A Security Guide to IoT-Cloud Convergence

The internet of things (IoT) has risen as one solution to the demands that have emerged because of the worldwide pandemic. The IoT, with its key characteristic of minimizing human interaction in performing a myriad of functions, seems a perfect fit in a world of remote setups and social distancing. But it is thanks to cloud computing that enterprises can smoothly make large-scale deployments of the IoT.

The integration of the IoT and cloud computing — as prominently manifested in the profusion of cloud services that power the IoT, collectively known as the IoT cloud — poses a new frontier for how industries are run. It is thus important not to overlook their respective security risks and the implications of these risks when the two technologies converge.

The role of cloud computing in the IoT

With regard to the security of IoT-cloud convergence, it would be best to understand how the IoT and cloud computing work together. The IoT by itself works on a diverse selection of devices that fit into the requirements of different industries or settings. Cloud computing, on the other hand, involves storing and accessing data, applications, or services over the internet — that is, in the cloud — instead of in physical servers or mainframes.

The cloud helps IoT environments by all but removing their defining limitations, such as their processing and storage capacities. The IoT, meanwhile, connects the cloud to physical or real-world devices. Figure 1 shows an example of a cloud-based IoT infrastructure.

Figure 1. An example of a cloud-based IoT infrastructure

The following are some of the other advantages of IoT-cloud convergence:

• Remote operation and interoperability: IoT devices do not typically have the resources for interoperability. Integration with the cloud, which is by nature interoperable, allows support engineers and device administrators to perform remote tasks (such as gathering data on their assets, conducting maintenance, and setting configurations) on IoT devices deployed in the field, which is a crucial requirement in present times.
• Unlimited data storage: The IoT handles troves of unstructured data coming from multiple sensors. The cloud is known for its near limitless storage capacity. When the two are combined, it opens up more space for aggregation and analysis of data.
• Unlimited processing capabilities: IoT devices and apps have limited processing capabilities, often just enough to perform their specific functions. Processing of a lot of data is done on a separate node. Integration with the cloud opens up its unlimited virtual processing capabilities, including the use of artificial intelligence (AI) and machine learning (ML) for data-driven decision-making and improvements.
• Added security measures: The cloud offers features that address some of the security gaps in the IoT. Examples of these features include enhancement of authentication mechanisms and device identity verification.

Security challenges

While it is true that the cloud offers solutions that can address some of the security gaps of the IoT, the integration of the two does not instantly solve the threats both technologies face. In some ways, IoT-cloud convergence elevates the urgency of these security risks as IoT-related weaknesses could cause more complicated problems in the cloud ecosystem, and vice versa.

The following are some of the challenges enterprises might face in creating secure IoT-cloud environments:

• Risk arising from centralizing the entry into critical infrastructure. The integration of the IoT and the cloud significantly reduces the attack surface by restricting all incoming and outgoing traffic to pass through the API gateway in the cloud. A high-end firewall is necessary to protect this flow of data through this gateway, but this highlights an old security concern, which is whether the firewall is sufficient defense. While a single entry minimizes the attack surface, it directs attention to a single target for potential attackers. If a malicious actor finds the right opportunity, this entry could somehow become their very “tunnel” into the infrastructure.
• Unsecure communication and data flow between the edge and the cloud: If the endpoints or the cloud has inadequate security features, such as authentication and encryption, this could put access controls and the integrity of the data sent between these two points at risk.
• Privacy and authorization issues: Enterprises need to consider how IoT devices and sensors gather sensitive data, which in a cloud-based ecosystem would be transmitted to a space that is interoperable and serves other users and clients in the case of the public cloud. Enterprises need to discuss the location of their data with their respective cloud service providers especially in areas with strict capitalization.
• Poor implementation of the IoT: An IoT ecosystem where security measures (such as changing default passwords, applying network segmentation, and physically securing devices) are not adequately implemented is likely to carry its weaknesses over even with the integration with the cloud. For example, to access the cloud, IoT components need one key to pass the API gateway.  In IoT implementations, endpoint devices should not store this key in plain text and the shared access signature (SAS), which allows limited access to the cloud, without a timeout.
• Cloud misconfiguration and other vulnerabilities: One of the most common problems faced in cloud computing is misconfiguration. Misconfigurations give malicious actors openings to conduct attacks such as data exfiltration. These and similar security flaws in the cloud could lead to serious consequences for the IoT ecosystem it is a part of.

Figure 2 illustrates the impact of these challenges if left unaccounted for, mapped to the top 10 web application security risks according to the Open Web Application Security Project (OWASP).