2.3 IOT SECURITY VS IT SECURITY In accordance with the above discussions, this study excludes IT devices that require significant human interaction such as mobile phones and computers. Extensive work has been done in the field of IT security 39 over the past few decades. While IoT security and IT security share the same fundamental principles, it is often inadvisable to apply IT security classifications and mindsets directly to the IoT world40 given the unique nature of the IoT ecosystem41. The following considerations apply: 1) As discussed, IoT devices are often constrained in terms of resources and/or physical environments. This significantly alters the way security is designed; for instance, IoT connections cannot generally rely on TLS/ SSL for encrypted and authenticated communications because many IoT devices do not have the resources to handle session establishment, communication overheads, or encryption. 2) IoT devices may run without supervision and for extended periods of time, possibly in hostile environments – making them particularly susceptible to hacking. Many might have zero or limited user interfacing; thus, patching and updating may not be convenient and malfunctioning or rogue devices may not be immediately detectable. 3) The fact that IoT is closely integrated with the physical world can increase the impact of cyber-attacks. While IT cyber-attacks have resulted in data leakage and financial losses, IoT cyber-attacks have the potential to cause direct physical harm. Moreover, conventional IT security has historically relied on fortifying a “perimeter”. In previous decades, organisations 20 39 40 41 42 43 44 45 46 could easily define and visualise this perimeter, and create a protection policy to enforce and guard its obvious boundary. Enterprises still commonly secure corporate networks using familiar baseline measures such as the firewall, the demilitarised zone (DMZ), and some variety of intrusion detection system (IDS). However, the traditional perimeter has been eroded by the widespread adoption of mobile devices, virtual private networks (VPNs), web-based applications and cloud computing42; IoT potentially takes both client device and server back-end out of the no-longerdefined perimeter43, making it necessary to re-think security practices. 2.4 IOT THREATS AND VULNERABILITIES The IETF defines 44 a threat as “a potential for violation of security, which exists when there is a circumstance, capability, action, or event that could breach security and cause harm. That is, a threat is a possible danger that might exploit a vulnerability.” Vulnerabilities can be exploited by a threat agent in an attack. The result can potentially compromise the confidentiality, integrity or availability of a resource. Attacks on critical IoT devices and systems, such as connected cars and medical equipment, can target the device itself and disrupt its integrity or availability, endangering the user of the device and potentially those in the vicinity. For less critical IoT devices, such as thermostats or cameras, a major threat is device compromise, where the devices can be harnessed as part of a botnet to support DDoS attacks, spam bots or ransomware campaigns. The aforementioned Mirai45 botnet and an evolved version of Mirai called Reaper46 showed how https://en.wikipedia.org/wiki/Computer_security ITU-T Y.4806, Security capabilities supporting safety of the Internet of things https://www.ibm.com/blogs/internet-of-things/security-iot/ IBM Red Paper, Understanding IT Perimeter Security https://www.redbooks.ibm.com/redpapers/pdfs/redp4397.pdf https://www.networkworld.com/article/3223952/internet-of-things/5-reasons-why-device-makers-cannot-secure-the-iot-platform.html IETF Internet Security Glossary, https://tools.ietf.org/html/rfc4949 Mirai IoT Botnet Co-Authors Plead Guilty - https://krebsonsecurity.com/2017/12/mirai-iot-botnet-co-authors-plead-guilty/ The Reaper IoT botnet has already infected a million networks - https://www.wired.com/story/reaper-iot-botnet-infected-million-networks/