How Blockchain Can Protect IoT Devices

The world is full of connected devices — and more are coming. In 2017, there were an estimated 8.4 billion internet-enabled thermostats, cameras, streetlights, and other electronics. By 2020 that number could exceed 20 billion, and by 2030 there could be 500 billion or more.

Because they’ll all be online all the time, each of those devices — whether a voice-recognition personal assistant or a pay-by-phone parking meter or a temperature sensor deep in an industrial robot — will be vulnerable to a cyberattack and could even be part of one.

Today, many “smart” internet-connected devices are made by large companies with well-known brand names, like Google, Apple, Microsoft, and Samsung, which have both the technological systems and the marketing incentive to fix any security problems quickly. But that’s not the case in the increasingly crowded world of smaller internet-enabled devices, like light bulbs, doorbells, and even packages shipped by UPS. Those devices, and their digital “brains,” are typically made by unknown companies, many in developing countries, without the funds or ability — or the brand-recognition need — to incorporate strong security features.

Insecure “internet of things” devices have already contributed to major cyber-disasters, such as the October 2016 cyber attack on internet routing company Dyn that took down more than 80 popular websites and stalled internet traffic across the US. The solution to this problem, in my view as a scholar of “internet of things” technology, blockchain systems and cybersecurity, could be a new way of tracking and distributing security software updates using blockchains.

Making Security a Priority

Today’s big technology companies work hard to keep users safe, but they have set themselves a daunting task: Thousands of complex software packages running on systems all over the world will invariably have errors that make them vulnerable to hackers. They also have teams of researchers and security analysts who try to identify and fix flaws before they cause problems.

When those teams find out about vulnerabilities (whether from their own or others’ work, or from users’ reports of malicious activity), they are well positioned to program updates, and to send them out to users. These companies’ computers, phones, and even many software programs connect periodically to their manufacturers’ sites to check for updates, and can download and even install them automatically.

Beyond the staffing needed to track problems and create fixes, that effort requires enormous investment. It requires software to respond to the automated inquiries, storage space for new versions of software, and network bandwidth to send it all out to millions of users quickly. That’s how people’s iPhones, PlayStations, and copies of Microsoft Word all stay fairly seamlessly up to date with security fixes.

None of that is happening with the manufacturers of the next generation of internet devices. Take, for example, Hangzhou Xiongmai Technology, based near Shanghai, China. Xiongmai makes internet-connected cameras and accessories under its brand and sells parts to other vendors.

Many of its products — and those of many other similar companies — contained administrative passwords that were set in the factory and were difficult or impossible to change. That left the door open for hackers to connect to Xiongmai-made devices, enter the preset password, take control of webcams or other devices, and generate enormous amounts of malicious internet traffic.

When the problem — and its global scope — became clear, there was little Xiongmai and other manufacturers could do to update their devices. The ability to prevent future cyber attacks like that depends on creating a way these companies can quickly, easily, and cheaply issue software updates to customers when flaws are discovered.

A Potential Answer

Put simply, a blockchain is a transaction-recording computer database that’s stored in many different places at once. In a sense, it’s like a public bulletin board where people can post notices of transactions. Each post must be accompanied by a digital signature, and can never be changed or deleted.

I’m not the only person suggesting using blockchain systems to improve internet-connected devices’ security. In January 2017, a group including US networking giant Cisco, German engineering firm Bosch, Bank of New York Mellon, Chinese electronics maker Foxconn, Dutch cybersecurity company Gemalto, and a number of blockchain startup companies formed to develop just such a system.

It would be available for device makers to use in place of creating their own software update infrastructure the way the tech giants have. These smaller companies would have to program their products to check in with a blockchain system periodically to see if there was new software. Then they would securely upload their updates as they developed them. Each device would have a strong cryptographic identity, to ensure the manufacturer is communicating with the right device. As a result, device makers and their customers would know the equipment would efficiently keep its security up to date.

These sorts of systems would have to be easy to program into small devices with limited memory space and processing power. They would need standard ways to communicate and authenticate updates, to tell official messages from hackers’ efforts. Existing blockchains, including Bitcoin SPV and Ethereum Light Client Protocol, look promising. And blockchain innovators will continue to find better ways, making it even easier for billions of “internet of things” devices to check in and update their security automatically.

