Security & Privacy for IoT Solutions

An Architectural View Point

When comparing all aspects of an IoT (Internet of Things) Solutions, it is clear that security & privacy top the list. In our society, there is a great deal of fear surrounding the perception that IoT systems are easily hackable. To an extent, this fear is justifiable as the consequences of hacked IoT devices and services can often be life-threatening. There is a special role for the IoT solution architects to address the concerns and mitigate risks.

In relation to security, the other critical concern for IoT solutions is privacy. In IoT solutions, security and privacy go hand in hand. This means that whilst we are analysing and validating the security requirements and use cases, we also must consider the privacy requirements and use cases in an integrated way.

Some IoT solutions could be compared to unchartered waters. As IoT solution architects, we need to understand the security pain points in these dangerous zones. The main reason for this prerequisite is that IoT is an emerging field; hence, there are still loopholes that should be systematically identified and addressed.

Therefore, we need to start asking powerful and open-ended questions to understand the security issues, risks, concerns, constraints and dependencies. At a high level, we may start posing the questions as to ‘What are the security pain points in this solution?’, ‘What are the new technologies that may create risks?’ and ‘How can we address the identified risks?’ among many more exploratory questions.

From architectural perspective, the most useful activity to address security and privacy concerns is applying a comprehensive viability assessment practice analysing risks, issues, assumptions, and dependencies.

This architectural workproduct must be developed in the earliest phase of the solution and monitored during the lifecycle of the project. All viability assessment items must be checked and closed off before the solution go into production for consumption.

Importance of Subject Matter Experts

Of course, by asking many more questions, we prompt our minds to find powerful answers for effective resolutions of each concern. As IoT solution architects, we usually cover the breadth rather than depth in developing solutions, like any aspect of the solution, it is essential to have a security subject matter expert on hand to help delve into the details of security risks, issues, dependencies and constraints.

These consulting subject matter experts can help validate our solution proposals. Therefore, it is highly recommended that the security subject matter experts review the security architecture of the solution and give their approval.

In addition to the security subject matter expert, the solutions are also reviewed by a security governance body in an organisation. The members of the governance body may review various aspects of the security, such as identity management, authorisation, encryption and so on.

Beware of Assumptions

It is the IoT Solution Architect’s role to ensure the recommended security actions fit into the overall solution. Assumptions for coverage of SMEs can be risky. As you may have guessed, specialists of a specific domain are often unaware of the other domains and the overall solution. Understanding the importance of this point is critical as architects often make the assumption that subject matter experts in security know every aspect of the systems or solutions.

As IoT lead solution architects, we need to analyse and define the key security threats. Then, we need to propose solutions to address those threats in the Security Model of the IoT solution aligned with requirements, use cases, and industry compliance guidelines and principles.

These critical points in each solution building block need to be carefully reviewed by specific security subject matter experts and peer-reviewed by other solution architects in the program or at the business organisation level.

The key considerations for this governance practice are security landscape for applications, tools, technology stacks, middleware, APIs, data practice, analytics platforms, hosting infrastructure, databases, network, storage, Cloud, Edge, gateways, sensors, smart objects and several other aspects of the solution.

Conclusion

IoT security and privacy is a comprehensive and complex domain. It required rigorous, dynamic, flexible, and agile approach. IoT Security and privacy requirements must be analysed using reliable trust and assurance frameworks. These requirements need to consider the privacy laws in the geographies of the solutions that are developed. These requirements may not use traditional security controls. These requirements may have been developed in agility, may pose constraints, and may differ, state to state, country to country, and continent to continent.

How do you secure your IoT solutions and maintain privacy?