Cybersecurity concepts

IoT designers and engineers need to have a good understanding of cybersecurity concepts. This will help them understand the various kinds of attacks that can be conducted against IoT devices and how to implement security mechanisms on the devices to protect them against cyber attacks. In this section, we discuss some cybersecurity concepts that are required to understand IoT security.

Cybersecurity refers to the technologies, strategies, and practices designed to prevent cyberattacks and mitigate the risk posed by cyberattacks on information systems and other cyber-physical systems. It is sometimes referred to as information technology security as it involves the design and implementation of technologies, protocols, and policies to protect information systems against data thefts, illegal manipulation, and service interruption. The main goal of cybersecurity systems is to protect the hardware and software systems, networks, and data of individuals and organizations against cybersecurity attacks that may bridge the confidentiality, integrity, and availability of these systems.

After understanding when cybersecurity is, it is also important to understand what a cyberattack is. A cyberattack can be considered as any deliberate compromise of the confidentiality, integrity, or availability of an information system. That is unauthorized access to a network, computer system or digital device with a malicious intention to steal, expose, alter, disable, or destroy data, applications or other assets. A successful cyberattack can cause a lot of damage to its victims, ranging from loss of data to financial losses. An organisation whose systems have been compromised by a successful cyber attack could lose its reputation and be forced to pay for damages incurred by customers due to a successful cybersecurity attack.

The question is why should we be worried about cybersecurity attacks, especially in the context of IoT. The widespread adoption of IoT to improve business processes and personal well-being has created an exponential increase in the options available to cybercriminals to conduct cybersecurity attacks, increasing cybersecurity-related risks for businesses and individuals. This underscores the need for IoT engineers, IT engineers, and other non-IT employees to understand cybersecurity concepts.

The CIA triad is a conceptual framework that combines three cybersecurity concepts, confidentiality, integrity, and availability, to provide a simple and complete checklist for implementing, evaluating, and improving cybersecurity systems. That is, they form a set of requirements that must be sacrificed by a cybersecurity system that is well-designed to ensure the confidentiality, integrity, and availability of information systems. It provides a powerful approach to identify vulnerabilities and threats in information systems and then implement appropriate technologies and policies to protect the information systems from being compromised. It provides a high-level framework that guides organisations and cybersecurity experts when designing, implementing, evaluating, and auditing information systems. In the following paragraphs, we briefly discuss the elements of the CIA triad.

Confidentiality

It involves the technologies and strategies designed to ensure that sensitive data is kept private and not accessible to unauthorised individuals. That is, sensitive data should be viewed only by authorised individuals within the organisation and kept private from unauthorised individuals. Some of the data collected by IoT sensors is very sensitive, and it is required that it is kept private and should not be viewed by unauthorised individuals with malicious intentions. Data confidentiality involves a set of technologies, protocols, and policies designed and implemented to protect data against unintentional, unlawful, or unauthorized access, disclosure, or theft. To ensure data confidentiality, it is important to answer the following questions:

• Who should be able to view the data or have access to the data?
• Are there laws, regulations, or contracts that require the data to be confidential?
• Are there certain conditions under which the data may be used or disclosed?
• How sensitive is the data, and what are the consequences that may be faced if unauthorised individuals access the data?
• How useful can the data be to unauthorised individuals (e.g., cybercriminals) if they have access to it?

In order to ensure the confidentiality of the data stored in computer systems and transported through computer and telecommunication networks, some security guidelines should be followed:

• Encrypt sensitive data during storage in computer systems and transportation through computer and telecommunication networks. The process of encryption renders the data unreadable or unintelligible to unauthorised persons, and only those who possess the appropriate keys can decrypt and access the data. By encrypting the data, it is kept confidential, and unauthorised individuals cannot access it unless the encryption scheme used is compromised.
• Proper management of data access is needed to ensure that only authorised individuals who have the proper privileges can access the data. Users should always authenticate themselves using strong passwords, and where possible, multi-factor (e.g., two-factor) authentication should be used. Also, there should be a regular review of the access rights or privileges of users, and unnecessary rights or privileges should be revoked.
• The physical location of hardware systems and paper documents should be properly secured. Just as it is very important to control remote access to digital systems, there should also be thorough control of the access to the physical location where the hardware and other critical assets are stored. Even paper documents should be properly sorted and stored in secure locations, and access to those locations must be controlled.
• Any data, hardware devices, and paper documents that are no longer needed should be securely disposed of as soon as possible.
• When collecting data, care must be taken to ensure that its privacy or confidentiality is not compromised, especially for sensitive data. Whenever possible, if it is possible to do so without collecting sensitive data, then it should not be collected as one of the ways to avoid the risk that comes with handling sensitive data is not to collect it in the first place if it's possible to do without it.
• Sensitive data should be used only when necessary; otherwise, it should not be used at all to preserve its confidentiality.
• Appropriate security systems should be implemented to ensure the confidentiality of data. Some of these measures include access control systems (e.g., firewalls), threat management systems, and attack detection and prevention systems etc.

