Breaking down the barriers to an IoT-enabled government

To say the internet of things is taking the world by storm understates the impact: IoT-connected devices are expected to number somewhere in the neighborhood of a staggering 30 billion by 2020. In a few years, each of us will have six IoT devices on average, though many of us are there already.

The advantages for the public sector are hard to deny. IoT sensor technologies could achieve vast cost savings and efficiency increases -- through the deployment of smart buildings and government fleet management – as well as significant improvements in public service, such as optimization of municipal traffic flows. The potential is virtually endless, and while several governmental entities at the local, state and federal levels have deployed some IoT capabilities, they have barely dipped the proverbial toe in the IoT waters.

Certainly, there are skill set and procurement challenges in deploying IoT at scale, as well as integrating any emerging technology with legacy equipment. But the security and privacy risks alone are enough to create hesitation, particularly acknowledging government's general risk aversion. The sheer scale of any deployment -- in terms of the number of governmental employees and the size of an implementation -- would increase the risk factor of a breach exponentially beyond a private individual’s use of, say, a smart TV. How do we better secure the IoT to facilitate governmental adoption?

A path forward: IoT standards, testing and transparency

Most emerging technologies have a predictable controls life cycle. Standards are eventually set and deployed, yet there is a lag between their emergence, mainstream adoption and the development of subsequent security controls. The IoT is a fairly immature market, and as of now, there are no generally accepted universal standards at the public- or private-sector levels. It is a “consumer beware” market, and several noteworthy hacks in the commercial space, such as the Mirai botnet, have highlighted device insecurity.

The first challenge is standardizing security practices for -- and demonstrating the security of --  these devices in an industry where even the definition of an IoT device is still up for debate. Fortunately, the federal government has a department charged with defining standards: the National Institute of Standards and Technology. NIST recently released the draft report, “Considerations for Managing Internet of Things (IoT) Cybersecurity and Privacy Risks,” to help federal agencies understand and manage device cyber risks. It is the first of a series of IoT documents, which will become more specific on various aspects of IoT risk.

The NIST document supplements the efforts of Sens. Mark Warner (D-Va.), Cory Gardner (R-Colo.), Ron Wyden (D-Ore.) and Steve Daines (R-Mont.), who introduced the Internet of Things Cybersecurity Improvement Act of 2017. The bill focuses on creating a set of minimum standards for devices installed in U.S. government networks.

I had the opportunity to discuss this legislation with Sen. Gardner at his recent visit with Coalfire, when we talked about how the private and public sectors can work together to improve IoT security for all consumers. The bill was a good start and focuses on the security fundamentals, which are still lacking, but it has so far failed to get much traction in Congress.

In September, California passed the first IoT cybersecurity law, putting the onus on device manufacturers to ensure their internet-connected devices have “reasonable” security features. That law has received criticism for its oversight of basic cybersecurity practices; yet, it is still better than no legislation at all.

All of these are positive movements toward IoT security, but as an industry, security standardization isn’t happening fast enough or holistically enough.

Where should we go from here?

To remove barriers to government and commercial adoption, we must apply a standards, testing and transparency structure that has already been applied in other areas of technology, such as cloud computing. While NIST is charged with setting standards and is well into the process, it has not historically set specific controls parameters for those standards. Telling organizations they must have passwords of agency-defined length does not help the consumer, manufacturer or federal agency. 

This gap has been addressed through a variety of approaches, my favorite being the “overlays” that have been created. These overlays provide more granular guidance to utilities or power industries, in the example of critical infrastructure. Standards bodies or overlays are typically employed to set more specific controls beneath the NIST guidance. Examples include the Federal Risk and Authorization Management Program for federal cloud usage and how critical infrastructure is managed using the NIST framework and dedicated industry overlays.

The NIST IoT draft document and planned guidance is a start; we believe that a standards body that includes broad representation of manufacturers, private-sector technology consumers, security researchers and security advisors should be formed to set the controls and testing requirements that are applied to IoT products as used by specific agencies. Manufacturers wishing to serve the government should be required to certify to the standard and provide transparent testing results. The standard should be iterated and refined over time, incorporating feedback from the public.

Clearly, IoT is here to stay, and its applications will continue to get smarter, better and more enabling. Because these devices represent real and concrete risks to security, it’s time to accelerate progress toward a more orchestrated security framework so the government can tap into its many unique advantages.

We have an opportunity to bake in security instead of sprinkling it on. Are we willing to move fast enough, or will IoT functionality race ahead of security?