As smart home technology moves from the lab to the marketplace, many home security, surveillance and control functions will now be exposed to the Internet through Smart Home gateways and management systems. Are these systems ready for the cyber-attacks that will undoubtedly ensue? And who is responsible for ensuring these devices are safe from attack?
The security challenge for the smart home, with its network of specialized, connected devices is different than the security challenges for enterprise networks and PC systems.
A few of the factors that make smart home security different are:
- Most smart home devices are fixed function devices.Once they are shipped they cannot be upgraded to add security after the fact.
- Smart home devices are special purpose devices, not general purpose devices like PCs or servers, and as a result require special purpose security solutions.
- Smart home devices may run small footprint real-time operating systems such as VxWorks or INTEGRITY and cannot run security solutions designed for Windows or Linux based systems.
- Once deployed, the devices cannot be upgraded to add security fixes unless the device manufacturer provides an upgrade.The end user cannot buy security software from a third party and install it on the devices.
- There is no one to manage security within the home
Since the homeowner using smart home devices cannot install security software onto the device, the responsibility for security falls squarely onto the shoulders of the OEMs who build the device. Security for embedded devices has to be designed into the device itself. All too often, however, OEMs push off the responsibility for the security of the device to the operating system vendor. They argue that the OS is responsible for the security of the device. Or even worse, that security is not a requirement and provides no competitive advantage and can be ignored.
Security is clearly a requirement for the smart home. The smart home may now include home video surveillance systems, health monitoring systems, environmental controls, home security systems and door locks, etc. all that can be remotely accessed. These systems must be protected from hackers.
A recent article from Forbes outlines several attacks against smart homes1. The attacks included remotely controlling lights and TVs, turning on a hot tub water heater, and opening someone garage door. In some cases, the smart home HUB or control system did not require a password, leaving them wide open to hackers. Other reported hacks include remotely flushing toilets and turning on and streaming video from Internet camera systems and unlocking doors and windows. The implications are obvious.
Floodgate at Home is embedded into Smart Home devices, providing protection at the point of attack.
Security is a requirement, but whose responsibility is it?
Unlike enterprise and PC security, where the responsibility lies mainly with the end user organization, security for the smart home is primarily the responsibility of the OEM building the devices. However, the OEM is not solely responsible. Everyone involved in the development and deployment of the device plays an important role.
The role of the OEM
The OEM plays the primary role in security. They are ultimately responsible for specifying security requirements, implementing security in the smart home devices, and testing to ensure security requirements are met. The OEM is responsible for selecting the OS and processor, and for using security protocols, secure authentication, and protection mechanisms such as an endpoint firewall.
The role of the OS vendor
While it is the role of the OEM to select the OS, the OS vendor (or open source community creating and maintaining the OS) is responsible for ensuring the security of the OS. Typical communication protocols and services are bundled with the OS and these often provide the main attack vectors for cyber-attacks. The OS vendor should be responsible for ensuring the security of each of the components they provide.
The role of the chip vendor
Chip vendors also play a key role in embedded device security. They are building processors with built-in code verification capability, physical tampering detection, and encryption engines. These tools allow OEMs to develop and deploy devices that verify they are running authentic code and detect when someone has physically opened a device. Once these events are detected, they can then shut the device down or report the event to prevent tampering.
The role of the specialized security companies
OEMs, end users, and even RTOS companies do not always have the expertise to ensure all aspects of device security are addressed. Companies specializing in embedded device security provide expertise, tools, specialized security solutions and security audit and verification services. These companies play a critical role in embedded device security by ensuring compliance with security standards, providing education to OEMs and end users, and testing devices to ensure they are not vulnerable to cyber-attacks.
The role of the end user
The end user is depending upon the OEM to build smart home devices and networks that are equipped with adequate security capability. However, the end user must ensure the device is deployed in a secure manner. They must properly set passwords, enable authentication and perform any other steps required for security. If history is any guide, most security breaches are caused by human error or carelessness. People are prone to using weak or default passwords, leaving the device open to attack.
The Role of Home Network Provider (cable company, broadband supplier, cellular phone company)
When Smart Home services are provided by a network service provider, the service provider plays a key role in security. Service Providers have the resources to ensure that security is included in the network design and have enough muscle to influence OEMs to build security into their products. An OEM is much more likely to implement product requirements from a service provider purchasing thousands of devices than they are to listen to an end user buying a single device. Service providers can also ensure that devices are deployed with secure passwords and with property security settings. The network needs need to be protected as well as the specific devices and endpoints connected to the network.
The only way to ensure smart home security is through the coordinated effort of everyone involved in the development and use of the product. Unfortunately, no one group can, by their efforts alone, ensure that a device is secure. However, a failure to implement or properly use security at any stage in the process can result in significant security loopholes.
Security must start with the OEM building the device and with their suppliers (OS vendors, chip vendors, etc.). By starting with a base of security within the essential components of the device, each additional layer of manufacturer, integrator and end user can build upon this base, making it less likely that someone – the end user or the network provider – will accidently leave open the door to attack.
Alan Grau is President and co-founder of Icon Labs, a leading provider of security software for embedded devices. He is the architect of Icon Labs' award winning Floodgate Firewall. Alan has 20 years of embedded software experience. Prior to founding Icon Labs he worked for AT&T Bell Labs and Motorola. Alan has an MS in computer science from Northwestern University. You can reach him at email@example.com