurity-related risks for businesses and individuals. This underscores the need for IoT engineers, IT engineers, and other non-IT employees to understand cybersecurity concepts.

The CIA triad is a conceptual framework that combines three cybersecurity concepts, confidentiality, integrity, and availability, to provide a simple and complete checklist for implementing, evaluating, and improving cybersecurity systems. They form a set of requirements that a well-designed cybersecurity system must sacrifice to ensure information systems' confidentiality, integrity, and availability. It provides a powerful approach to identify vulnerabilities and threats in information systems and then implement appropriate technologies and policies to protect the information systems from being compromised. It provides a high-level framework that guides organisations and cybersecurity experts when designing, implementing, evaluating, and auditing information systems. In the following paragraphs, we briefly discuss the elements of the CIA triad (figure 1).

Confidentiality

It involves the technologies and strategies to ensure that sensitive data is kept private and inaccessible to unauthorised individuals. That is, sensitive data should be viewed only by authorised individuals within the organisation and kept private from unauthorised individuals. Some of the data collected by IoT sensors is very sensitive, and it must be kept private and should not be viewed by unauthorised individuals with malicious intentions. Data confidentiality involves a set of technologies, protocols, and policies designed and implemented to protect data against unintentional, unlawful, or unauthorised access, disclosure, or theft. To ensure data confidentiality, it is essential to answer the following questions:

• Who should be able to view the data or have access to the data?
• Are there laws, regulations, or contracts that require the data to be confidential?
• Are there specific conditions under which the data may be used or disclosed?
• How sensitive is the data, and what consequences may be faced if unauthorised individuals access the data?
• How valuable can the data be to unauthorised individuals (e.g., cybercriminals) if they can access it?

To ensure the confidentiality of the data stored in computer systems and transported through computer and telecommunication networks, some security guidelines should be followed:

• Encrypt sensitive data during storage in computer systems and transportation through computer and telecommunication networks. Encryption renders the data unreadable or unintelligible to unauthorised persons, and only those who possess the appropriate keys can decrypt and access the data. The encryption scheme used is kept confidential, and unauthorised individuals cannot access it unless the encryption scheme used is compromised.
• Proper data access management is needed to ensure that only authorised individuals with the proper privileges can access the data. Users should always authenticate themselves using strong passwords, and multi-factor (e.g., two-factor) authentication should be used where possible. Also, users' access rights or privileges should be regularly reviewed, and unnecessary rights or privileges should be revoked.
• The physical location of hardware systems and paper documents should be secured appropriately. Just as it is essential to control remote access to digital systems, access to the physical location where the hardware and other critical assets are stored should also be thoroughly controlled. Even paper documents should be properly sorted and stored in secure locations, and access must be controlled.
• Any data, hardware devices, and paper documents no longer needed should be securely disposed of immediately.
• Care must be taken to ensure data privacy or confidentiality is not compromised, especially for sensitive data. If it is possible to do so without collecting sensitive data, then it should not be collected, as one of the ways to avoid the risk of handling sensitive data is not to collect it in the first place if it's possible to do without it.
• Sensitive data should be used only when necessary; otherwise, it should not be used to preserve its confidentiality.
• Appropriate security systems should be implemented to ensure data confidentiality. Some of these measures include access control systems (e.g., firewalls), threat management systems, and attack detection and prevention systems.

