Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Operations

10/23/2019
04:15 PM
Connect Directly
Twitter
LinkedIn
Google+
RSS
E-Mail
50%
50%

IoTopia Framework Aims to Bring Security to Device Manufacturers

GlobalPlatform launches an initiative to help companies secure connected devices and services across markets.

IoTopia, a new framework for IoT security, aims to standardize the design, certification, deployment, and management of connected services and services, GlobalPlatform reports.

This initiative marks the latest effort to build on IoT security by the industry standards body, whose members work to ensure its specifications align with current and emerging market requirements. GlobalPlatform has 2,600 industry representatives from 90 member companies, and people around the world rely on its certified secure elements, which have been integrated in chip-enabled credit cards, smartphones, smart TVs, and control units built into vehicles.

As the Internet of Things continues to expand, so, too, do GlobalPlatform's efforts to better secure it, says executive director Kevin Gillick. "We're progressing farther into this world of interconnected devices everywhere," he explains. "The same component technology and the same security mindset is logically extensible into this new space."

The IoT is the "wild, wild west," Gillick continues. Device makers are entering the ecosystem and creating connected products without bringing security into the picture. Part of GlobalPlatform's effort involves sharing standardization to bring products to market faster, at a lower price. It makes more sense, he says, for manufacturers to invest R&D into a service they can build their brands around rather than in their own security architectures and certifications.

"There is a lack of a common IoT security framework," he adds. Device manufacturers don't have security at the core of their competence; many avoid it because of the bias that adding more protection will increase cost and time to market. The idea behind IoTopia is to help these makers implement a framework that helps them move forward wihout bring security experts.

"We're seeing a lot of industry associations crop up around IoT who talk a lot about requirements, talk about security and use cases, but don't tell you how to implement it into technology," Gillick says. "Moving from words and speech to something actionable and adoptable is [a gap] no one has been able to close."

IoTopia is based on four pillars. The first is security by design, which includes capabilities and features that define how secure components and APIs can be used with existing "secure by design" standards. The second pillar is device intent. IoTopia uses Internet Engineering Task Force's manufacturer usage descriptions and uniform resource identifier to manage device permissions and access on networks, GlobalPlatform explains.

"We want to make sure we have in place a simple way to answer important questions about the device," Gillick says. "What is this thing? Who is responsible for it? How do I protect it, and how do I protect my business? Is it doing what it should be doing? … There's no systematic way to go about doing that."

The third pillar addresses autonomous, scalable, secure device onboarding (SDO), as IoTopia will offer an open, standards-based secure onboarding process to streamline network administration. The fourth focuses on device life cycle management, including a range of capabilities to manage devices throughout their life cycles aligned with international regulations.

Related Content:

This free, all-day online conference offers a look at the latest tools, strategies, and best practices for protecting your organization’s most sensitive data. Click for more information and, to register, here.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Current Issue
6 Emerging Cyber Threats That Enterprises Face in 2020
This Tech Digest gives an in-depth look at six emerging cyber threats that enterprises could face in 2020. Download your copy today!
Flash Poll
State of Cybersecurity Incident Response
State of Cybersecurity Incident Response
Data breaches and regulations have forced organizations to pay closer attention to the security incident response function. However, security leaders may be overestimating their ability to detect and respond to security incidents. Read this report to find out more.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-1927
PUBLISHED: 2020-04-02
In Apache HTTP Server 2.4.0 to 2.4.41, redirects configured with mod_rewrite that were intended to be self-referential might be fooled by encoded newlines and redirect instead to an an unexpected URL within the request URL.
CVE-2020-8144
PUBLISHED: 2020-04-01
The UniFi Video Server v3.9.3 and prior (for Windows 7/8/10 x64) web interface Firmware Update functionality, under certain circumstances, does not validate firmware download destinations to ensure they are within the intended destination directory tree. It accepts a request with a URL to firmware u...
CVE-2020-8145
PUBLISHED: 2020-04-01
The UniFi Video Server (Windows) web interface configuration restore functionality at the “backup� and “wizard� endpoints does not implement sufficient privilege checks. Low privileged users, belonging to the PUBLIC_GROUP ...
CVE-2020-8146
PUBLISHED: 2020-04-01
In UniFi Video v3.10.1 (for Windows 7/8/10 x64) there is a Local Privileges Escalation to SYSTEM from arbitrary file deletion and DLL hijack vulnerabilities. The issue was fixed by adjusting the .tsExport folder when the controller is running on Windows and adjusting the SafeDllSearchMode in the win...
CVE-2020-6009
PUBLISHED: 2020-04-01
LearnDash Wordpress plugin version below 3.1.6 is vulnerable to Unauthenticated SQL Injection.