Integrity

Integrity in cybersecurity involves technologies and strategies designed to ensure that data is not modified or deleted during storage or transportation by unauthorised persons. It is very important to maintain the integrity of the data to ensure that it is consistent, accurate, and reliable. In the context of IoT, integrity is the assurance that the data collected by the IoT sensors is illegally altered during transportation, processing, and storage, making it incomplete, inaccurate, inconsistent, and unreliable. The data can only be modified or altered by those authorised to do so. The collected data must be kept complete, accurate, consistent and safe throughout its entire lifecycle in the following ways ^[1]:

• The data must be maintained in its full form with no data elements filtered, truncated or lost to ensure that the data is complete.
• The accuracy of the data is preserved by ensuring that the data is not altered or aggregated either by human error or malicious attacks in such a way that affects the results of further processing and analysis of the data.
• The consistency of the data should be maintained by ensuring that the data is unchanged regardless of how or how often it's accessed and no matter how long it's stored.
• The safety of the data should be ensured by making sure that it is securely maintained and accessed only by authorised applications and individuals. Data security methods such as authentication, authorisation, encryption, backups, etc, can be used to ensure that the data is altered or destroyed by unauthorised applications or individuals.

The IoT system designers, manufacturers, developers, and operators should ensure that the data collected is not lost, leaked, or corrupted during transportation, processing, or storage. As the data collected by IoT sensors is growing rapidly and lots of companies are depending on the results from the processing of IoT data for decision-making, it is very important to ensure the integrity of the data. It must be ensured that the IoT data collected is complete, accurate, consistent and secure throughout its lifecycle, as compromised data is of little or no interest to organisations and users. Also, data losses due to human error and cyberattacks are undesirable for organisations and users. Physical and logical factors can influence the integrity of the data.

• Physical integrity: It includes the various ways the integrity of the data can be compromised during transportation, storage and retrieval. During the transportation of data, some parts of the data could be lost due to packet losses occurring at the network equipment or packet errors caused by a disturbance in the transmission media. Also, data could be lost due to physical damage to the storage or computing devices. The integrity of the data could be compromised due to the following reasons:
  • Hardware failures and faults.
  • Design failures and negligence
  • Natural failures that may result from the deterioration of the hardware device (e.g., corrosion)
  • Power failures outages
  • Natural disasters
  • Environmentally induced failures resulting from extreme environmental failures like high temperatures.
  • Cyberattacks that are designed to cause hardware failures or power failures (e.g., energy depletion attacks)

The physical integrity of data could be enforced by:

• Implementing redundancy in data storage systems to ensure that failure of a storage memory will not result in data losses.
• Implementing battery-protected write cache.
• Deploying storage systems with advanced error-correcting memory devices,
• Implementing clustered and distributed file systems.
• Implementing error-detection algorithms to detect any changes in the data during transportation.
• Deploying backups that are located in different physical locations.
• Implement network protection mechanisms to ensure that the data is not corrupted or lost during transportation.

IoT system designers, manufacturers, and developers can adopt a variety of technologies and policies to ensure the integrity of the hardware from the IoT devices and communication to fog/cloud data centres.

• Logical integrity: Even when there are no hardware issues, there can still be unintended or malicious alterations in the data or data losses during transportation, storage, and retrieval that could alter its integrity. Logical integrity can be compromised by software design flaws and bugs, poor network configurations, as well as human error and cyberattacks. Some of the data integrity risks include:
  • Data may be deleted, wrongly entered, and illegally altered in the storage system.
  • Data may be damaged, lost, or illegally altered during transportation.
  • Data may be stolen, damaged, or illegally altered by a malicious hacker after a successful cyberattack.
  • Data may be stolen, damaged, lost, or illegally altered due to poor network and infrastructure configuration.