Integrity

Integrity in cybersecurity involves technologies and strategies designed to ensure that data is not modified or deleted during storage or transportation by unauthorised persons. It is essential to maintain the integrity of the data to ensure that it is consistent, accurate, and reliable. In the context of IoT, integrity is the assurance that the data collected by the IoT sensors is not illegally altered during transportation, processing, and storage, making it incomplete, inaccurate, inconsistent, and unreliable. The data can only be modified or changed by those authorised to access it. The collected data must be kept complete, accurate, consistent and safe throughout its entire lifecycle in the following ways ^[1]:

• To ensure it is complete, the data must be maintained in full form with no data elements filtered, truncated or lost.
• The accuracy of the data is preserved by ensuring that the data is not altered or aggregated either by human error or malicious attacks in such a way that affects the results of further processing and analysis of the data.
• The consistency of the data should be maintained by ensuring that the data is unchanged regardless of how often it's accessed and no matter how long it's stored.
• Data safety should be ensured by guaranteeing it is securely maintained and accessed only by authorised applications and individuals. Data security methods such as authentication, authorisation, encryption, backups, etc., can ensure that unauthorised applications or individuals do not alter or destroy the data.

The IoT system designers, manufacturers, developers, and operators should ensure that the data collected is not lost, leaked, or corrupted during transportation, processing, or storage. As the data collected by IoT sensors is growing and lots of companies depend on the results from the processing of IoT data for decision-making, it is vital to ensure the integrity of the data. It must be assured that the IoT data collected is complete, accurate, consistent and secure throughout its lifecycle, as compromised data is of little or no interest to organisations and users. Also, data losses due to human error and cyberattacks are undesirable for organisations and users. Physical and logical factors can influence the integrity of the data.

• Physical integrity: It includes the various ways the integrity of the data can be compromised during transportation, storage and retrieval. During the transportation of data, some parts of the data could be lost due to packet losses occurring at the network equipment or packet errors caused by a disturbance in the transmission media. Also, data could be lost due to physical damage to the storage or computing devices. The integrity of the data could be compromised due to the following reasons:
  • Hardware failures and faults.
  • Design failures and negligence.
  • Natural failures may result from the deterioration of the hardware device (e.g., corrosion).
  • Power failures and outages.
  • Natural disasters.
  • Environmentally induced failures resulting from extreme environmental failures like high temperatures.
  • Cyberattacks designed to cause hardware or power failures (e.g., energy depletion attacks).

The physical integrity of data could be enforced by:

• Implementing redundancy in data storage systems to ensure that failure of a storage memory will not result in data losses.
• Implementing battery-protected write cache.
• Deploying storage systems with advanced error-correcting memory devices.
• Implementing clustered and distributed file systems.
• Implementing error-detection algorithms to detect any changes in the data during transportation.
• Deploying backups that are located in different physical locations.
• Implement network protection mechanisms to ensure the data is not corrupted or lost during transportation.

IoT system designers, manufacturers, and developers can adopt various technologies and policies to ensure the integrity of the hardware from the IoT devices and communication to fog/cloud data centres.

• Logical integrity: Even with no hardware issues, there can still be unintended or malicious alterations in the data or data losses during transportation, storage, and retrieval that could alter its integrity. Software design flaws, bugs, poor network configurations, human error, and cyberattacks can compromise logical integrity. Some of the data integrity risks include:
  • Data may be deleted, wrongly entered, and illegally altered in the storage system.
  • Data may be damaged, lost, or illegally altered during transportation.
  • Data may be stolen, damaged, or illegally altered by a malicious hacker after a successful cyberattack.
  • Poor network and infrastructure configuration may cause data to be stolen, damaged, lost, or illegally altered.

Enforcing data integrity is a complex task that requires carefully integrating cybersecurity tools, policies, regulations, and people. Some of the ways that data integrity can be enforced include but are not limited to the following strategies:

• Access to the data should be strictly controlled using effective authentication and authorisation tools to ensure that unauthorised persons do not manipulate it.
• Logs of users' actions should be created and carefully audited to keep track of their changes.
• Data should be encrypted during transportation and storage to ensure that it is not altered or damaged during transportation or storage.
• Data protection mechanisms should be used to prevent data losses. For example, data should be backed up regularly, and error detection and correction communication algorithms should be used.
• When accessing data to process or analyse it, necessary steps should be taken to ensure that it is not corrupted, lost, or damaged, primarily when it is accessed by third parties for analysis.
• The employees and other stakeholders should be trained to handle the data so that its integrity is not lost, altered, or damaged.

