The Internet of Things - The Need for Standardisation

Transcription

1 NEKs Ekomkonferanse 21Nov2017, Oslo The Internet of Things - The Need for Standardisation Josef Noll Department of Technology Systems, University of Oslo m: , e: josef.noll@its.uio.no IoTSec.no - SCOTT.IoTSec.no

2 The last time I was connected by wire was at birth - our when Internet of Things (IoT) meets people! The changing role of security in HMS -> HMSS! Internet has changed, IoT will accelerate the ecosystem of making business automated processes! Security in IoT teach our sensors to talk Norwegian! Standardisation new paradigm: measurable security security classes design! related to projects: Security in IoT for Smart Grids: IoTSec.no Secure Trusted IoT: SCOTT.IoTSec.no, Diversity in IoT Security: DiversIoT.IoTSec.no Need for standardisation in IoT Nov2017, Josef Noll 2

3 Source: L. Atzori et al., The Internet of Things: A survey, Comput. Netw. (2010), doi: / The Internet of Things (IoT) Things! IoT = Things + Internet + Semantics! Things that communicate with Things: computer, understand the meaning, takes own decisions Internet Semantics * security * privacy * dependability * context-aware * personalised Smart Energy - Trust Jun2017, Josef Noll 3

4 IoT - 3rd wave of convergence 1. wave: All-IP By 2020, business is dominated by [DNV-GL 2013] automated processes flat world, global business all-ip 2. wave: Telecom - IT - Broadcast from fixed to mobile and quadruple play Telecom = mobile Telco-IT 3. wave: IoT Internet The business merger core business Community Collaboration and cooperation drives developments Need for standardisation in IoT IoT Internet Nov2017, Josef Noll 4

5 Economics in IoT Jun2017, Noll et al. 5

6 National initiative for a more secure future in IoT IoTSec.no - Security in IoT for Smart Grids Academia Industry Interest Org. Industry «Open World Approach» everything that is not declared closed is open Gjøvik Kjeller Oslo Halden International IoTSec.no #IoTSecNO High level view on Security for IoT Nov 2017, Chr. Johansen, J. Noll X

7 Addressing the Threat Dimension for IoT! Hollande (FR), Merkel (DE) had their mobile being monitored! «and we believe it is not happening in Norway? [source: Süddeutsche Zeitung, 18Dec2014] [source: Need for standardisation in IoT Nov2017, Josef Noll 6

8 I Significance 16Oct2016 IoT security challenges! Mirai attack security by obscurity different security viewpoint! it is just the beginning [Source: ] Need for standardisation in IoT Nov2017, Josef Noll 7

9 Communication & IoT for society project IoTSec.no >20 partners (5 academics) Research on IoT security Building the national Security Centre for Smart Meter Internet Smart Grid Security by obscurity Open World Approach IoTSec.no Feb 2016, Josef Noll 8

10 teach our sensors to talk Norwegian Need for standardisation in IoT Nov2017, Josef Noll 9

11 SCOTT key message elevator pitch largest security project in EU 57 largest partners security from project 12 countries in EU 80 M budget 35 M EU&national largest 8 partners security from project Norway in EU IoT is the game changer and driver for digitalisation, and SCOTT contributes through: Answer the IoT need for a new and more advanced security paradigm through security classes Create a Convincing privacy assessment through privacy labelling Automotive Home Rail 5G Establish a clear link between security and safety Avionics 10

12 The trust matrix! trust as a positive user attitude engaging voluntarily! security based trust issues building trusted systems! technological factors data storage, distribution insight! human/societal factors government family, friends Smart Energy - Trust Jun2017, Josef Noll 11

13 Learn from Industrial Automation and Mobile Networks! What to secure?! Network segregation Network slicing! From Confidentiality, Service cloud #1 Service cloud #2 Softwareenabled routing Home services Appliance services Integrity, Availability VPN #1 Car services (CIA)! to Availability, Integrity, Confidentiality (AIC) Basic Internet low capacity Health services Smart Energy - Trust Jun2017, Josef Noll X

14 Security in IoT - our promises Semantic system description Understanding the system and describing security through security functionality Measurable security - the novel security concept criticality Measurable criticality Security modelling Development of privacy-aware models and measures Adopting and enhancing adaptive security for system of systems Formal languages for semantically proving signalling ideal good accep. critical failure System versus Goal analysis Application-specific security/privacy, e.g. billing vs Human/technical interface, security usability to measurable: security, privacy and dependability Operational security for IoT-based critical infrastructure IoTSec ecosystem -> extended network Roadmap for Smart Grid Security Centre (SGSC) (Gap Analysis of security methods for critical infrastructures) IoTSec.no #IoTSecNO High level view on Security for IoT Nov 2017, Chr. Johansen, J. Noll X

