Virtual Patches for IoT: Now More than Ever
Join the DZone community and get the full member experience.
Join For FreeWhen Gunnar Peterson and I wrote about the security considerations for Internet of Things, one of the key items was patching ("Vulnerabilities
will be found in IOT systems, but how will they be patched? IOT systems
require management systems for patching and versioning"). The
problem is that Internet of Things devices are often difficult to
update. There isn’t an equivalent of a “Patch Tuesday” for a wristband,
or a Wi-Fi-enabled smart meter. Many devices do not have an auto-update
mechanism, or may be constrained by bandwidth or processing power.
Rather than patching the device itself, patches will often have to be
applied upstream as “virtual patches”. A Gateway is the ideal point to
apply these virtual patches.
Heartbleed made this device all the more important. This week, in an article entitled "It’s Crazy What Can Be Hacked Thanks to Heartbleed",
Robert McMillan covers the work of Nicholas Weaver at UC Berkeley.
Weaver has been investigating the vulnerability of devices such as
programmable thermostats, home routers, and (ironically) home firewalls
to Heartbleed. The problem is that many of these devices are difficult
to patch.
He writes "The bad news is that many of the devices that can be hacked can only be updated manually", and "In other words, the Internet of Things needs a patch".
Virtual patches are the key here. They allow patches to be applied
upstream from the Internet-of-Things device itself, applying a "wrapper"
layer. Virtual patches are also something I also discussed in BBC
articles in the context of vulnerabilities in power station control systems and in protecting Windows XP systems now that patches are no longer provided by Microsoft.
By
enabling virtual patches to be applied, security gateways are an
important piece of a mitigation strategy for vulnerabilities such as
Heartbleed. They are the upstream point at which you can apply security
mitigation, when devices themselves may be difficult or impossible to
patch. This is why at Axway, we provide gateways for Web Services and API traffic, gateways for B2B and file-transfer, and Gateways for email and file sharing.
Heartbleed will not be the last vulnerability to impact the Internet of
Things in this way, but by applying a virtual patching strategy at the
Gateway layer, security mitigation is possible.
Published at DZone with permission of Mark O'Neill, DZone MVB. See the original article here.
Opinions expressed by DZone contributors are their own.
Comments