Availability

The computing, communication, and data storage and retrieval systems should be accessible anytime and when needed. Availability in the context of cybersecurity is the ability of authorised users or applications to have reliable access to the information systems when necessary at any time. It is one of the elements of the CIA triad that constitutes the requirement for designing secure and reliable information and communication systems such as IoT. Given that IoT nodes are being integrated into critical infrastructure and other existing infrastructure of companies and individuals, longer downtimes are not tolerated, making availability a crucial requirement. Availability disruption could result from any of the following causes:

• Hardware failures that may result from natural failures resulting from deterioration.
• Software failures that may result from software design flaws or bugs.
• Cyberattacks, e.g., DoS/DDoS, energy depletion attack in the case of an IoT node.
• Power failure may result from power outages or depletion of energy stored in the battery in the case of IoT nodes.
• Data damage, corruption, or losses during transportation or storage and retrieval that prevent authorised users and applications from accessing the data when needed.
• Bandwidth bottlenecks and link failures in the communication network that interfere with data transfer to users and applications that need them.
• The downtimes could result from failure, misbehaviour, or malfunctioning of the cybersecurity systems.
• Data to the computing, communication and storage infrastructure resulting from natural disasters, theft, vandalisation, political unrest, or conflict.

Some of the ways to ensure the availability of information systems and data include the following:

• Creating data backups and storing the backup systems in different geographical locations.
• Ensuring effective operation and maintenance processes.
• Ensuring effective and efficient energy sources and energy storage systems.
• Energy consumption should be minimised to increase the lifetime of IoT nodes.
• Software design flaws and bugs should be resolved immediately and quickly to minimise downtimes.
• The physical storage locations of hardware infrastructure should be carefully secured.
• Effective authentication and authorisation mechanisms should ensure that authorised users can access the systems when needed.
• Cybersecurity systems should be carefully implemented and configured to minimise performance degradation and downtimes resulting from malfunctioning.
• Ensuring the networking systems are correctly configured with appropriate security mechanisms and networking failures are quickly resolved.

To understand advanced cybersecurity concepts and technologies, it is crucial to have a good understanding of some basic cybersecurity concepts. Below, some cybersecurity concepts are presented.

Cybersecurity risk: It is the probability of being exposed to a cybersecurity attack or that any of the cybersecurity requirements of confidentiality, integrity, or availability is violated, which may result in data theft, leakage, damage or corruption. It may also result in service disruption or downtime that may cause the company to lose revenue and damage infrastructure. An organisation that falls victim to a successful cyber-attack may lose its reputation and be compelled to pay damages to its customers or to pay a fine to regulatory agencies. Thus, a cybersecurity risk is the potential losses that an organisation or individuals may experience as a result of successful cyberattacks or failures of the information systems that may result in loss of data, customers, revenues, and resources (assets and financial losses).

Threats: It is an action performed to violate any cybersecurity requirements that may result in data theft, leakage, damage, corruption, or losses. The action may either disclose the data to unauthorised individuals or alter the data illegally. It may equally result in the disruption of services due to system downtime, system unavailability, or data unavailability. Threats may include, among others, device infections with viruses or malware, ransomware attacks, denial of service, phishing attacks, social engineering attacks, password attacks, SQL injection, data breaches, man-in-the-middle attacks, energy depletion attacks (the case of IoT devices), or many other attack vectors. Cybersecurity threats could result from threat actors such as nation stations, cybercriminals, hacktivists, disgruntled employees, design errors, misconfiguring of systems, software flaws or bugs, terrorists, spies, errors from authorised users, and natural disasters ^[2].

