Updated: Feb 18, 2020
The first major areas to address is the computer, network and security architecture itself. We need to come to reason with the following…
If the current security standards and associated compliance are failsafe for protecting an Operational Technology (OT) environment…then why are there so many security breaches?
That is a rather common sense and logical question. The answer is obvious: they aren't failsafe. Something needs to give way. The topic of IoT security when using elements of current technology, e.g. Linux, must look to enhanced and unconventional innovations and approaches.
Let’s look at a different industry for war-fighter strategies to defeat an enemy. In the IoT sub-industry, we must realize that we are in a cyberwar. Maintaining the status-quo cybersecurity position will only worsen the security risk with broad and deep IoT adoption, as IoT deployments leverage the current standards and methods with rapid adoption and deployment speed.
In military strategies, what are two of many strategies used to defeat an enemy?
1. Unconventional warfare.
2. Infiltration and attack from within
We must adopt these strategies and techniques to fight off the evil actors and nation states keeping them from getting inside. We must stop them from infiltrating a single computing device and accessing all others connected to the network. We must change, be different, be unconventional in our cybersecurity approach to IoT, especially with human lives at stake.
Therefore, some of the architecture elements below must be as follows:
1. Implementation of a new network (or subnet) for only IoT devices, segregating that new network into IoT operations, segregating the IoT network from the overall corporate network. This must be viewed as a requirement, not simply a recommendation.
2. Access to either the sensor or the IoT network fed from the sensors must accept an authentication and access definition of: Default Deny. Access must never simply accept communications from an unknown node. Access must be implicitly earned and not expected, with no exceptions.
3. Acknowledge that the current security standards of PKI are not secure enough at this time.
a. In May 2019, DISA, the Defense Information Systems Agency (DISA) release a solicitation due June 14, 2019 for information with the following quote: “One of the immediate concerns facing DoD has to do with Public key cryptography data encryption.” The reference is specifically to Public Key Encryption (PKI) in an upcoming Quantum Computer world. Keep in mind that PKI through Man in the middle (MiTM) attacks has had it problems for the past decade. It is so pervasive, there’s even a Wikipedia page on this attack ( http://bit.ly/2KoTa5G ).
b. On July 16, “DISA is testing zero-trust networking on the Defense Department's classified network”. That network is the SIPRNet - Secret Internet Protocol Router Network with U.S. Cyber Command, used for U.S. Secret communications globally.
c. Ask yourself:
If a ZTE is designated by DISA, post their successful pilot, to be the future for Secret communications on the SIPRNet in the U.S government…
…should the security for IoT devices and networks
not deserve the same consideration?
4. Multi layered encryption – as described above, PKI, is no longer sufficient. It’s not simply the MiTM attacks. If that’s not bad enough! It’s the keystores and certificates that are being attacked. Those are the targeted attack surfaces by evil actors and nation states. Therefore, a single monolithic layer of encryption is not sufficient enough any longer and is susceptible to brute force attacks. This is a complex situation all by itself. We recommend a solution which provides you multiple layers of encryption for inbound and outbound communications, fully protecting against any brute force attack on the encryption stream.
5. Replacing PKI, we recommend a Trusted Node architecture.
6. Adopt a strategy of a digital security wall for where IoT devices connect to the systems they are communicating with a Software Defined Perimeter (SDP).
7. Intrusion prevention – deploy a SDP which has incorporated an advanced intrusion prevention capability, based on received packets, not signatures.
8. Ensure each IoT devices maintains a strong firewall and logging tied into a SIEM system.
9. If not segregating the IoT network from the corporate OT network, adopt a multi-layered, stacked, approach to digitally segregate the overall corporate network and deploying multi-layered ZTEs on the corporate network.
4.2 Security Audits, Activity & Maintenance
1. Approval and cataloging of all IoT devices running in your corporate environment.
2. A custom security policy for each IoT device type.
3. Routinely update configurations/apply patches against deployed IoT devices.
4. Monitor IoT device activity for abnormal behavior beyond what they are designed to do.
1. Define policies for isolation of IoT devices, preservation of device data, ability to maintain logs of device traffic, and capture of device images for forensic investigation.
2. If devices are deployed or managed by a 3rd party, include explicit Terms in your contracts detailing security practices to be followed and Audits that report security status and health of all managed devices.
