The Internet of Things - in the form of smart homes with connected doorbells and smart light bulbs - is already permeating every area of our lives. But the real impact of IoT is happening within industry, where connected devices are streamlining business processes and making entirely new revenue streams possible.
By connecting devices with systems, data, and people, businesses are finding that they can introduce more personalised, automated, and enhanced experiences for their customers and employees.
But what happens to these connected devices when they can’t connect to the internet? Do they simply become an inanimate ‘dumb’ object? Worse still, without the access permissions granted by the network, are devices open to increased security risks?
Gerhard Zehethofer is the VP of IoT at ForgeRock.
Offline IoT devices and situational awareness
Take for example the latest smart farming equipment, which has the ability to fully integrate and connect all of your farming tools and infrastructure - from your tractor to the barn temperature to your maintenance management software - to the cloud and to your suppliers, making day to day life a lot easier and efficient in many ways. But what happens if there’s a sudden interruption through an electrical outage, network outage or from a device malfunction that brings your smart system offline unexpectedly?
Most IoT installations have an interruption of connectivity of some sort at some point in time so it's essential that IoT devices are designed with this kind of scenario in mind.
To determine whether a loss of connectivity has implications from a safety and security standpoint, we need to consider what kind of offline status we’re talking about – whether it’s a standard mode of operation or, crucially, a failure or breakdown of the device. Under regular operating conditions, connected devices that go offline should function as if nothing happened. However, if there has been a breakdown of some kind, the device has to come to a secure and safe state (the specifics of what that safe space looks like is largely dependent on the function of the device) but it won’t continue to operate as normal.
For example, if your connected tractor loses connection and suddenly goes offline mid-use, you wouldn’t want the device to shut down immediately - a major safety concern. Therefore it should be able to operate autonomously even when not connected for a defined period of time. However, the system will move to its safe state with manual operation only should it also lose its GPS signal on top of that. Similarly, if your parked car and its corresponding smart key is in an underground garage with no cell phone signal, of course the electronic key should continue to work.
When IoT goes offline for weeks
However, what happens when your smart farm hasn’t been connected to its cloud services for three weeks - could it be fraud? If it’s a very rural farm in Brazil for example, three weeks wouldn’t be a long enough time frame as they likely use a satellite connection. However, if it’s a farm in the south of England that regularly connects to a broadband service, then several days might be an appropriate time frame that raises suspicion.
But how long is too long for an IoT smart device to remain secure when there’s an interruption in connectivity? What happens to data when it cannot access its online storage? The answer to these questions is determined by how well different use cases, particularly those where the online connection and/or other services are interrupted, have been anticipated and factored in during the product development process.
The onus is on the device manufacturer and the platform operator to consider all of these eventualities in order to design a system that is capable of planning for contingencies and reducing harmful activity based on the unique use cases of that specific device. For example, if someone is attempting to connect to a smart home hub, such as Google Home Hub, that has been offline for three weeks, the access rights granted will depend on users privileges as well as on how this scenario has been configured within the device; for example, access after a certain time could be restricted to specific individuals.
Using digital identity to keep your device safe and secure
Whether the loss of connectivity is planned or unplanned, ensuring that a connected device is safe and secure when offline requires several measures that prevent it from booting up after manipulation while offline, as well as the inclusion of a set of policies to be programmed and enforced within the device.
Digital identity - both the identity of the device itself and the individual or entity trying to access it - sits at the core of this since, without the right digital identity system in place, you cannot be sure that you are only granting access to the right individual, or thing, in the right circumstances.
A scalable, IoT-ready Identity and Access Management (IAM) system is therefore vital so that your system is capable of knowing who is accessing the network. By empowering devices as first-class citizens that have the full power of a modern IAM system, it allows devices to be managed the same way identities for humans are managed.
Expect the unexpected
In summary, a sudden loss in connectivity that brings your IoT device offline doesn’t necessarily mean that your device will a) completely shut down or b) become exposed to nefarious hackers. With a state-of-the-art, scalable IAM system that uses digital identity to authenticate and authorise every actor (human and non-human), both those within and those attempting to access the network, there is no reason that your connected devices should not remain functional and secure even when offline.
However, you shouldn’t assume that a device is automatically equipped to handle unplanned connectivity glitches either. If you are a device manufacturer, it’s vital to define the use cases for a normal connected operation, normal operation with interrupted connectivity, and interrupted service for your product to make sure that you have processes in place to handle the security and data implications for the cases defined. And, if you are implementing IoT devices within your organisation, it is vital to do your due diligence to ensure that every IoT device has the right processes and digital identity systems in place before you begin to deploy them to support business critical functions.
Gerhard Zehethofer is the VP of IoT at ForgeRock.
- Check out the best cloud antivirus.