The Importance of External Pressure

It will not be enough to develop blockchain-based systems that are capable of protecting “internet of things” devices. If the devices’ manufacturers don’t actually use those systems, everyone’s cybersecurity will still be at risk. Companies that make cheap devices with small profit margins, so they won’t add these layers of protection without help and support from the outside. They’ll need technological assistance and pressure from government regulations and consumer expectations to make the shift from their current practices.

If it’s clear their products won’t sell unless they’re more secure, the unknown “internet of things” manufacturers will step up and make users and the internet as a whole safer.

Inverse:

You Might Also Read:

A Guide To Addressing Corporate IoT Security

« US Army Upgrades Cyber Protection Training
Trump Relaxes US Cyber Attack Rules »

CyberSecurity Jobsite
Check Point

Directory of Suppliers

BackupVault

BackupVault

BackupVault is a leading provider of automatic cloud backup and critical data protection against ransomware, insider attacks and hackers for businesses and organisations worldwide.

IT Governance

IT Governance

IT Governance is a leading global provider of information security solutions. Download our free guide and find out how ISO 27001 can help protect your organisation's information.

Alvacomm

Alvacomm

Alvacomm offers holistic VIP cybersecurity services, providing comprehensive protection against cyber threats. Our solutions include risk assessment, threat detection, incident response.

Jooble

Jooble

Jooble is a job search aggregator operating in 71 countries worldwide. We simplify the job search process by displaying active job ads from major job boards and career sites across the internet.

TÜV SÜD Academy UK

TÜV SÜD Academy UK

TÜV SÜD offers expert-led cybersecurity training to help organisations safeguard their operations and data.

High-Tech Bridge

High-Tech Bridge

High-Tech Bridge SA is a Swiss MSSP provider offering security auditing, source code review and computer forensics.

SureCloud

SureCloud

SureCloud is a Governance, Risk and Compliance (GRC) and Cybersecurity Solutions provider.

Avatu

Avatu

Avatu specialise in providing clients the advice, technology and tools they need to fight cyber and insider threats.

CISPA Helmholtz Center for Information Security

CISPA Helmholtz Center for Information Security

The CISPA Helmholtz Center for Information Security is a German national Big Science Institution within the Helmholtz Association. Our research encompasses all aspects of Information Security.

Malware Patrol

Malware Patrol

Malware Patrol provides intelligent threat data that protects against cyber attacks.

Core Security

Core Security

Core Security provides threat-aware identity, access, authentication and vulnerability management solutions.

OXO Cybersecurity Lab

OXO Cybersecurity Lab

OXO Cybersecurity Lab is the first dedicated cybersecurity incubator in the Central & Eastern Europe region.

Digital Fingerprints

Digital Fingerprints

Digital Fingerprints provides continuous authentication with behavioural biometrics. Protection against account takeover and session takeover. Compliant with GDPR and PSD2.

Dynatrace

Dynatrace

Dynatrace provides software intelligence to simplify cloud complexity and accelerate digital transformation.

stackArmor

stackArmor

stackArmor specializes in compliance and security-focused solutions delivered using our Agile Cloud Transformation (ACT) methodology.

Virtual Technologies Group (VTG)

Virtual Technologies Group (VTG)

Virtual Technologies Group is a single source, IT product and services provider for SMBs and IT departments, delivering reliable, cost-efficient service, maintenance and support solutions.

Distology

Distology

Distology are an award-winning cloud security distributor bringing a wealth of experience and strong relationships with a huge breadth of partners covering the UK, Ireland and Benelux.

Securious

Securious

If you need to improve your cyber security or achieve cyber security accreditations, Securious provide an independent service that will identify and address your issues quickly and efficiently.

Quantum Security Services

Quantum Security Services

Quantum Security Services is a specialist information security firm providing a range of risk, compliance and technical security services.

DataProof Communications

DataProof Communications

DataProof Communications is Cybersecurity Company specialising in cybersecurity operations, incident management and response best practices and technologies.

CardinalOps

CardinalOps

The CardinalOps platform continuously assesses your detection posture and eliminates coverage gaps in your existing detection stack so you can easily implement a threat-informed defense.