Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Operations

10/23/2019
04:15 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

IoTopia Framework Aims to Bring Security to Device Manufacturers

GlobalPlatform launches an initiative to help companies secure connected devices and services across markets.

IoTopia, a new framework for IoT security, aims to standardize the design, certification, deployment, and management of connected services and services, GlobalPlatform reports.

This initiative marks the latest effort to build on IoT security by the industry standards body, whose members work to ensure its specifications align with current and emerging market requirements. GlobalPlatform has 2,600 industry representatives from 90 member companies, and people around the world rely on its certified secure elements, which have been integrated in chip-enabled credit cards, smartphones, smart TVs, and control units built into vehicles.

As the Internet of Things continues to expand, so, too, do GlobalPlatform's efforts to better secure it, says executive director Kevin Gillick. "We're progressing farther into this world of interconnected devices everywhere," he explains. "The same component technology and the same security mindset is logically extensible into this new space."

The IoT is the "wild, wild west," Gillick continues. Device makers are entering the ecosystem and creating connected products without bringing security into the picture. Part of GlobalPlatform's effort involves sharing standardization to bring products to market faster, at a lower price. It makes more sense, he says, for manufacturers to invest R&D into a service they can build their brands around rather than in their own security architectures and certifications.

"There is a lack of a common IoT security framework," he adds. Device manufacturers don't have security at the core of their competence; many avoid it because of the bias that adding more protection will increase cost and time to market. The idea behind IoTopia is to help these makers implement a framework that helps them move forward wihout bring security experts.

"We're seeing a lot of industry associations crop up around IoT who talk a lot about requirements, talk about security and use cases, but don't tell you how to implement it into technology," Gillick says. "Moving from words and speech to something actionable and adoptable is [a gap] no one has been able to close."

IoTopia is based on four pillars. The first is security by design, which includes capabilities and features that define how secure components and APIs can be used with existing "secure by design" standards. The second pillar is device intent. IoTopia uses Internet Engineering Task Force's manufacturer usage descriptions and uniform resource identifier to manage device permissions and access on networks, GlobalPlatform explains.

"We want to make sure we have in place a simple way to answer important questions about the device," Gillick says. "What is this thing? Who is responsible for it? How do I protect it, and how do I protect my business? Is it doing what it should be doing? … There's no systematic way to go about doing that."

The third pillar addresses autonomous, scalable, secure device onboarding (SDO), as IoTopia will offer an open, standards-based secure onboarding process to streamline network administration. The fourth focuses on device life cycle management, including a range of capabilities to manage devices throughout their life cycles aligned with international regulations.

Related Content:

This free, all-day online conference offers a look at the latest tools, strategies, and best practices for protecting your organization’s most sensitive data. Click for more information and, to register, here.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
State of Cybersecurity Incident Response
State of Cybersecurity Incident Response
Data breaches and regulations have forced organizations to pay closer attention to the security incident response function. However, security leaders may be overestimating their ability to detect and respond to security incidents. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-8423
PUBLISHED: 2020-04-02
A buffer overflow in the httpd daemon on TP-Link TL-WR841N V10 (firmware version 3.16.9) devices allows an authenticated remote attacker to execute arbitrary code via a GET request to the page for the configuration of the Wi-Fi network.
CVE-2019-14868
PUBLISHED: 2020-04-02
In ksh version 20120801, a flaw was found in the way it evaluates certain environment variables. An attacker could use this flaw to override or bypass environment restrictions to execute shell commands. Services and applications that allow remote unauthenticated attackers to provide one of those env...
CVE-2019-20635
PUBLISHED: 2020-04-02
codeBeamer before 9.5.0-RC3 does not properly restrict the ability to execute custom Java code and access the Java class loader via computed fields.
CVE-2020-11452
PUBLISHED: 2020-04-02
Microstrategy Web 10.4 includes functionality to allow users to import files or data from external resources such as URLs or databases. By providing an external URL under attacker control, it's possible to send requests to external resources (aka SSRF) or leak files from the local system using the f...
CVE-2020-11453
PUBLISHED: 2020-04-02
Microstrategy Web 10.4 is vulnerable to Server-Side Request Forgery in the Test Web Service functionality exposed through the path /MicroStrategyWS/. The functionality requires no authentication and, while it is not possible to pass parameters in the SSRF request, it is still possible to exploit it ...