Digital technology is more important than ever. Not only are items like smartphones, tablets, and laptops ubiquitous with consumers and businesses, emerging trends like IoT (Internet of Things) and Industry 4.0 are introducing digital technology to new applications regularly. The flip side of this topic is that digital security is also now more important than ever.
Everything from personal healthcare information to trade secrets to financial data to how “smart” vehicles operate is digital in 2019. This means stakes are high when it comes to digital security. A data breach can have severe personal or professional consequences. Further, in some cases, such as with Struxnet, a computer virus can affect international relations and nuclear programs.
Given the broad scope of digital technology, there are a variety of layers to digital security in 2019. In this piece, we’ll dive into the different areas of cybersecurity, discuss why they are important, explain how information security has evolved over the years, and explore the importance of digital security for embedded devices.
What is Digital Security?
Since digital security has such a broad scope, it is useful to define the term before exploring the different aspects of digital security. There are varying definitions depending on the source you reference, but at a high level, they all pertain to protecting digital data from unwanted or unauthorized access. Other terms often used to reference digital security include information security and cybersecurity.
Image by Why is Digital Security Important?
In short, digital security is important because it helps keep digital information and assets safe. Poor security posture and ill-advised cybersecurity practices can lead to financial loss or even physical damage. To help conceptualize the potential damage cyber-attacks can create, consider the statistics below:
- The average cost of a data breach is $3.86 million USD
- Identity theft has impacted almost 60 million Americans
- Cryptojacking attacks have surged in recent years, with Semantic blocking 8 million cryptocurrency mining-related events in just December 2017
- The United States is the biggest target for cybersecurity attacks, accounting for 38% of targeted attacks from 2015 to 2017
Reference: Symantec Corporation/Norton
While there will always be day zero threats and risks associated with digital technology, digital security is important because it helps reduce risk and increase the ability of consumers and businesses alike to operate safely in our digitally connected world.
What are the Different Aspects of Digital Security?
Digital security includes a variety of subtopics and subdomains. Here we will review some of the most important and discuss some trends and tips to help you in 2019.
Cryptography
Cryptography deals with encoding communications and data in a way that makes it illegible unless you have the means to decode it. By leveraging modern cryptographic algorithms and ciphers, developers can help ensure that their applications and devices remain secure. In 2019, developers should not be using hash and encryption algorithms like MD5 or SHA-1 for secure applications and consider using algorithms such as scrypt or SHA-3 when needed. Similarly, for networked applications, TLS 1.2 and TLS 1.3 should be favored over SSL v2, SSL v3, TLS 1.0, and TLS 1.2.
Authentication and Authorization
Authentication and authorization deal with ensuring a user is identified in a system and authorized to access a given function or piece of information. An example of poor authentication and authorization practices can be found in the previously linked Norton article where a “smart” door lock could be unlocked over the Internet without using a password.
Developers of such devices can no longer be lax in implementing proper security practices. Leveraging methods such as Multi-factor Authentication (MFA), SSH keys, and secure remote authentication methods can help avoid such egregious oversights.
Firewalls, Anti-virus, Threat Detection, & Access Controls
Firewalls and access controls help restrict network access to devices. This form of cybersecurity is an important part of keeping data secure, particularly for Internet-connected devices. For example, a modern firewall can prevent access to a device if the connection is attempted using a particular port or protocol. Access control lists (ACLs) help restrict access based on IP (Internet Protocol) address to help prevent unauthorized access. Developers of embedded devices can enhance the security of their solutions by enabling firewall or ACL functionality within their devices.
Anti-virus and threat detection software can also help businesses detect, contain, and respond to digital security threats. Artificial intelligence (AI) and machine learning (ML) are making a big impact in this area. AI and ML enabled cybersecurity appliances such as Intrusion Prevention Systems (IPS) and Intrusion Detection Systems (IDS) can rapidly identify threats and enable businesses to improve their information security posture.
User Behavior
Humans that have access to sensitive data should be taken into consideration when implementing a security strategy. Social engineering and tactics like phishing are common attack methods hackers use to infiltrate networks. This means a more informed user base can lead to better digital security.
If your user base includes the type of individual that is continuing browsing after warnings from a browser that a site is insecure, data can be more easily compromised. For this reason, user education and training is important when implementing a plan to strengthen digital security posture. For example, educating users to only install signed USB drivers from trusted sources and how to tell the difference between a website secured by HTTPS compared to a website that uses HTTP only are excellent ways to educate a user base.
From a developer’s standpoint, it is important to keep in mind that businesses in 2019 are now investing in educating that user base on the importance of digital security. This is evidenced by the growth of companies such as KnowBe4 that focus on educating users on security tips. This means developers must be sure to design devices that use only signed and trusted drivers and create applications that support secure network protocols and access methods.
How has Digital Security Evolved?
It is important to understand that, like many other aspects of technology, digital security moves fast. This is particularly important because outdated security protocols and practices can lead to vulnerabilities that hackers can exploit. Before digitization, information security was mostly a function of ensuring secure access methods to physical copies of data.
While the importance of physical security still remains, things have become much more complex. The 1990s saw the rise of anti-virus programs and the more widespread use of firewalls. The 2000s ushered in cloud computing which changed the cybersecurity paradigm. The explosion of IoT and smart devices in the 2010s have made digital security more important than ever. Now we must be able not only to secure devices users access but also devices that act autonomously.
For example, CAN Bus hacking is a major threat vector that can impact a variety of smart devices, including smart vehicles.
How does Total Phase Help Enable Digital Security?
Total Phase offers a variety of tools for debugging, developing, and monitoring embedded systems. As IoT and smart devices continue to grow, our solutions that can be leveraged through the entire product lifecycle will help developers design secure and robust products.
For example, our CAN monitoring and debugging tools help enable developers to design robust CAN systems. Similarly, our Promira Serial Platform can be leveraged by an engineer to help design an IDS based on specifications.
Summary
As our lives become more digitally connected, digital security will continue to grow in importance. As we close out the decade, protecting smart devices, embedded systems, and all aspects of IoT and Industry 4.0 should be a priority for businesses and consumers alike. Sound digital security requires accounting for a variety of attack vectors and subcategories of security, including user education. Total Phase can help engineers and developers by providing industry-leading debugging, monitoring, and programming tools to aid in the design of robust and secure systems.