IEEE Talks IoT: Jacob West
Jacob West is chief architect for security products at NetSuite and co-author of “WearFit: Security Design Analysis of a Wearable Fitness Tracker,” which supports the IEEE Center for Secure Design’s report, “Top Ten Software Security Design Flaws.” Both reports and the Center are part of the IEEE Cybersecurity Initiative. As this interview reveals, software secure design and wearable technology are intimately connected with the Internet of Things.
Question: You’ve co-authored a new report that uses a fictitious “WearFit” device to illustrate sound software security design in wearable fitness trackers. How does this example fit into the Internet of Things (IoT)?
Jacob West: Let me count the ways! The IoT is composed of a rapidly increasing number of networked devices and sensors, which contain or are connected with processing power. In the case of wearable fitness trackers, these devices don't fit the traditional form factor of a computer, and their rapid uptake means that the public is interacting with computing technology in new and different ways.
Many of these devices are designed to communicate with each other and with us, presumably to improve our quality of life, our energy efficiency and to produce other benefits. However, there are potential downsides. In a version of Metcalf’s Law – that as the number of nodes in a network increases, so does the value of each node – such networks at scale also introduce an increase in what we call “attack surface,” which vastly increase the potential for successful attacks.
So not only do wearable fitness trackers fit into the IoT, but our report highlights the need for secure software design in connected devices broadly speaking. Fundamentally, we chose a fictitious wearable fitness tracker to illustrate points in secure software design because it serves as a proxy for the proliferation of connected devices that will populate the IoT. According to Forbes, nearly half of all consumers expect to purchase wearable technology by 2019, which makes this a top concern for security practitioners.
Question: Would you describe the report’s intended impact on consumers, software designers and the vendors of such devices?
West: Consumers don’t need to master the nuances of software security, but they need to be aware that nothing is 100 percent secure and that the products they choose and how they use them can affect the security and privacy of their health and fitness data, among others.
For software security designers and the companies that employ them, we’d like to convey the mission of the Center for Secure Design: to shift the industry from a reactive stance of finding and fixing bugs to include a proactive approach of secure design that eliminates opportunities for bugs to develop. We need a more balanced approach. For software designers in particular, the analyses we provide in the report should expand their thinking about issues related to their own work and add tools to their toolbox.Question: How is that intent accomplished in this report?
West: First, my co-authors and I settled on a popular wearable product category and a fictitious but realistic design for the system. For the vast majority of software architects who do not work on wearable fitness trackers, we provide an introductory system overview that describes the device’s software architecture, its components, how they fit into the device as a whole, the mobile application that communicates data and the backend website that the data are uploaded to and with which users interact. All of this provides background on the device’s functionality, independent of software security issues.
The report then walks through the top ten software security design flaws we identified in our previous report, but in the context of this fictional WearFit device. We discuss each flaw in detail and how to avoid it. Where certain flaws relate to other flaws, we cross-reference that relationship.
Question: Does the emerging IoT create issues of scale – the sheer proliferation of “things” or the size of networks – that affect sound software security design?
West: In my view, with the proliferation of devices and order of magnitude increases in connectivity, scale is going to present a challenge for designers of software systems for the foreseeable future. Personally, however, I don’t believe that the IoT is going to be the biggest driver of that challenge. We've gotten very, very good at generating data at incredibly large rates and in incredibly large volumes. And I don’t know that a large number of individual devices is going to have a particularly different implication for the generation and consumption of big data. Scale is definitely a challenge everywhere, including IoT. I don't believe that secure software design is specifically impacted by IoT’s scale.