How do I secure my CPS Devices?

imageSecurity and CPS devices present an interesting problem. First because we are talking billions of devices. The three concerns that I detailed previously were data, power and access. Access being the broad swath that security lives in. We can also argue that security would be a bubble that fits behind the entire CPS world.

imageIf we explode the access piece we gain additional information about where we have to apply security. There is user level, data level, device level, transmission level and finally location level access that we need to consider. Device is the hardest in that many devices aren’t going to have security chips in them. Location is most interesting because it presents two problems. So let’s start with secure locations.

imageBy definition CPS devices are connected. That means me when when you consider their location you also have the issue of physical and cyber location. It is somewhat reasonable to secure a physical location. The catch-22 here is that you often rely on CPS devices to provide physical security. Now, you have a cyber available security system.

Many years ago when Active Directory first appeared there was an interesting concept of group policies. Where you could apply a set of rules to users, groups and domain joined machines. We tested and played with that at a number of larger customers and came to the realization that security was best applied tightly to machines and loosely to users. Users were more likely to wander to a kiosk and use it. Machines didn’t often wander the building. If they did they were likely terminators and well we were running for our lives and no longer worried about security.

The problem with applying the highest security on the CPS device itself is the resulting change to the device. Many CPS devices continue to shrink. They continue to become smaller and smaller so that their utility is greater. That means there just isn’t physical space for greater security. So instead with CPS we have to apply the greatest security on the user. Social Engineering becomes the hacking tool that violates your CPS system now.

We can argue that there are CPS devices that we don’t care if they get hacked or if their information is compromised. An outside weather station that broadcasts information is information we don’t need to secure. If however that weather station is tied to the HVAC system of a building, we can’t let the information be hacked or modified (air conditioning is wonderful in the summer, really uncomfortable in January when your office is 22 degrees F). So there are devices that we don’t care if their data is compromised. And devices that we do care.

Security and CPS is a very interesting problem. Where access is used to apply security and where other forms of security are used to protect access becomes the question. What once was simply applying physical security (a guard with a gun and a gate or the 3g’s) doesn’t work when the device that is producing the information is cyber connected as well.

more to come…


new rut CPS Security!