M2M in the Real World: Security Best Practices and Lessons Learned

Transcription

1 M2M in the Real World: Security Best Practices and Lessons Learned Tyson Macaulay VP Global Telecommunications Strategy & Corporate Development Oct 10, 2013

2 Agenda and Topics M2M compliance and regulatory risks and lesson M2M service provider OPEX, security and lessons M2M threats and controls M2M access M2M roaming Case studies in 4G security

3 Compliance and Regulatory

4 Security Requirements in the IOT Business Requirements - top two 1. Profitability (and/or Efficiency) 2. Regularity and Legal compliance Operations Requirements Audit demonstrates operation compliance Need IOT security standards onem2m, ISO, ETSI Evolving from works such as ISA 99 / IEC

5 IOT CONOPS : new compliance challenges End node End-point Network Application and Storage Old Dimensions of compliance Gateway Application layer (multitenant and roles) New Dimensions of compliance Service Layer Network 5

6 OPEX and security

7 OPEX and security Backhaul is a major operational cost Getting data from the edges across the middle of the network Measured in hundreds of Gbps to Tbps ~30% up to 60% of OPEX in 3G/4G illicit traffic is parasitic Attack traffic from the Internet Attack traffic from subscribers Assume 5% of device are compromised or malfunctioning Torrents and P2P (copyright violations) Pirate drops and compromised services Botnet C&C and outcomes (DOS, spam,, etc)

8 Service Provider OPEX risks today

9 Service Provider OPEX risks 2018

10 M2M threats and controls

11 M2M / IOT reference design Cloud / DC Compute Storage 4G endpoint M2M Gateway M2M endpoint Enterprise Service Provider Network M2M endpoint Consumer ISP M2M endpoint

12 Top Risks to 4G wireless Vulnerabilities Threats Risks Customers suffer fraud Mobile malware + Phishing + SMiShing Wireless APN Back-haul Spectrum U/L and D/L limits Over-the-air signaling DOS Illicit (U/L+D/L) traffic causes excess provisioning and expense Malicious devices with mobile attack apps (ie mobile DDOS) + Mobile malware (rogue proxy and relay) IP range scanning, port scanning Service degradation or outage Operation cost increases Infrastructure DOS (enb- Femtocell-Microcell, MME) M2M devices fragility Edge-based services and caching Telephony and Media /DOS (T/DOS) Cell outages and/or whole-network impacts Machine and M2M service failures, increased maintenance Lawful Intercept Compliance VOIP and Content Delivery infrastructure attacks Customer dis-satisfaction / churn Regulatory non-compliance Meaningful to M2M

13 Wireless Broadband Threat: APN flooding HSPA+ (20Mbps) trials Attacks flood network as broadband devices activate IPS and FW deployed, and tuned for inbound / outbound 60%+ of wireless APN recovered National launch 3G/4G services reduced to 2G speeds without security (pipes fill with attack traffic) 13 October 31, 2013 McAfee Confidential Internal Use Only

14 M2M / IOT security solutions design Off-line image protection

15 M2M Roaming and off-lload security Device heavy Device lite Find / Locate / Wipe Wireless APN DNSBL App whitelist IPS GTP IPS Mobile-AV Carrier-loaded web proxy app enobeb (4G) 3G data fallback SGW (4G) PGW (4G) Carrier-loaded DNS app NobeB (3G) On-Net Wifi offload SGSN GGSN DNSBL SaaS Web / DLP Proxy Third-party Wifi offload

16 Case studies

17 Carrier A North American operator (>40M subs) Primary Vulnerability: Spectrum Limits, Over-the-air signaling DOS Threats: Malicious devices, Mobile malware Risks: higher OPEX + reduced operational efficiency Solutions: GTP-enabled IPS on PGW Operational Security Mobile malware C&C streams M2M fragility Mobile2mobile attacks Mobile to internet attacks Identify IMEI Value-added Security To be determined Status: Operation deployment (25% of PGW) Future: Full operational coverage - Q1 2015

18 Carrier B Multi-nation operator (> 100M subs) Primary Vulnerability: Customer suffer fraud, Wireless APN backhaul, Infrastructure DOS, Edge-based services Threats: Mobile malware, Illicit traffic, Lawful Intercept Compliance Risks: Customer churn + higher OPEX + non-compliance Solutions: GTP-enabled IPS on enb Operational Security Mobile malware C&C streams M2M fragility Mobile2mobile attacks Mobile to internet attacks Infrastructure hardening Traffic replication Identify IMEI Value-added Security Family safety Enterprise device monitoring Status: Proof of concept and testing Future: Operational deployment - Q Future: Value-added service 2015/16

19 Carrier C North American Operator (> 8M subs) Primary Vulnerability: Wireless APN backhaul, Telephony and Media DOS Threats: Illicit traffic, Service outages Risks: Customer churn + higher OPEX + non-compliance Solutions: IPS outside PGW + GGSN, IPS in Content Delivery Infra Operational Security Mobile to internet attacks Infrastructure hardening Value-added Security TBD - planning Status: Full operational coverage Future: Value-added service planning Q1 2014

20 Contact Telco team Tyson Macaulay VP Global Telco Strategy Eric Tuckness Sr Director, Consumer BD Telco Rodel Alejo Director, SaaS Product Management Nipank Mehta Mgr, Sales Engineering October 31, 2013

21 Back-up

22 IPv6 packet staining Untreated IPv6 packet Stain applied as Destination Option header extension Control network Packet Manipulation Device IOT Application Provider network IOT Service Provider network 22 Gateway device may read stain and apply policy or pass to endpoint End point device reads stain and applies policy.

23 IP header staining

24 Chip-based packet processing Network processing unit Central processing unit IP offload engine Security stain Options / Ext header subengine 24