Smart cities will help both the private and public sector excel in many areas, but as helpful they are, they also come with many security risks. PERRY HUTTON, Regional Vice President – Africa at Fortinet, outlines five security areas CIOs need to watch out for.
Car navigation systems that can predict where and when traffic jams might occur, by siphoning data from sensors in roads and other vehicles. Cameras that can spot litter in public places and call in the cleaning crew. Self-adjusting street lamps.
These are just a few of the scenarios that could become commonplace as smart cities take hold over the next few years. Driven by rising urbanisation and fuelled by technologies such as the Internet of Things (IoT) and data analytics, smart cities are on the cusp of explosive growth. Glasgow, Barcelona, Nice, New York City, London and Singapore have already embarked on the trek. The smart city technology market could be worth US$27.5 billion annually by 2023, according to Navigant Research.
Smart city initiatives are driven by public sector initiatives. However, they will have a big impact on businesses. CIOs will have to learn how to tap on the new connected city infrastructure for their business. Smart city technologies like IoT and data analytics are expected to drive innovative business ideas in the future.
But the new wave of smart city services and technologies are also expected to create new security vulnerabilities. Here are five areas CIOs should watch out for.
1. A further fragmentation of IT
The last few years saw a rapid proliferation of cloud services and mobile device adoption in the workplace. The trend has transformed business productivity. But it has also wrecked the tight-fisted control that CIOs used to be able to exert on their IT systems.
CIOs now have to grapple with the idea of employees using unsanctioned cloud services via unsecured phones to hook up to corporate servers and accessing sensitive business data. The expected explosion of IoT devices − researchers estimate that by 2020, the number of active wireless connected devices will exceed 40 billion worldwide − will result in a further fragmentation of IT in businesses.
Instead of fighting the losing battle of trying to lock down devices and services, CIOs should look at protecting the data. Look for IoT devices that offer device-to-device encryption. Consider implementing − as well as bolstering − comprehensive encryption schemes to protect data in networks, cloud services and endpoint devices.
2. Device vulnerabilities
In the past year, security researchers have exposed holes in Wi-Fi-enabled Barbie dolls, Jeep Cherokee cars, fitness trackers and other new-fangled connected devices. Fortinet’s FortiGuard Labs already see IoT based attacks on the radar and happening in real time around the world. This shows the risks that are coming as toys, wearables, cars and power grids get attached to sensors that are linked to a common network and the Web.
IoT will bring forth a larger surface attack. Hackers will eye IoT devices as a launching pad for ‘land-and-expand’ attacks. One scenario: hackers take advantage of vulnerabilities in connected consumer devices to get a foothold within the corporate networks and hardware to which they connect.
So how do CIOs protect against the risks of connected devices and their own IoT implementations? Short of physically separating such devices from all other network systems, they can consider deploying network-based protection schemes. Internal segmentation firewalls, or ISFWs, for instance, can mitigate the proliferation of threats inside the business network. They also need to employ an IoT network security solution which is capable of mitigating exploits against this growing and vulnerable attack surface. IoT vendors need to harden their products and develop proper product security (PSIRT) teams.
3. IoT gateways can be exploited
In a typical IoT deployment, the majority of connected devices will be always connected and always on. Unlike mobile phones and laptops, such devices are likely to go through only a one-time authentication process across multiple sessions. This will make them attractive to hackers looking to infiltrate into company networks, as it allows easy control and sniffing of traffic. Shoring up the security of the gateways that connect IoT devices is therefore a must. CIOs should map out where these gateways are and where they are linked to − they can reside internally or externally, and even be connected to IoT device manufacturers. There must also be a sound plan for updating security patches on these gateways, as well as the IoT devices.
4. Big data, more risks
If there is a constant in smart city deployments, it is that more data will be generated, processed and stored. Connected devices will generate huge data repositories. Businesses that adopt big data systems will see an even larger data deluge. Unfortunately, such data will also become attractive targets for corporate hackers. To protect huge amounts of data with large inflows and outflows, the bandwidth capabilities of security appliances will come to the fore. And when dealing with data analytics, it often isn’t just a single data set, but multiple repositories of data that may be combined and analyzed together by different groups of people. For instance, a pharmaceutical company’s research efforts may be open to employees, contractors and interns. This means individual access and auditing rights.
5. A new can of worms
New worms designed to attach to IoT devices will emerge − and they could wreak more havoc given the extended reach of the new converged networks. Conficker is an example of a worm that spread on PC’s in 2008 and is still persistent and prevalent in 2016. Likewise, worms and viruses that can propagate from device to device can be expected to emerge – particularly with mobile and the Android operating system. Embedded worms will spread by leveraging and exploiting vulnerabilities in the growing IoT and mobile attack surface. The largest botnet FortiGuard labs has witnessed is in the range of 15 million PC’s. Thanks to the internet of things, this can easily reach in excess of 50 million if the spread of IoT worms is not properly mitigated. Patch management, and network based security inspection – particularly intrusion prevention systems or IPS – that can block IoT worms is a must.
