If 50 billion, or however many billion, devices share the same Internet as some 8 billion humans by the year 2020, will the weakest links in data security be on machines that have any degree of human control? Put another way, could a not-so-smart client on a machine-to-machine (M2M) network become a future target of malicious Internet activity? These are questions worth asking; and this morning at Mobile World Congress in Barcelona, security consultants at mobile security firm AdaptiveMobile asked them in a very bold way, starting a discussion that's resonating worldwide - including as far as the RSA Security conference in San Francisco.
On the other hand, are these questions being answered to any significant degree? Or just being "focused on?" In an interview with ReadWriteWeb this afternoon from Barcelona, AdaptiveMobile's Cathal McDaid spoke to some of the questions asked in a new report published for MWC. Entitled "Machine to Machine: The Future Threat?" the report asks whether a new universe of relatively simple and unsophisticated communications devices will lead to an Internet that is, by design, insecure.
"The security that we have for mobile networks has really been designed for humans," McDaid tells RWW. "For example, if I send you a spam message, you're going to report us to the operator or some concerned party. But if you're actually a mobile device and I send you a spam, you're not going to report it - you're not going to do anything about it. You're going to continue on. If I send you a thousand or tens of thousands of messages, you have a potential for denial of service... So what we're trying to push is, when it comes to security, we need to have security by design, and we need security by design that takes account that we have people and machines communicating with other machines."
The nature of malicious attacks will not be made harder or easier by the infusion of M2M, McDaid believes. They will be different. Because they're low-power devices, the automated clients on M2M networks will not be able to run security software, he says.
The Low End as the Vulnerable One
The AdaptiveMobile report goes into that point in greater depth: "The latest smartphones and tablets come with complex, high-end operating systems that can be protected and reinforced against even the most advanced mobile security threats," the report reads. "Unfortunately, the same cannot be said of all of the devices that will be connected to the M2M enabled 'Internet of Things.' Without hard drives and with any processing power often devoted solely to performing the operation it was designed for, the limited nature of many M2M devices means there is less ability to embed security software."
McDaid cites statistics showing that 1 Internet message in 20 is sent from machine to machine. The protocols involved, he says, are not sophisticated, streaming solutions but rather something as simple as SMS. While consumers may drive newer and more sophisticated communications protocols for their mobile devices, M2M communications may not require an upgrade of format for the foreseeable future - certainly not, by McDaid's estimate, within the next 20 years. So during that timeframe, the same protocol will need to be supported as the foundation for secure communications between machines.
"Those protocols were designed for people, essentially," he says. As his report puts it, "The upgrade mentality does not apply." But shouldn't the age of that technology, if it does carry on for a few decades as McDaid predicts, help ensure its viability and reliability? He answers, "Yes and no."
"Yea, we know how all about new technologies, we know all about how the communications medium works. But on the other hand, our security model has included humans in the past... If somebody's [mobile] device get compromised by virus, one result could be high data usage [on the bill]. This isn't going to happen on M2M. It's going to simply keep processing and running. So you would hope in that situation that somebody notices, which is not guaranteed."
M2M Access May Not Be Open By Design
We ran McDaid's conclusions today by Alex Brisbourne, the president and COO of KORE Wireless Group, and a world-recognized expert in the construction and management of M2M networks. KORE has been delivering M2M connectivity systems since 2003. Reading through the AdaptiveMobile report today, Brisbourne called its interpretation of M2M networking as a security strain on existing human networking "an interesting observation but one not wholly legitimate.
"The fact is, as you make more 'doorways' into the internet, the challenges of controlling access will become ever more acute," Brisbourne tells RWW, also from Brisbourne this evening. "Machine devices will add significantly to the 'access doorways' - just as increasing delivery of smartphones, etc., will do. But this is where there is a substantial difference: Smartphones typically create open access mechanisms to the Internet. Each has its addresses, just as any PC does. Most are using browser technologies that have not been tested in the white heart of hacking, but it's a fact that virus management, malware, and security attacks via smartphone browser are rising fast. Part of the reason is their very openness."
By contrast, Brisbourne goes on, a true M2M environment is already very closed. It is not, as some corporations' marketing has suggested, an extension of the Web into the everyday life of soulless devices.
"Edge devices typically use dedicated network access (custom APNs, etc.) that route data solely to/from specific network resources (servers, hosts) with quite complex (not impossible, however) challenges to getting outside of those domains," Brisbourne remarks (with plenty of parenthesis). "In addition, the streams are often subject to security processes from encryption to SSL support, depending on the application. In sensitive markets such as energy utilities or payment processing, the industries are further beefing this up with industry specific security overlays that go far beyond simple 'end point ingress' - PCI in the payment area, and NIST driving security standards for utilities. These look at both end-to-end as well as indemnity of the points in between. This will certainly continue to grow."
Put another way, just because the endpoint of an M2M transaction doesn't contain Norton Antivirus, doesn't mean it will be insecure. There are architectural differences in the M2M platform that transcend the level of how humans communicate over the Internet.
Cathal McDaid believes these differences are not widely known, which is why a new approach to securing both communications models is necessary. "You don't throw away what you have for human communications. You need to operate like P2P but smarter when it comes to M2M." That extra layer of smarts, he says, should come in the form of some kind of authoritative arbiter, to determine whether a party has the authority to communicate with a device. This is where McDaid and Brisbourne come to some modicum of agreement, especially with regard to the need to decide how much authoritative access a system should grant, and at what time.
"Do you want absolute denial of access (Fort Knox) or do you want simply to impede access until timeliness no longer makes any action relevant (border fences in a prison)?" asks Brisbourne. "Each situation is different, each market different, all have to be considered. M2M, as a part of a broader enterprise data management architecture, is not immune to needing this level of thought."