Cybersecurity vulnerability: It is a weakness, flaw, or error found in an information system or a cybersecurity system that cybercriminals could exploit to compromise the security of an information system. There are several cybersecurity vulnerabilities, and so many are still being discovered. Still, the most common ones include SQL injection, buffer overflows, cross-site scripting, security misconfiguration ^[3], weak authentication and authorisation mechanisms, and unencrypted data during transportation or storage. Security vulnerabilities can be identified using vulnerability scanners and performing penetration testing. When a vulnerability is detected, necessary steps should be taken to eliminate or mitigate its risk.

Cybersecurity exploit: A cybersecurity exploit is the various ways that cybercriminals take advantage of cybersecurity vulnerabilities to conduct cyberattacks to compromise the confidentiality, integrity, and availability of information systems. The exploit may involve the use of advanced techniques (e.g., commands, scripting, or programming) and software tools (proprietary or open-source) to identify and exploit vulnerabilities to steal data, disrupt the services, damage or corrupt the data, and hijack data or systems in exchange for money.

Attack vector: It is the various ways that attackers may compromise the security of an information system, such as computing, communication, or data storage and retrieval systems. Some of the common attack vectors include:

• Phishing attacks.
• Email attachments.
• Credential theft using various social engineering techniques.
• Account takeover to steal or damage data and other resources and to conduct further attacks.
• Cryptoanalysis of encrypted data.
• Man-in-the-middle attacks.
• Cross-site scripting.
• SQL injection.
• Insider threats.
• Vulnerability exploits (e.g., vulnerabilities in unpatched software, servers, and operating systems).
• Browser-based attacks, application compromise.
• Brute-force attacks to compromise passwords.
• Using malware to take over devices, gain unauthorised access, and may cause damage to data or information systems.
• Exploiting the presence of open ports.

The various approaches to eliminate attack vectors to reduce the chances of a successful attack include the following ^[4]:

• Encryption of data during transportation, storage, and retrieval.
• Designing effective security policies and training and compelling employees and stakeholders to apply them.
• Patching security vulnerabilities by regularly updating the software and hardware and checking the various system configurations to identify any vulnerabilities.
• Implementing secure network access mechanisms.
• Performing regular security audits to identify and eliminate threats and vulnerabilities before cybercriminals exploit them.
• Deploying threats (intrusion) detection and prevention systems.

Attack surface: An attack surface is a location or possible attack vectors that cybercriminals can target or use to compromise data and information systems' confidentiality, integrity, and availability. Organisations and individuals should always strive to minimise their attack surfaces; the smaller the attack surfaces, the smaller the likelihood that their data or information systems will be compromised. So, they must constantly monitor their attack surfaces to detect and block attacks as soon as possible and minimise the potential risk of a successful attack. Some of the common attack surfaces are poorly secured devices (e.g., devices such as computers, mobile phones, hard drives, and IoT devices), weak passwords, a lack of email security, open ports, and a failure to patch software, which offers an open backdoor for attackers to target and exploit users and organisations. Another common attack surface is weak web-based protocols, which hackers can exploit to steal data through man-in-the-middle (MITM) attacks. There are two categories of attack surface, which include ^[5]

• Digital attack surface: This kind of attack surface consists of all the software and hardware systems found within an organisation's infrastructure. These include applications, code, ports, servers, websites, and sensor devices (IoT devices). With the deployment of tens of millions to hundreds of millions of IoT devices, the attack surfaces created by IoT infrastructure from the sensor layer, through the networking infrastructure, to fog/cloud computing infrastructure is vast.
• Physical attack surface: This kind of attack surface consists of all endpoint devices that an attacker can gain physical access to, such as desktop computers, hard drives, laptops, mobile phones, Universal Serial Bus (USB) drives, and IoT devices (in the case of IoT systems). Some physical attack surfaces include carelessly discarded hardware containing user data and login credentials, user passwords written on pieces of paper, and unauthorised access to the physical location where sensitive assets are stored.