Enforcing data integrity is a complex task that requires a careful integration of cybersecurity tools, policies, regulations, and people. Some of the ways that data integrity can be enforced include but are not limited to the following strategies:

• There should be strict control of access to the data using effective authentication and authorisation tools to ensure that unauthorised persons do not manipulate data.
• Logs on the actions performed by users should be created and carefully audited to keep track of the changes made by users.
• Data should be encrypted during transportation and storage to ensure that it is not altered or damaged during transportation or storage.
• Data protection mechanisms should be used to prevent data losses, e.g., data should be backed up regularly, and error detection and correction communication algorithms should be used.
• When accessing data to process or analyse it, necessary steps should be taken to ensure that it is not corrupted, lost, or damaged, especially when it is accessed by third parties for analysis.
• The employees and other stakeholders should be trained to handle the data in such a way that its integrity is not lost, altered, or damaged.

Availability

The computing, communication, and data storage and retrieval systems should be accessible at any time and when needed. Availability in the context of cybersecurity is the ability of authorised users or applications to have reliable access to the information systems when necessary at any time. It is one of the elements of the CIA triad that constitutes the requirement for designing secure and reliable information and communication systems such as IoT. Given that IoT nodes are being integrated into critical infrastructure and other existing infrastructure of companies and individuals, longer downtimes are not tolerated, making availability a critical requirement. Availability could result from any of the following causes:

• Hardware failures that may result from natural failures resulting from deterioration.
• Software failures that may result from software design flaws or bugs
• Cyberattacks, e.g., DoS/DDoS, energy depletion attack in the case of an IoT node.
• Power failure that may result from power outages or depletion of energy stored in the battery in the case of IoT nodes.
• Data damage, corruption, or losses during transportation or storage and retrieval that prevent authorised users and applications from having access to the data when needed.
• Bandwidth bottlenecks and link failures in the communication network that interfere with the transfer of data to users and applications that need them.
• The downtimes could result from failure, misbehaviour, or malfunctioning of the cybersecurity systems
• Data to the computing, communication and storage infrastructure resulting from natural disasters, theft, vandalisation, political unrest, or conflict.

Some of the ways to ensure the availability of information systems and data include the following:

• Creating data backups and storing the backup systems in different geographical locations.
• Ensuring effective operation and maintenance processes.
• Ensuring effective and efficient energy sources and energy storage systems.
• The energy consumption should be minimised in the case of IoT nodes to increase the lifetime of the devices.
• Software design flaws and bugs should be resolved immediately and as quickly as possible to minimise downtimes.
• The physical storage locations of hardware infrastructure should be carefully secured.
• Effective authentication and authorisation mechanisms should be used to ensure that authorised users have access to the systems when needed.
• There should be careful implementation and configuration of cybersecurity systems to ensure performance degradation and downtimes resulting from the malfunctioning of cybersecurity systems are minimised.
• Ensuring the networking systems are properly configured with appropriate security mechanisms and networking failures are quickly resolved.

In order to understand advanced cybersecurity concepts and technologies, it is important to have a good understanding of some basic cybersecurity concepts. Below we present some cybersecurity concepts.

Cybersecurity risk: It is the probability of being exposed to a cybersecurity attack or that any of the cybersecurity requirements of confidentiality, integrity, or availability is violated, which may result in data theft, leakage, damage or corruption. It may also result in service disruption or downtime that may cause the company to lose revenue and damage infrastructure. An organisation that falls victim to a successful cyber-attack may lose its reputation and be compelled to pay damages to its customers or to pay a fine to regulatory agencies. Thus, a cybersecurity risk is the potential losses that an organisation or individuals may experience as a result of successful cyberattacks or failures of the information systems that may result in loss of data, customers, revenues, and resources (assets and financial losses).

