Endpoint
10/19/2015
11:00 AM
Lev Lesokhin
Lev Lesokhin
Commentary
Connect Directly
Twitter
LinkedIn
RSS
E-Mail
50%
50%

Secure Software Development in the IoT: 5 Golden Rules

The evolving threat landscape doesn't merely expose developers to new problems. It exposes them to old problems that they need to address sooner, faster, and more frequently.

Smart hardware is only as good as its software. Manufacturers have known for a long time that putting "glitchy" software on-board devices is asking for trouble. We’ve seen countless examples of violations of good coding and architectural practices that cause an application to be less reliable and less secure.

In the Internet of Things, this can be downright dangerous. If the smart device is a light switch that turns on when you enter the room, badly written code might result in a stubbed toe. But if it’s a "smart" smoke alarm, fire sprinkler system, or a pacemaker (which can typically contain up to 100,000 lines of code), human lives may be on the line.

The evolution of the landscape is not really creating new problems. Rather, it is exposing developers to problems and capabilities of which they are already well-aware -- at least in some circles. For example, enterprise and web developers are very familiar with the need for robust security against local and remote attacks. The notion of input validation as a first line of defense is well accepted in connected systems today. But IoT development is expanding the scope of those concerns in that embedded, device, and mobile developers now need to start considering security challenges such as input validation during development because it will be too costly to redesign onboard systems to include these defenses after they have been shipped.

In the IoT ecosystem, first-to-market is a competitive driver, and developers will be under further pressure to get products released. However, this could mean sacrificing quality and dependability for speed -- already an issue in many software-intensive environments today. Despite developers’ best intentions, management is always looking for short cuts. Third-party components help offload some of the burden, but in the IoT, with more complexities and upkeep, components will need to be maintained and updated to address problems, like security vulnerabilities, much faster. To meet those demands, developers need to institute several “golden rules for IoT”:

Rule #1: Make proper code review and repeat testing a priority. Manufacturers will need to communicate this message to development teams and call for stricter software quality measures. One bad miscommunication between an application, a sensor and a hardware device can cause systemic failure. 

Rule #2: Software assurance is more critical than ever. Continuous deployment in the connected world will be business-as-usual. Updates will occur non-stop and will often be pushed, perhaps multiple times a day. If the software isn’t continuously monitored and the code evaluated, this almost certainly guarantees failure.

Rule #3: Management must take responsibility for software risk. One way to evaluate issues like reliability, security, or performance at a high level is through analytics that loop business leaders into where the vulnerabilities lie, in order to protect customers and meet the company’s fiduciary responsibility to shareholders. Another way is through benchmarking. Knowing the baseline starting point and comparing it to industry performance provides fact-based insight.

Rule #4: Up the game for structural quality analysis. For some enterprise IT developers, this might be a familiar environment, especially if they are running mission-critical systems, like a utilities provider or a bank. But, ordinary app and device software developers could suddenly find themselves needing to take much more rigid precautions, such as the same degree of structural quality analysis and code review required by software engineers for airline autopilot systems.

Rule #5: Make software quality and security education a priority. We all need to evangelize the fact that security vulnerabilities caused by poor coding or system architectural decisions can be some of the most expensive problems to correct.

A significant standards initiative surrounding quality will provide manufacturers and IT departments with a consistent way to measure the quality of their software. The Object Management Group recently approved a set of global standards proposed by the Consortium for IT Software Quality (CISQ) that would help companies quantify and meet specific goals for software quality. CISQ’s measurement standards include security, reliability, performance, and maintainability. This will allow businesses to certify the quality of their codebases and IoT networks.

By its nature, size, and complexity, software is almost impossible to completely protect from disruptions and breaches. In the IoT, those complexities will expand. Understanding the importance of a secure architecture foundation and insisting that developers comply with industry standards will be the first line of defense. After that, you’re on your own. 

Lev Lesokhin is executive vice president of strategy for CAST. He is responsible for market development, strategy, thought leadership and product marketing worldwide. He has a passion for making customers successful, building the ecosystem, and advancing the state of the art ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: "Why else would HR ask me if I have a handicap?"
Current Issue
The Changing Face of Identity Management
Mobility and cloud services are altering the concept of user identity. Here are some ways to keep up.
Flash Poll
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7445
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

CVE-2015-4948
Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

CVE-2015-5660
Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

CVE-2015-6003
Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

CVE-2015-6333
Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio
Archived Dark Reading Radio

The cybersecurity profession struggles to retain women (figures range from 10 to 20 percent). It's particularly worrisome for an industry with a rapidly growing number of vacant positions.

So why does the shortage of women continue to be worse in security than in other IT sectors? How can men in infosec be better allies for women; and how can women be better allies for one another? What is the industry doing to fix the problem -- what's working, and what isn't?

Is this really a problem at all? Are the low numbers simply an indication that women do not want to be in cybersecurity, and is it possible that more women will never want to be in cybersecurity? How many women would we need to see in the industry to declare success?

Join Dark Reading senior editor Sara Peters and guests Angela Knox of Cloudmark, Barrett Sellers of Arbor Networks, Regina Wallace-Jones of Facebook, Steve Christey Coley of MITRE, and Chris Roosenraad of M3AAWG on Wednesday, July 13 at 1 p.m. Eastern Time to discuss all this and more.