Now that we’ve gone through the first two lessons in our Cellular IoT crash course (part 1: Who needs cellular IoT? ; part 2: Tackling the Challenges of Cellular IoT), we’ll address one of our team’s favorite topics – protecting cellular IoT devices from cyber threats.
It’s no secret that cellular IoT adoption is on the rise across industries and verticals. The demand for innovative IoT connectivity solutions is driven by digital transformation in traditional industries. Moreover, the COVID-19 crisis sparked a growing interest in connected automation solutions, while 5G deployments added fuel to the cellular IoT trend.
The proliferation of cellular IoT has solved some challenges but not without giving birth to new ones. Today, the challenges businesses face withcellular IoT are quite varied. Among others, they include hurdles related to coverage, latency and bandwidth reliability, as well as battery life, and management of cellular IOT deployments.
One of the more complex challenges is the issue of cellular IoT security, but is also one of the most pressing ones. With more IoT devices on cellular networks, cybercriminals are leveraging both cellular and IoT vulnerabilities to launch attacks more effectively than ever before.
In 2019, Forbes cited F-Secure research that reported a 300% increase in IoT traffic attacks to more than 2.9 billion incidents. In fact, IoT attacks rose in 2019 – by 900%, and25% of companies polled reported losses related to IoT security of at least $34 million USD during a two-year period.
What is it that makes cellular IoT devices so uniquely vulnerable? And how should businesses and organizations approach the complex yet critical issue of cellular IoT security?
What is cellular IoT security?
Cellular IoT security is a system or combination of technologies employed to protect IoT devices connected to cellular networks from cyberthreats. Unlike traditional endpoint devices (such as PCs and smartphones), IoT devices connected to cellular networks are uniquely vulnerable to both infrastructure and device-based attacks. They are exposed to attacks targeting the devices themselves, as well as the networks they operate on.
If you consider the fact that 98% of all IoT traffic is unencrypted, it’s easy to see that the only way to start protecting these devices is by securing their connection. Add to that the fact that cellular networks are inherently risky, and it becomes clear why cellular IoT devices are such “easy” targets for cybercriminals.
Why do you need to secure cellular IoT deployments
The vulnerability of IoT devices is nothing new. In 2017, cybercriminals were already exploiting IoT devices to pull off things like casino heists. As IoT devices take on more mission-critical roles than fish tank maintenance, the impact of an attack becomes a lot more real.
For example, Israel’s water system was attacked in April 2020. Politically-driven cybercriminals located on another continent attempted to gain access to the systems controlling chemical levels in drinking water. Their goal was to change water chlorine levels to poison the citizens of central Israel. All while COVID-19 forces people to stay in their homes and the public health system can hardly handle mass poisoning of the civilian population.
Although these attacks did not cause extensive damage or reach the goal of poisoning the local population, the Israel National Cyber-Directorate (INCD) and the Water Authority asked water treatment facilities to improve their cybersecurity practices.
With more legislators seeing the potentially catastrophic results of successful attacks on sensitive cellular IoT systems, laws are being passed to force businesses and organizations to pay attention too. Some forward-thinking legislators are already putting in place laws and regulations that compel organizations and service providers to secure their cellular IoT deployments.
How to protect cellular IoT devices
In 2020, cellular IoT security continues to be one of the main challenges to mass adoption of cellular IoT across industries and verticals. Beyond the “double jeopardy” of cellular and IoT threats coming together to create a cybercriminal paradise, cellular IoT is hard to secure because of the sheer versatility of device types. There is no single security standard for IoT devices so there’s no one-size-fits-all solution.
What this means is that you will have to consider each case and choose the most appropriate approach by combining numerous solutions. Each approach depends on the use case, the potential threat landscape, device type, network type, location, etc.
The approaches listed below can be used to tackle cyber attacks on IoT devices. The correct combination of these approaches can provide the protection needed in most use case scenarios without adding significant costs to the projects.
6 methods to secure to IoT devices from cyber attacks
1. Hardware based IoT security
Keeping hardware safe involves a layered approach, the implementation of which usually starts during the device design phase and begins with establishing a Root of Trust. A Root of Trust is a part of the boot process that ensures the first opcode executed comes from an unalterable source.