Threats: It is an action performed with the intention of violating any of the cybersecurity requirements that may result in data theft, leakage, damage, corruption, or losses. The action performed may either disclose the data to unauthorised individuals or alter the data illegally. It may equally result in the disruption of services due to system downtime, system unavailability, or data unavailability. The could that could be considered threats could be infection of devices with viruses or malware, ransomware attacks, denial of service, phishing attacks, social engineering attacks, password attacks, SQL injection, data breaches, man-in-the-middle attacks, energy depletion attacks (the case of IoT devices), or many other attack vectors. Cybersecurity threats could result from threat actors such as nation stations, cybercriminals, hacktivists, disgruntled employees, design errors, misconfiguring of systems, software flaws or bugs, terrorists, spies, errors from authorised users, and natural disasters ^[2].

Cybersecurity vulnerability: It is a weakness, flaw, or error found in an information system or a cybersecurity system that cybercriminals could exploit to compromise the security of an information system. There are several cybersecurity vulnerabilities, and so many are still being discovered. Still, the most common ones include SQL injection, buffer overflows, cross-site scripting, security misconfiguration ^[3], weak authentication and authorisation mechanisms, and unencrypted data during transportation or storage. Security vulnerabilities can be identified using vulnerability scanners and performing penetration testing. When a vulnerability is detected, necessary steps should be taken to eliminate it or to mitigate its risk.

Cybersecurity exploit: A cybersecurity exploit is the various ways that cybercriminals take advantage of cybersecurity vulnerabilities to conduct cyberattacks in order to compromise the confidentiality, integrity, and availability of information systems. The exploit may involve the use of advanced techniques (e.g., commands, scripting, or programming) and software tools (proprietary or open-source) to identify and exploit vulnerabilities with the intention of stealing data, disrupting the services, damaging or corrupting the data, and hijacking data or systems in exchange for money.

Attack vector: It is the various ways that attackers may compromise the security of an information system, such as computing, communication, or data storage and retrieval systems. Some of the common attack vectors include

• Phishing attacks
• Email attachments,
• Credential theft using various social engineering techniques,
• Account takeover to steal or damage data and other resources and to conduct further attacks
• Cryptanalysis of encrypted data,
• Man-in-the-middle attacks,
• Cross-site scripting,
• SQL injection,
• Insider threats,
• Vulnerability exploits (e.g., vulnerabilities in unpatched software, servers, and operating systems),
• Browser-based attacks, application compromise,
• Brute-force attacks to compromise passwords,
• Using malware to take over devices, gain unauthorised access, and may cause damage to data or the information systems,
• Exploiting the presence of open ports.

The various approaches to eliminate attack vectors to reduce the chances of a successful attack include the following ^[4]:

• Encryption of data during transportation, storage, and retrieval.
• Designing effective security policies and training and compelling employees and stakeholders to apply them.
• Patching security vulnerabilities by regularly updating the software and hardware and checking the various system configurations to identify any vulnerabilities.
• Implementing secure network access mechanisms.
• Performing regular security audits in order to identify and eliminate threats and vulnerabilities before cybercriminals exploit them.
• Deploying threats (intrusion) detection and prevention systems.

Attack surface: An attack surface is a location or possible attack vectors that cybercriminals can target or use to compromise the confidentiality, integrity, and availability of data and information systems. Organisations and individual should always strive to minimise their attack surfaces as the smaller the attack surfaces, the smaller the likelihood that their data or information systems will be compromised. So, they have to constantly monitor their attack surfaces in order to detect and block attacks as soon as possible and to minimise the potential risk of a successful attack. Some of the common attack surfaces are poorly secured devices (e.g., devices such as computers, mobile phones, hard drives, and IoT devices), weak passwords, a lack of email security, open ports, and a failure to patch software, which offers an open backdoor for attackers to target and exploit users and organizations. Another common attack surface is weak web-based protocols, which hackers can exploit to steal data through man-in-the-middle (MITM) attacks. There are two categories of attack surface, which include ^[5]

• Digital attack surface: This kind of attack surface consists of all the software and hardware systems found within the infrastructure of an organisation. These include applications, code, ports, servers, websites, and sensor devices (in the case of IoT devices). With the deployment of tens of millions to hundreds of millions of IoT devices, the attack surfaces created by IoT infrastructure from the sensor layer, through the networking infrastructure, to fog/cloud computing infrastructure is huge.
• Physical attack surface: This kind of attack surface consists of all endpoint devices that an attacker can gain physical access to, such as desktop computers, hard drives, laptops, mobile phones, Universal Serial Bus (USB) drives, and IoT devices (in the case of IoT systems). Some physical attack surfaces include carelessly discarded hardware that contains user data and login credentials, user passwords that are written on pieces of paper, and unauthorised access to the physical location where sensitive assets are stored.