3. Include IoT device configuration weaknesses or IoT-based intrusion scenarios as part of Red Team testing.
5 NCoded Communications Zero Trust Environment Overlay
The NCoded ZTE Overlay is a proprietary design developed to complete the following objectives through new and unconventional proprietary technology:
Reduce Your Attack SurfaceSecure User AccessEnd-to-end encrypt Data-In-TransitCloak, (add stealth), to your infrastructure from Evil Actors
The final objective is to:
Neutralize the adversaries
Once completed, you will have established a Software Defined Perimeter (SDP), cloaking your environment from being seen or accessible on the internet by “not just anyone” e.g. a hacker.
The Operational Technology (OT) security premise:
If they can’t find it, they can’t steal it!
5.2 ZTE in Detail
The NCoded Zero Trust Environment is a new security architecture definition to address the cybersecurity environment of 2018+. It starts with a least-privilege access model, comprised of the following:
1. A security posture of Default Deny. A Zero Trust Environment must follow the mantra of:
Trust No One & Trust Nothing
2. From the onset of execution, two Trusted Nodes on your network communicating with each other should have no implicit trust. Implicit trust must be earned through strong authentication between the two nodes through Whitebox Cryptography ( http://bit.ly/3055TzD), only enhanced with proprietary methods increasing entropy. A unique encryption key is created in each trusted node independently, in real-time, never storing it or sharing it over the network, implicitly providing stealth of the key.
3. Upon completion, trust is then explicit, and they become two trusted nodes which can securely communicate with each other with a unique encryption key for the communications session or the feature execution of the application.
4. Trusted Nodes shall verify and authenticate each other before actual user data is transmitted/received.
5. Secured encryption includes 3 logical layers of encryption while data is in transit. Each layer provides a “tunnel” as described in the NSA’s Multi-Site Connectivity Capability Package V1.1 (MSC) specification - http://bit.ly/2MFdp20 where a Top-Secret definition requires 2 tiers or layers of encryption. The NCoded ZTE implementation is 3 logical layers resulting in a tunnel within a tunnel within a tunnel. Each tunnel has a unique one-time use real-time generated encryption key that is never shared or stored. Each trusted node completes the key generation on itself and simply utilizes the encryption key, never storing it and never needing to share it to communicate securely.
5.3 NCoded ZTE Implementation
NCoded addresses the ZTE implementation through an overlay process. This process implements NCoded solutions which have these characteristics and objectives:
1. Eliminates the traditional attack surfaces
2. Implements methods to eliminate the attack surfaces which are vulnerable in the existing world
3. Delivers end-to-end encryption
4. Deploys advanced intrusion prevention
5. Stops Zero Day attacks
6. Immune and not susceptible to MiTM attacks
7. Delivers high trust
8. Resistant to Distributed Denial of Service attacks
An overlay provides for the rapid implementation over an existing OT without the need for many configurations or source code changes.
NCoded has innovated solutions which address the weaknesses of the conventional security protection approaches of the past 20 years. The attack surfaces used by evil actors and nation states do not exist in our solutions, rendering their attack vector tools and methods as ineffective. We are unconventional in our approaches where conventional attack vector tools fail.
UltraPAD is the solution that delivers a ZTE Overlay:
1. Provides a digital security wall to an organization’s transactional servers; which in turn allows the organization to remove the transactional servers off the public internet through changing their IP address to a non-routable IP address.
2. Provides advanced intrusion prevention that stops access to the transactional server on the first packet that attempts to connect when not a trusted NCC node.
3. Encrypts data-in-transit network packets with multiple layers of encryption.
4. Eliminates any clear text metadata while in transit.
5. The ZTE does not require an additional network security protocol, such as TLS, to protect the secure packets.
6. The traffic protection is inherent in the NCC solution.
7. It effectively operates with the same security strength as a One-Time Pad, the same strength as the Vernam cipher, only digitally and in real-time.
5.5 NCoded ZTE Benefits
1. The ZTE overlay is implemented without major changes in the Operational Technology (OT) of the existing infrastructure.
2. Allow only trusted node communications between clients and servers or server to server. The servers are not visible, much less accessible, to a non-trusted node on the internet.
3. All data communications are multilayer encrypted between client endpoints and servers, effectively cloaking all information while data is in transit.
4. Stop undesired access to the operational servers and network.
5. Eliminate zero-day attacks against the operational network from the public Internet.
We are sharing this information to raise awareness of these risks across the IoT industry and calling for better enterprise integration of IoT devices. We have innovated a solution which equates to a Top-Secret level of security to be applied for this all-important, burgeoning industry. To prevent possible catastrophic human consequences, adopting new and advanced security is imperative.
For further information, please contact:
Peter W Rung
NCoded Communications, Inc.
LinkedIn – linkedin.com/in/peter-rung-a03bb6162
Twitter – @peter_rung
main: (844) 962-6333 x706