A practical attack surface management provides the following advantages to organisations and individuals:

• Identify vulnerabilities and eliminate them.
• To mitigate the risk posed by cybersecurity threats.
• Identify new attack surfaces created as they expand their infrastructure and adopt new services.
• Effective management of access to critical resources and data minimises the chances of any security breach.
• Minimise the possibility of successful cybersecurity attacks.

As IT infrastructures increase and are connected to external IT systems over the internet, they become more complex, hard to secure, and frequently targeted by cybercriminals. Some of the ways to minimise attack surfaces to reduce the risk of cyberattacks include:

• Implementing zero-trust policies ensures that only authorised users and applications can access information resources (computing devices, sensor devices, networks, servers, databases, etc.). This eliminates or reduces the chances of unauthorised access.
• Reducing unnecessary complexities by turning off or removing unused hardware devices and software from the IT infrastructure to reduce the attack surfaces that cybercriminals can exploit.
• Perform regular security audits and scan the entire network and IT systems to identify vulnerabilities (both hardware and software) that cybercriminals could exploit and resolve to reduce the attack surface that cybercriminals can exploit.
• The network should be segmented into smaller networks using firewalls and micro-segmentation strategies to add more barriers, restrict the spread of attacks, and reduce attack surfaces.
• Regular training of employees so that they can adopt security best practices and respect security policies designed to enhance the security of data and information systems.

Encryption: Encryption is scrambling data into a secret code (encrypted data) to only be transformed back into the original data (decrypted) with a unique key by authorised users or applications. It ensures that the confidentiality and integrity of the data are not compromised. That is, it prevents the data from being stolen or illegally altered by cybercriminals. Encryption is often used to protect data during transportation, storage, and processing/analysis. The process of encryption involves the use of a mathematical cryptographic algorithm (encryption algorithm) to scramble data (plaintext) to a cyphertext that can only be unscrambled back into the plain text using another cryptographic algorithm (decryption algorithm) and an appropriate unique key. The cryptographic keys should be long enough that cybercriminals can not easily guess them through a brute-force attack or cryptanalysis. The goals of implementing encryption algorithms in information systems are:

• To ensure the confidentiality of data, preventing unauthorised users from having access to the data and ensuring that the data is kept secret.
• To ensure the integrity of the data by ensuring that it is not altered, damaged, or corrupted during storage or transportation.
• To authenticate the users by verifying the origin of the data to ensure that the users are who they say they are.
• To ensure non-repudiation by ensuring that a data sender cannot deny that they are the origin of the data.
• It also enables organisations to comply with regulators' security requirements, which require that sensitive data be adequately protected from theft, corruption, and illegal alteration.

Cryptographic algorithms can be categorised into two main types as follows:

• Symmetric encryption: In this type of encryption, the same key is used for encryption and decryption; hence, it is sometimes called the private key or shared key encryption. The encryption key is sent through a secured channel so that it can be used to decrypt the data. The main advantage of this type of encryption scheme is that it is relatively less expensive to create the cypher, making it less computationally costly and faster to decrypt. A significant disadvantage of this type of encryption is that the key could be compromised when it is transferred from the sender to the receiver. If a third party views the key, the person or application could use it to decrypt the data, compromising the confidentiality and integrity of the data. Some common examples of symmetric encryption algorithms are Data Encryption Standard (DES), Triple DES (3DES), Advanced Encryption Standard (AES), and Twofish.
• Asymmetric encryption: In this type of encryption, two different types of keys (private and public keys) are used to encrypt and decrypt the data; hence, it is sometimes called a public key encryption scheme. The public key is shared among the communication parties (senders) so that it can be used to encrypt the data, but only the receiver with the appropriate private key can decrypt the data. Asymmetric cryptographic algorithms are relatively secure but relatively expensive to generate a cypher and computationally costly to decrypt the ciphertext into the original plaintext. Some examples of public key encryption algorithms include RSA (Rivest-Shamir-Adelman) and elliptic Curve Cryptography (ECC).