Smart home arrives in SA
The smart home is no longer a distant vision confined to advanced economies, writes ARTHUR GOLDSTUCK.
The smart home is a wonderful vision for controlling every aspect of one’s living environment via remote control, apps and sensors. But, because it is both complex and expensive, there has been little appetite for it in South Africa.
The two main routes for smart home installation are both fraught with peril – financial and technical.
The first is to call on a specialist installation company. Surprisingly, there are many in South Africa. Google “smart home” +”South Africa”, and thousands of results appear. The problem is that, because the industry is so new, few have built up solid track records and reputations. Costs vary wildly, few standards exist, and the cost of after-sales service will turn out to be more important than the upfront price.
The second route is to assemble the components of a smart home, and attempt self-installation. For the non-technical, this is often a non-starter. Not only does one need a fairly good knowledge of Wi-Fi configuration, but also a broad understanding of the Internet of Things (IoT) – the ability for devices to sense their environment, connect to each other, and share information.
The good news, though, is that it is getting easier and more cost effective all the time.
My first efforts in this direction started a few years ago with finding smart plugs on Amazon.com. These are power adaptors that turn regular sockets into “smart sockets” by adding Wi-Fi and an on-off switch, among other. A smart lightbulb was sourced from Gearbest in China. At the time, these were the cheapest and most basic elements for a starter smart home environment.
Via a smartphone app, the light could be switched on from the other side of the world. It sounds trivial and silly, but on such basic functions the future is slowly built.
Fast forward a year or two, and these components are available from hundreds of outlets, they have plummeted in cost, and the range of options is bewildering. That, of course, makes the quest even more bewildering. Who can be trusted for quality, fulfilment and after-sales support? Which products will be obsolete in the next year or two as technology advances even more rapidly?
These are some of the challenges that a leading South African technology distributor, Syntech, decided to address in adding smart home products to its portfolio. It selected LifeSmart, a global brand with proven expertise in both IoT and smart home products.
Equally significantly, LifeSmart combines IoT with artificial intelligence and machine learning, meaning that the devices “learn” the best ways of connecting, sharing and integrating new elements. Because they all fall under the same brand, they are designed to integrate with the LifeSmart app, which is available for Android and iOS phones, as well as Android TV.
Click here to read about how LifeSmart makes installing smart home devices easier.
Matrics must prepare for AI
By Vian Chinner, CEO and founder of Xineoh.
Many in the matric class of 2018 are currently weighing up their options for the future. With the country’s high unemployment rate casting a shadow on their opportunities, these future jobseekers have been encouraged to look into which skills are required by the market, tailoring their occupational training to align with demand and thereby improving their chances of finding a job, writes Vian Chinner – a South African innovator, data scientist and CEO of the machine learning company specialising in consumer behaviour prediction, Xineoh.
With rapid innovation and development in the field of artificial intelligence (AI), all careers – including high-demand professions like engineers, teachers and electricians – will look significantly different in the years to come.
Notably, the third wave of internet connectivity, whereby our physical world begins to merge with that of the internet, is upon us. This is evident in how widespread AI is being implemented across industries as well as in our homes with the use of automation solutions and bots like Siri, Google Assistant, Alexa and Microsoft’s Cortana. So much data is collected from the physical world every day and AI makes sense of it all.
Not only do new industries related to technology like AI open new career paths, such as those specialising in data science, but it will also modify those which already exist.
So, what should matriculants be considering when deciding what route to take?
For highly academic individuals, who are exceptionally strong in mathematics, data science is definitely the way to go. There is, and will continue to be, massive demand internationally as well as locally, with Element-AI noting that there are only between 0 and 100 data scientists in South Africa, with the true number being closer to 0.
In terms of getting a foot in the door to become a successful data scientist, practical experience, working with an AI-focused business, is essential. Students should consider getting an internship while they are studying or going straight into an internship, learning on the job and taking specialist online courses from institutions like Stanford University and MIT as they go.
This career path is, however, limited to the highly academic and mathematically gifted, but the technology is inevitably going to overlap with all other professions and so, those who are looking to begin their careers should take note of which skills will be in demand in future, versus which will be made redundant by AI.
In the next few years, technicians who are able to install and maintain new technology will be highly sought after. On the other hand, many entry level jobs will likely be taken care of by AI – from the slicing and dicing currently done by assistant chefs, to the laying of bricks by labourers in the building sector.
As a rule, students should be looking at the skills required for the job one step up from an entry level position and working towards developing these. Those training to be journalists, for instance, should work towards the skill level of an editor and a bookkeeping trainee, the role of financial consultant.
This also means that new workforce entrants should be prepared to walk into a more demanding role, with more responsibility, than perhaps previously anticipated and that the country’s education and training system should adapt to the shift in required skills.
The matric classes of 2018 have completed their schooling in the information age and we should be equipping them, and future generations, for the future market – AI is central to this.