Encryption is also an important layer of hardware security. Device manufacturers can use a Trusted Platform Module to manage the RSA key for encryption. This module is installed during the manufacturing process and can help provide encryption that covers hardware verification and password management, among other things.
Ensuring devices are kept physically secure is another angle often overlooked. Businesses must take into account the ways a device can be compromised physically. No security policy is worth anything if someone can just pick up the device and leave with it or simply disconnect it.
2. Software based IoT security
The security of a device depends greatly on its operating system’s security. This is true for all devices, not only cellular IoT. Ideally, the OS should be able to isolate itself from untrusted code and prevent it from accessing secure domains. It needs to be able to prevent the accessing, copying, or altering of information found within the device. In addition, it has to be tamper-proof to prevent things like non-trusted debug requests.
Since ideals are a goal and not a reality, operating systems for IoT devices are frequently updated to fix security issues that may have been discovered. For businesses and IoT service managers this means including cellular IoT devices in the corporate software updates policy.
Also worth noting is the role of good password practices and access control to IoT devices.
3. Cloud-based
Many IoT devices are just that – connected “things”. As such they often depend on cloud-based services to function properly. This makes cloud-based security a critical part of cellular IoT security policy as insecure cloud infrastructure can lead to everything from data theft to device hijacking.
A good example of a cloud-dependent IoT device is any surveillance or delivery drone. Even if the device is capable of processing information (like navigation instructions and image data) on its own, it may still transmit video captured or logs to a cloud-based server. If the device is compromised, it may put at risk other devices or the entire network if the breach is not immediately contained.
4. Mobile network-based
The vulnerabilities engrained in cellular networks expose IoT devices to attacks other cellular devices may be immunized to using on-device software solutions. Due to the unique characteristic of IoT devices overall, as well as properties of specific types and categories of devices, protecting IoT deployments from cellular attacks requires a unique approach and tactics.
Detection of cellular attacks from external networks and the Internet is not enough. Nor can a cellular data firewall provide a comprehensive solution on its own. The reason is quite clear: these solutions leave each individual device on the network susceptible to compromise from within the perimiterer of the cellular network.
Consider an endless number of LAN ports in the air around the cell tower that plug directly into the network your IoT devices are connected to. With these floating LAN ports, all an attacker would need to do is park next to one and launch a DoS attack that can easily remain undetected, while causing potentially costly mayhem.
As a result, centrally managed protection at the SIM-level is one of only effective methods to safeguard individual IoT devices from attacks originating from within the network perimeter.
5. Private APN and Private mobile networks
On the flip-side of cloud-dependent IoT devices are devices that require no connectivity to the Internet, but only to a single on-site server.
Scenarios starring such devices are suitable for the deployment of private mobile networks or APNs, that provide a great deal of security by simply keeping the network disconnected fromthe rest of the world and the attackers in it. That said, a cellular network is still vulnerable to attacks on its infrastructure and attacks initiated within the network’s physical perimeter.
6. 5G Network Slicing
Network slicing is a key feature of 5G technology that allows for multiple virtual networks on a single infrastructure. Aside from making it possible to do more with one set of antennae and servers, network slicing also comes with some built-in security features.
Much like a VPN, it provides network and resource isolation, protecting networks from DoS attacks. The slices can be configured for different levels of security based on the use cases and security policies through firewall configuration, access policies, and packet inspections, among others.
Finally, because similar devices are clustered into their own network slice, there’s greater visibility into what normal behavior looks like for a specific device type. For example, if one connected device starts using more data than the rest, it may be a good indicator that something isn’t right.
Comparing and Combining IoT Device Cybersecurity Approaches
Securing IoT devices requires a layered approach due to the sheer versatility and complexity of the cellar IoT ecosystem. No one security solution covers everything on a network.
When defining the security requirements for cellular IoT network deployment, consider the areas where there is the most risk. Then, consider the impact of a potential attack type and vector on business operations. Only once the risks are fully mapped out can you begin to explore the options to mitigate them.
We use cookies in order to provide you with a better browsing experience. By continuing to use this website you agree to our use of cookies. To learn more visit our
Privacy Policy
