Cloud Security in the Age of IoT

Alagappan Karuppiah (Alagu), Head of Information Technology and Lead for Digital transformation and Products, Diners Club Singapore

Alagappan Karuppiah (Alagu), Head of Information Technology and Lead for Digital transformation and Products, Diners Club Singapore

IoT (Internet of Things) once a buzz word is now becoming a reality. Gartner predicts that by 2020, IoT technology will be in 95 per cent of electronics for new product design. The same Gartner study also predicts that, by 2022, half of all security budgets for IoT will go to fault remediation, recalls and safety features rather than detection or protection. Every other electronic device we see from refrigerators to coffee machines or from baby monitors to watches all of them have started to have some sort of network connectivity either to the internet or to another machine in order to bring more convenience to the consumer and empower them.

In the age of digital disruption and fourth industrial revolution IoT is becoming the next frontier of technological innovation, but IoT devices are inherently vulnerable. For example a water dispenser that is connected to internet to order new water bottle when the level runs low can become a point of compromise if a smart technical savvy person can hack into this vulnerable IoT device, access the corporate network and download customer data then this would become a significant issue. DDoS (Distributed Denial of Service) is another area of concern for IoT, as seen in the past the Mirai botnet used compromised IP cameras and video recorders to launch the DDoS attack that crippled Dyn, a DNS provider, and impaired Internet access to many popular websites for millions of users. As most of IoT devices have resource constraints and lesser processing power they mostly resort to the cloud for outsourced storage and computation which has brought a new challenge in terms of data privacy, unauthorized access and default passwords.

In August 2017, the US Senate introduced a bipartisan bill calling for minimum security requirements for IoT devices used by the federal government, offering general and limited recommendations.

In the age of digital disruption and fourth industrial revolution iot is becoming the next frontier of technological innovation, but iot devices are inherently vulnerable

The proposed bill, Internet of Things (IoT) Cybersecurity Improvement Act of 2017, requires vendors to ensure that their devices are patchable, rely on industry standard protocols, do not use hard-coded passwords, and do not contain vulnerabilities.

Unfortunately manufacturers had none or negligible security design into their products as they are driven by tight margins, high volume and speed of time to market. Having security built into IoT products need investment, expertize and product redesign as security needs more computing power. So for IoT to have a certain level of security it needs a cloud that can support scaling up and computing resources.

Cloud security is about policies, process, technologies and controls to protect the data, application and infrastructure. We could either follow the traditional approach to ban anything out of fear or embrace IoT. IoT is so immense to be ignored hence it needs to be embraced, so the next best option would be for governments or industry to regulate the devices and the cloud service providers offering these cloud computing services.

In Singapore, the InfoComm Media Development Authority (IMDA) has released a “Cloud Adoption Starter kit” handbook that gives a beginner view on cloud and cloud security on those who are planning to adopt the move to cloud. They have also released the “Cloud Computing in Singapore” booklet which provides an overview of Singapore’s cloud computing ecosystem and consists of variety of cloud adoption case studies; featuring Cloud Service Providers’ journey achieving Multi- Tier Cloud Security certification. The booklet also contains directory listings of IaaS/PaaS, SaaS(Infrastructure as a service/ Platform as a service/ Software as a service), Cloud Technology Companies, Cloud Training Providers and MTCS Certification Bodies. And Singapore was the first to launch the Multi-Tier Cloud Security (MTCS) Singapore Standard (SS) 584 a world’s first cloud security standard that covers multiple tiers of cloud security. It can be adopted by Cloud Service Providers (CSPs) to meet different cloud user needs for data sensitivity and business criticality.

The MTCS standard seeks to drive cloud adoption across industries by giving clarity around the security service levels of cloud providers, while also increasing the level of accountability and transparency from CSPs. As of 23 Jan 2018, a total of 128 cloud services are MTCS certified. Of these, 107 are IaaS/PaaS and 21 are SaaS.

In conclusion, the more the insecure IoT devices the more it increases the risk to consumers. To reduce these risks, the industry, regulators must work together to mitigate these risks and the risks associated with the cloud computing services. A standards-based approach similar to Singapore could be one possible option to address such issues related to cloud computing services and an industry-led approach to address the security design and protocols of the IoT devices. These approaches would lead to a strong consumer satisfaction when deploying IoT devices and pave a secure way forward into the future.

Faisal Parvez, Director, BT Business CIO

Eric Boyette, Secretary & State CIO, Information Technology

Russell M. Kaurloto, VP and CIO, Clemson University

Kevin Soh, CIO and Director, e-Strategies, BH Global Corporation

Yvonne Wassenaar, CIO, New Relic, Inc

CEO

Founder and CEO, Prime Focus

Co-founder, Lacima

Cloud Security in the Age of IoT

IoT

Cloud Computing

SaaS

Weekly Brief