10 IoT Cyber Security
485
10.3.1.4 Conducting Code Audits and Automating Processes
Code auditing today should occur continuously. Static and dynamic analysis tools
provide feedback that can identify weaknesses in code. Dynamic analysis is used
to identify weaknesses during the operation of the software. Static analysis tools
review the source code for known weaknesses. Depending on the sensitivity of
the code being developed, manual source code reviews can also be required.
Systems today often contain millions of lines of code (LoC), so any manual
review must be focused on high-value areas of the code. For example, a manual
review might be required based on the results of a static or dynamic analysis
tool output. Architectural reviews should also be conducted regularly. As time
progresses, the features and functions of an application or system may change
substantially. Revisiting the security architecture can ensure that open weaknesses
are not unintentionally exposed.
Binary analysis should also be performed. There are many binary analysis tools
available. Binwalk is an open source tool that supports analysis of the files contained
within firmware. The tool is available for use within Kali Linux distributions [8].
Premium binary analysis products also exist. VDOO, for example, provides
a firmware analysis tool that maps results to cyber security standards and best
practices available from organizations such as ENISA, Cloud Security Alliance,
IoT Security Foundation (IoTSF), and the National Institute of Standards and
Technology (NIST) [9].
Additional testing such as fuzzing should also be performed. Fuzz testing
is a black box testing method that introduces unexpected inputs into software.
By injecting “bad” data such as malformed data automatically to the software,
anomalies can be identified in the way that the software handles unexpected inputs.
Tools such as Peach [10] allow security engineers to quickly begin the process of
fuzzing their software. Fuzzing should include the initial connection setup, state
changes such as power on or power off, and http or protocol fields such as headers
or length/value fields.
Automation has been a critical enabler of quality code development for years
now. Automated test tools evaluate developer adherence to coding standards and
quickly pinpoint bugs in code. The same is true for evaluating the cyber security
posture of software used within your IoT system. Automated analysis tools can
be integrated into your Continuous Integration (CI) environment to check for
adherence to secure coding guidelines. Static analysis tools, dynamic analysis tools,
firmware analysis tools, and even fuzz testers can now be incorporated within
the CI environment. These tools can be integrated with requirements management
platforms such as JIRA to automatically open ISSUES that must be addressed by
the development team.
485
10.3.1.4 Conducting Code Audits and Automating Processes
Code auditing today should occur continuously. Static and dynamic analysis tools
provide feedback that can identify weaknesses in code. Dynamic analysis is used
to identify weaknesses during the operation of the software. Static analysis tools
review the source code for known weaknesses. Depending on the sensitivity of
the code being developed, manual source code reviews can also be required.
Systems today often contain millions of lines of code (LoC), so any manual
review must be focused on high-value areas of the code. For example, a manual
review might be required based on the results of a static or dynamic analysis
tool output. Architectural reviews should also be conducted regularly. As time
progresses, the features and functions of an application or system may change
substantially. Revisiting the security architecture can ensure that open weaknesses
are not unintentionally exposed.
Binary analysis should also be performed. There are many binary analysis tools
available. Binwalk is an open source tool that supports analysis of the files contained
within firmware. The tool is available for use within Kali Linux distributions [8].
Premium binary analysis products also exist. VDOO, for example, provides
a firmware analysis tool that maps results to cyber security standards and best
practices available from organizations such as ENISA, Cloud Security Alliance,
IoT Security Foundation (IoTSF), and the National Institute of Standards and
Technology (NIST) [9].
Additional testing such as fuzzing should also be performed. Fuzz testing
is a black box testing method that introduces unexpected inputs into software.
By injecting “bad” data such as malformed data automatically to the software,
anomalies can be identified in the way that the software handles unexpected inputs.
Tools such as Peach [10] allow security engineers to quickly begin the process of
fuzzing their software. Fuzzing should include the initial connection setup, state
changes such as power on or power off, and http or protocol fields such as headers
or length/value fields.
Automation has been a critical enabler of quality code development for years
now. Automated test tools evaluate developer adherence to coding standards and
quickly pinpoint bugs in code. The same is true for evaluating the cyber security
posture of software used within your IoT system. Automated analysis tools can
be integrated into your Continuous Integration (CI) environment to check for
adherence to secure coding guidelines. Static analysis tools, dynamic analysis tools,
firmware analysis tools, and even fuzz testers can now be incorporated within
the CI environment. These tools can be integrated with requirements management
platforms such as JIRA to automatically open ISSUES that must be addressed by
the development team.