An effective attack surface management provides the following advantages to organisations and individuals:

• Identify vulnerabilities and eliminate them.
• To mitigate the risk posed by cybersecurity threats.
• Identify new attack surfaces that have been created as they expand their infrastructure and adopt new services.
• Effective management of access to critical sources and data, minimising the chances of any form of a security breach.
• Minimise the possibility of successful cybersecurity attacks.

As IT infrastructures increase in size and are connected to external IT systems over the internet, they become more complex, hard to secure, and frequently targeted by cybercriminals. Some of the ways to minimise attack surfaces in order to reduce the risk of cyberattacks include:

• The implementation of zero-trust policies to ensure that only authorised users and applications can have access to information resources (computing devices, sensor devices, networks, servers, databases, etc.). This eliminates or reduces the chances of unauthorised access that compromises
• Reducing unnecessary complexities by turning off or removing unused hardware devices and software from the IT infrastructure to reduce the attack surfaces that can be exploited by cybercriminals.
• Perform regular security audits and scan the entire network and IT systems to identify vulnerabilities (both hardware and software) that could be exploited by cybercriminals and resolve them to reduce the attack surfaces that cybercriminals can exploit.
• The network should be segmented into smaller networks using firewalls and micro-segmentation strategies to add more barriers to restrict the spread of attacks and reduce attack surfaces.
• Regular training of employees so that they can adopt security best practices and respect security policies designed to enhance the security of data and information systems.

Encryption: Encryption is the process of scrambling data into a secret code (encrypted data) so that it can only be transformed back into the original data (decrypted) with a unique key by authorised users or applications. It ensures that the confidentiality and integrity of the data are not compromised. That is, it prevents the data from being stolen or illegally altered by cybercriminals. Encryption is often used to protect data during transportation, storage, and processing/analysis. The process of encryption involves the use of a mathematical cryptographic algorithm (encryption algorithm) to scramble data (plaintext) to a cyphertext that can only be unscrambled back into the plain text using another cryptographic algorithm (decryption algorithm) and an appropriate unique key. The cryptographic keys should be long enough that cybercriminals can not easily guess them, be it through a brute-force attack or cryptanalysis. The goals of implementing encryption algorithms in information systems are:

• To ensure the confidentiality of data, preventing unauthorised users from having access to the data and ensuring that the data is kept secret.
• To ensure the integrity of the data by ensuring that it is not altered, damaged, or corrupted during storage or transportation.
• To authenticate the users by verifying the origin of the data to ensure that the users are who they say they are.
• To ensure non-repudiation by ensuring that a sender of data cannot deny that they are the origin of the data.
• It also enables organisations to comply with the security requirements of regulators that require that sensitive data should be adequately protected from theft, corruption and illegal alteration.

Cryptographic algorithms can be categorised into two main types as follows:

• Symmetric encryption: In this type of encryption, the same key is used for encryption and decryption; hence, it is sometimes called the private key or shared key encryption. The encryption key is sent through a secured channel so that it can be used to decrypt the data. The main advantage of this type of encryption scheme is that it is relatively less expensive to create the cypher, making it less computationally expensive and faster to decrypt. A major disadvantage of this type of encryption is that the encryption key could be compromised when it is being transferred from the sender to the receiver. In case a third party views the key, the person or application could use it to decrypt the data, compromising the confidentiality and integrity of the data. Some common examples of symmetric encryption algorithms are Data Encryption Standard (DES), Triple DES (3DES), Advanced Encryption Standard (AES), and Twofish.
• Asymmetric encryption: In this type of encryption, two different types of keys (private and public keys) are used to encrypt and decrypt the data; hence, it is sometimes called a public key encryption scheme. The public key is shared among the communication parties (senders) so that it can be used to encrypt the data, but only the receiver with the appropriate private key can decrypt the data. Asymmetric cryptographic algorithms are relatively secured but are relatively expensive to generate a cypher and are also computationally expensive to decrypt the ciphertext into the original plaintext. Some examples of public key encryption algorithms include RSA (Rivest-Shamir-Adelman) and elliptic Curve Cryptography (ECC).

