10 IoT Cyber Security
487
make it easy for those researchers to share their information by establishing a
formalized vulnerability disclosure program. The IoTSF also provides guidance on
establishing a vulnerability disclosure program [14].
Bug bounty programs are also an option for proactively engaging with the
security community. Organizations like BugCrowd (https://www.bugcrowd.com/
product/bug-bounty/) can support the creation of a bug bounty program. The
organization HackerOne (https://www.hackerone.com/) successfully established a
bug bounty for the Department of Defense (DoD) in 2016. The first Hack the
Pentagon event identified 138 unique vulnerabilities [15].
10.3.2 Integrating Safety and Security Engineering
IoT systems integrate the cyber and physical domains. As such, both safety and
security engineering disciplines must be incorporated in order to mitigate both
safety and security risks.
Safety and security engineering have some similarities. IoT systems must be
engineered to adhere to security and safety goals simultaneously. A safety engineers’ primary modeling tool is the fault tree. Fault tree analysis (FTA) identifies
common mode failures.
There are similarities between fault trees and a common cyber security modeling
tool known as attack trees. Fault trees, however, do not take into account the creative
approaches used by attackers to cause system disruption. IoT system designers must
be able to evaluate both attack trees and fault trees. This helps to analyze how a
motivated attacker might target the safety controls within a system, for example.
Establish a safety engineering function within your development team to analyze
the safety impacts of your system. Given the intended use of the system, is there a
potential for physical harm if the device stopped working, or malfunctioned. Even if
the machine itself is not safety-critical, consider whether there are any other safetycritical devices or services that depend upon outputs from the machine. Consider
how potential harm from machine failure could be minimized or avoided.
A good example of the integration of safety and cyber security is the definition of
a fail-safe state that is entered upon detection of a cyber security event. For example,
with an AV the vehicle may be programmed to enter into this fail-safe mode that
brings it to a safe stop at the side of the road upon detection of a serious event.
Alternatively, the system may simply report the event to the cabin occupant and
instead fail-operationally, allowing the driver to take control and decide on a course
of action.
487
make it easy for those researchers to share their information by establishing a
formalized vulnerability disclosure program. The IoTSF also provides guidance on
establishing a vulnerability disclosure program [14].
Bug bounty programs are also an option for proactively engaging with the
security community. Organizations like BugCrowd (https://www.bugcrowd.com/
product/bug-bounty/) can support the creation of a bug bounty program. The
organization HackerOne (https://www.hackerone.com/) successfully established a
bug bounty for the Department of Defense (DoD) in 2016. The first Hack the
Pentagon event identified 138 unique vulnerabilities [15].
10.3.2 Integrating Safety and Security Engineering
IoT systems integrate the cyber and physical domains. As such, both safety and
security engineering disciplines must be incorporated in order to mitigate both
safety and security risks.
Safety and security engineering have some similarities. IoT systems must be
engineered to adhere to security and safety goals simultaneously. A safety engineers’ primary modeling tool is the fault tree. Fault tree analysis (FTA) identifies
common mode failures.
There are similarities between fault trees and a common cyber security modeling
tool known as attack trees. Fault trees, however, do not take into account the creative
approaches used by attackers to cause system disruption. IoT system designers must
be able to evaluate both attack trees and fault trees. This helps to analyze how a
motivated attacker might target the safety controls within a system, for example.
Establish a safety engineering function within your development team to analyze
the safety impacts of your system. Given the intended use of the system, is there a
potential for physical harm if the device stopped working, or malfunctioned. Even if
the machine itself is not safety-critical, consider whether there are any other safetycritical devices or services that depend upon outputs from the machine. Consider
how potential harm from machine failure could be minimized or avoided.
A good example of the integration of safety and cyber security is the definition of
a fail-safe state that is entered upon detection of a cyber security event. For example,
with an AV the vehicle may be programmed to enter into this fail-safe mode that
brings it to a safe stop at the side of the road upon detection of a serious event.
Alternatively, the system may simply report the event to the cabin occupant and
instead fail-operationally, allowing the driver to take control and decide on a course
of action.