In the past, IT and OT were two worlds. The two are not connected to each other. Information technology and industrial control are not known to each other. The status of security problems in various networks is also not the same. The OT network is relatively closed without too many attackers. Vendors consider more "physical security", that is, the security of the production process.
The two have now merged into one. With the interconnection of everything, from the hardware manufacturer to the individual user, there is ubiquitous intelligence, and the attack surface of security threats has also been expanded. An attacker can start from any point in the production of the manufacturer to the sales, affect the production and operation activities of the manufacturer, and disrupt the production order while also increasing the production cost of the manufacturer. Such as:
In some process industries, the valves are all electronically controlled valves. The rotation is controlled by the network. After the attacker invades, it is easy to disturb the valve's operating procedures. The valve life is usually very limited, toss back and forth, the valve will soon be scrapped, the replacement cost is tens of thousands of dollars.
It can be said that in the IOT era, security has become a challenge. Last week, Lei Fengwang (searching for "Lei Feng Net" public concern) interviewed the 360 ​​chief security officer Tan Xiaosheng and talked with him about smart hardware vendor-related security issues.
Q: 360 seems to have its own ambitions in smart hardware, and has always been concerned about IOT security issues. In your opinion, what are the new changes in the security issues in the IOT era?
A: The security issue in the IOT era is divided into individuals and vendors. Personal use of household items, cameras, air conditioners, refrigerators, washing machines, including door locks are now smart. If the camera is invaded, it may be exposed to being “livedâ€. If the door lock is flawed, it can be “opened†without an authorized door. In the face of these security risks, users will personally throw the problem to the manufacturers. They will consider whether the smart hardware products they buy are relatively safe. Smart hardware vendors will choose to work with security vendors to let security vendors conduct product security assessments and provide solutions.
But the manufacturers are different. The intelligence of manufacturers is mainly reflected in the production machinery. If the screws on the lathe need to be replaced, the robots can be replaced one by one automatically. The replacement task is issued through the production management system. The production management system is an IT network, and there are many solutions to IT network security problems.
Q: IOT is an opportunity for companies. However, for attackers, IOT actually provides more ways to attack. Now what are the common methods of attack? How to avoid them?
A: The intelligent hardware needs to communicate with other devices through network devices. The communication protocol is the first type of attack point. Intelligent hardware needs to be managed through third-party devices or platforms, such as mobile phones, iPads, etc. These platforms or devices are the second type of attack point. An app that can control the hardware on the phone or iPad, or an agreement between the app and the control platform, is the third type of attack point.
There are no magic bullets for these attacks. Only product safety begins. From the product design stage, it is necessary to consider the foreseeable types of attacks, whether the protocol is secure, and whether there is a problem with the firmware update mechanism. It is relatively safe to ensure that products are produced and monitored in the operational life cycle of the future.
Q: What can the current security vendors do?
A: Take 360, our main strategy now is to do security research, find problems, make suggestions based on requirements, and help users establish a safe operating system. For example, we are the earliest domestic camera security research, will provide research results to manufacturers, tell them what kind of camera loopholes, how to improve. Second, through the way out of the security research report, it will serve as a warning to the industry and let manufacturers realize the seriousness of the security threat. Every year, ISC HackPwn will see many of the smart hardware being cracked. Through this exposure, it will attract the attention of manufacturers and promote their improvement on security issues.
Q: Is it possible to know that there are some common security issues in smart hardware vendors? Can it provide a relatively standard solution before it can be produced to help prevent it?
A: It is possible. Some security reference designs, such as cameras, can be considered by the manufacturer to make your camera relatively safe. The security vendor can provide some reference solutions or security component recommendations. But this will involve the issue of the commercial interests of manufacturers. With the manufacture of smart hardware, controlling costs is very important. Safe designs may increase manufacturing costs. Whether the vendor benefits from the security solutions you provide, this business model has not yet been created, so at present there is relatively little to do so.
Q: In addition to working with security vendors, what can intelligent hardware producers do?
A: Producers should pay attention to IOT security issues. Still taking 360, we began to consider security issues from the design of the circuit board. For example, when our cameras were built, security personnel couldn't speak after they had seen it. The design of the circuit board had a security problem and it was changed again. Second, we will consider how components can be safely upgraded and how to prevent them from being tampered with during the upgrade process. Again, we will consider the security of the communication protocol interface and background management platform. Before the final release of the product, security personnel will continue to conduct loophole testing, and will also invite white hats to be tested.
Q: Intelligent hardware upgrades usually bring some new problems. Manufacturers are also resistant to upgrades. How do you view this situation?
A: If you start to design, take the upgrade mechanism into consideration, and the risk brought by the upgrade is controllable, you can avoid it by doing experiments in advance. However, the threshold for some IOT equipment upgrade operations is very high, and the guarantee is also relatively low. For example, manufacturers sell their handhold rings to hundreds of millions of people. Now that they need to upgrade their firmware, they have a certain degree of difficulty in operation. Some upgrades may also incur additional costs. This is a reality. There is no particularly good solution.
Q: What role does IOT security play in enterprise security?
A: The IOT security issue is currently not the most important security threat for enterprises. Just as we are going to fill a container, we will throw stones first and finally we will fill sand. Because the most space is occupied by stones, the issue of corporate security is also the same. Taking some of the most basic tasks to do well will solve most of the problems. Vulnerability management, user identity management, network segmentation management, and data backup are the most basic things in building the Great Wall of Defense. If you do these things well, you will greatly increase the attacker's attack difficulty.