Although encryption is very valuable for securing data during transportation, processing, and storage, it still possesses some disadvantages. Some of the drawbacks of encryption are:

• Cybercriminals can use it to hijack the data of individuals and organisations, demanding a ransom to be paid before they can access their data, the so-called ransomware attack.
• Effective management of encryption keys to ensure that they cannot be compromised is challenging, making it possible for cybercriminals to access the keys and use them to compromise the confidentiality and integrity of the data.
• There is a growing anxiety that when quantum computing technologies become mature, they will be able to break advanced encryption schemes that we now depend on for the protection of our data.

Authentication: Authentication is an access control mechanism that makes it possible to verify that a user, device, or application is who they claim to be. The authentication credentials (username and password) are matched against a database of authorised users or data authentication servers to verify their identities and to ensure that they have access rights to the device, servers, application or database. The use of a username or ID and a password for authentication is called single-factor authentication. Recently, organisations, especially those that are dealing with sensitive data (e.g., banks), require their users and applications to provide multiple factors for authentication (rather than only an ID and password), resulting in what is now known as multi-factor authentication. In the case of two factors, it is known as two-factor authentication. The use of human features such as Fingerprint scans, facial or retina scans, and voice recognition is known as biometric authentication ^[6]. Authentication ensures the confidentiality and integrity of data and information systems by allowing only authenticated users, applications, and processes to have access to valuable and sensitive resources (e.g., computers, wireless networks, wireless access points, databases, websites, and other network-based applications and services).

Authorisation: Just like authentication, authorisation is another process that is often used to protect data and information systems from being abused or misused by cybercriminals and unintended (or intended) actions of authorised users. Authorisation is the process of determining the access rights of users and applications to ensure that they have the right to perform the action that they are trying to perform. That is, unlike authentication, which verifies the identities of the users and then grants them access to the systems, authorisation determines the permissions that they have to perform specific actions. One example of authorisation is the Access Control List (ACL), which allows or denies users and applications access to specific information system resources and to perform certain actions. General users may be allowed to perform some actions, but they may be denied permission to perform certain actions. In contrast, super users or system administrators are allowed to perform almost every action in the system. Also, some users are authorised to have access to some data and are denied access to more sensitive data; thus, in database systems, general users may be permitted to access less sensitive data, and the administrator is permitted to have access to more sensitive data.

Access control: It consists of the various mechanisms designed and implemented to grant authorised users access to information system resources and to control the actions that they are allowed to perform (e.g., view, modify, update, install, delete). It can also be the control of physical access to critical resources of an organisation. It ensures that the confidentiality and integrity of data and information systems are not compromised. Thus, physical access controls physical access to critical resources, while logical access control controls access to information systems (networks, computing nodes, servers, files, and databases). Access to locations where critical assets (servers, network equipment, files) are stored is restricted using electronic access control systems that use keys, access card readers, personal identification number (PIN) pads, auditing and reports to track employee access to these locations. Access to information systems (networks, computing nodes, servers, files, and databases) is restricted using authentication and authorization mechanisms that evaluate the required user login credentials, which can include passwords, PINs, biometric scans, security tokens or other authentication factors ^[7].

Nonrepudiation: It is a way to ensure that the sender of data does not refute that it sent the data and also that the receiver does not deny that it received the data. It also ensures that an entity that signs a document cannot refute its signature. It is a concept adopted from the legal field and has become one of the five pillars of information assurance, among others, such as confidentiality, integrity, availability, and authentication. It ensures the authenticity and integrity of the message. It provides the identity of the sender to the receiver and assures the sender that the message was delivered without being altered along the way. In this way, the sender and receiver are unable to deny they send, receive or process the data. Signatures can be used to ensure nonrepudiation as long as they are unique for each entity.

Accountability: Accountability requires that organisations take all the necessary steps to prevent cyberattacks and also mitigate the risk of a possible attack. In case an attack occurs, the organisation must take responsibility for the damages and engage relevant stakeholders to handle the consequences and prevent future attacks from happening. That is, it must accept responsibility for dealing with security challenges and fallouts from security breaches.