15 Example of Research: Multi-Metricsv2 - system composition! System consists of sub-systems criticality consists of components security system (s,p,d) ideal good accep. critical failure privacy dependability Multi-Metrics (weighted subsystems) sub-system 1 sub-system 2 (s,p,d) (s,p,d) M MM Multi-Metrics Comp. 1 Comp. 2 Comp. 3 Innovation through IoT - IoTSec.no - BasicInternet.org Nov2016, Josef Noll X

16 High level view of Security in IoT Goal Provide the means for IoT security from todays attack to tomorrows design security thinking in organisations Trust in Things Privacy label Smart Grid Security Centre facilitated through: Security classes & System design Manish Adam Smart Grid Security Centre Accountable security: - Assessment - Modelling - Framework Habtamu Olaf Toktam Seraj - Meas. Security all Heidi Håkon Øivind Privacy Label Elahe our basis: Christian Security and Privacy Functionality Josef Elahe IoTSec.no #IoTSecNO High level view on Security for IoT Nov 2017, Chr. Johansen, J. Noll 12

17 Security and Privacy Functionality IoTSec.no #IoTSecNO High level view on Security for IoT Nov 2017, Chr. Johansen, J. Noll 13

18 Security Classes and System design Security Classes in IoT New postulate of security class Consequence Exposure Consequence Consequence as in risk map Exposure Security Class Physical exposure - people, building, physical ports, IT exposure - ports, firewall, connectivity Used to assess the security class Increase weak security: - watchdog - Attribute based access control (S-ABAC) Exposure of Systems, sub-systems and components IoTSec.no #IoTSecNO High level view on Security for IoT Nov 2017, Chr. Johansen, J. Noll 14

19 Semantic attribute based access control (S-ABAC) Lifting the security class through S- ABAC GSM/LTE Access to information who (sensor, person, service) Admin Cloud what kind of information from where Attribute-based access role (in organisation, home) Smart Home Access device, network security tokens Meter reading Home-logic home owner Rules inferring access rights Smart grid operator Power control statistical data Heat pump Warm water Attributes: roles, access, device, reputation, behaviour,... IoTSec.no #IoTSecNO High level view on Security for IoT Nov 2017, Chr. Johansen, J. Noll X

20 Methodology: From System description to SPD level System/ Sub-system Is made by Components and functionalities Could be SPD Components, SPD functionalities described by Metrics description (SPD functionality) define config. parameters and SPD values in Metrics Run SPD Multimetrics analysis System: Automatic Meter System (AMS) consists of reader (AMR), aggregator, communications, storage, user access Sub-systems: AMR consists of power monitor, processing unit, communication unit Component: AMR communication contains of a baseband processing, antenna, wireless link Configuration Parameter: Wireless link: f=868 MHz, output power=?, Encryption=? IoTSec.no #IoTSecNO High level view on Security for IoT Nov 2017, Chr. Johansen, J. Noll X

21 Accountable security system (s,p,d) Assessment Comparison desired Class vs sub-system 1 (s,p,d) Multi-Metrics (weighted subsystems) sub-system 2 (s,p,d) Calculated class PROSA modelling M MM Multi-Metrics Modelling Comp. 1 Comp. 2 Comp. 3 SPD Metrics, from criticality to SPD value Framework Examples of applicability criticality Measurable criticality to measurable: security, privacy and dependability Measurable Security Security is not 0/1 ideal good accep. critical failure IoTSec.no #IoTSecNO High level view on Security for IoT Nov 2017, Chr. Johansen, J. Noll 15

22 SmartGridSecurity Logo

23 Mission Statement We help the Utility Companies achieve their smart grid goals with higher resiliency and quicker response times against security threats.

24 Privacy Labelling Measure, what you can measure - Make measurable, what you can t measure - Galileo Privacy today based on lawyer terminology words on app terms and conditions Privacy tomorrow A++: sharing with no others A: C: sharing with. The Privacy label for apps and devices IoTSec.no #IoTSecNO High level view on Security for IoT Nov 2017, Chr. Johansen, J. Noll 16

25 Answer the Challenges addressed by the EU SCOTT contribution: privacy label? IoTSec.no #IoTSecNO High level view on Security for IoT Nov 2017, Chr. Johansen, J. Noll X

26 Helse, Miljø og Sikkerhet IoT attack -> car crashes? safety! Security affects safety! Security affects core business company confidential information Customer information Privacy regulative (GDPR May2018): 4% of revenue Board of directors IoT is corporate governance Finance, HMS security and safety CEO Buz #1 #2 #3 #4 Need for standardisation in IoT Nov2017, Josef Noll 17

27 Conclusions Service cloud #1 Service cloud #2 Softwareenabled routing VPN #1 Home services Appliance services Car services! Things (IoT) are driving the digital societies! IoT: Business merger Basic Internet low capacity Health services Internet + Semantics + Things = IoT Digitisation of the Society! IoT Security and privacy new security paradigm Security classes, accountable security - security and privacy ontology! competitive advantage e.g.: - Privacy label (A++, A+ D) Smart Energy - Trust Jun2017, Josef Noll 18