Although encryption is very valuable for securing data during transportation, processing, and storage, it still has disadvantages. Some of the drawbacks of encryption are:

• Cybercriminals can use it to hijack the data of individuals and organisations, demanding a ransom to be paid before they can access their data, the so-called ransomware attack.
• Effective management of encryption keys to ensure that they cannot be compromised is challenging, making it possible for cybercriminals to access the keys and use them to compromise the confidentiality and integrity of the data.
• There is a growing anxiety that when quantum computing technologies mature, they will be able to break advanced encryption schemes that we now depend on to protect our data.

Authentication: Authentication is an access control mechanism that makes it possible to verify that a user, device, or application is who they claim to be. The authentication credentials (username and password) are matched against a database of authorised users or data authentication servers to verify their identities and ensure they have access rights to the device, servers, application or database. Using a username or ID and a password for authentication is called single-factor authentication. Recently, organisations, especially those dealing with sensitive data (e.g., banks), require their users and applications to provide multiple factors for authentication (rather than only an ID and password), resulting in what is now known as multi-factor authentication. In the case of two factors, it is known as two-factor authentication. Using human features such as fingerprint scans, facial or retina scans, and voice recognition is known as biometric authentication ^[6]. Authentication ensures the confidentiality and integrity of data and information systems by allowing only authenticated users, applications, and processes access valuable and sensitive resources (e.g., computers, wireless networks, wireless access points, databases, websites, and other network-based applications and services).

Authorisation: Just like authentication, authorisation is another process often used to protect data and information systems from being abused or misused by cybercriminals and unintended (or intended) actions of authorised users. Authorisation is the process of determining the access rights of users and applications to ensure they have the right to perform the action they are trying to perform. Unlike authentication, which verifies the users' identities and then grants them access to the systems, authorisation determines the permissions they have to perform specific actions. One example of authorisation is the Access Control List (ACL), which allows or denies users and applications access to particular information system resources and to perform specific actions. General users may be allowed to perform some actions but may be refused permission to perform others. In contrast, super users or system administrators can perform almost every action in the system. Also, some users are authorised to access some data and are denied access to more sensitive data; thus, in database systems, general users may be permitted to access less sensitive data, and the administrator is permitted access to more sensitive data.

Access control: It consists of the various mechanisms designed and implemented to grant authorised users access to information system resources and to control the actions that they are allowed to perform (e.g., view, modify, update, install, delete). It can also control an organisation's physical access to critical resources. It ensures that the confidentiality and integrity of data and information systems are not compromised. Thus, physical access controls physical access to critical resources, while logical access control controls access to information systems (networks, computing nodes, servers, files, and databases). Access to locations where critical assets (servers, network equipment, files) are stored is restricted using electronic access control systems that use keys, access card readers, personal identification number (PIN) pads, auditing and reports to track employee access to these locations. Access to information systems (networks, computing nodes, servers, files, and databases) is restricted using authentication and authorisation mechanisms that evaluate the required user login credentials, which can include passwords, PINs, biometric scans, security tokens or other authentication factors ^[7].

Non-repudiation: It is a way to ensure that the data sender does not refute that it sent the data and that the receiver does not deny that it received the data. It also ensures that an entity that signs a document cannot refute its signature. It is a concept adopted from the legal field and has become one of the five pillars of information assurance, including confidentiality, integrity, availability, and authentication. It ensures the authenticity and integrity of the message. It provides the sender's identity to the receiver and assures the sender that the message was delivered without being altered along the way. In this way, the sender and receiver cannot deny they send, receive or process the data. Signatures can be used to ensure non-repudiation as long as they are unique for each entity.

Accountability: Accountability requires organisations to take all the necessary steps to prevent cyberattacks and mitigate the risk of a possible attack. If an attack occurs, the organisation must take responsibility for the damages and engage relevant stakeholders to handle the consequences and prevent future attacks. It must also accept responsibility for dealing with security challenges and fallouts from security breaches.