1. INTRODUCTION
There are currently more objects connected to the Internet than there are people
in the world [1]. This gap will continue to grow, as more objects gain the ability
to directly interface with the Internet or become physical representations of data
accessible via Internet systems. This trend toward greater object interaction in the
Internet is collectively described as the Internet of Things (IoT). As with previous
global technology trends, such as widespread mobile adoption and datacentre
consolidation, the changing information landscape associated with the Internet of
Things represents considerable change to the attack surface and threat environment
of the Internet and Internet-connected systems.
The precise definition of the Internet of Things is a subject of some debate, due to
the influence of several contributing trends, as well as various interpretations of
the phrase in everything from scientific research to marketing materials [2]. For
purposes of attack surface and threat analysis, let us confine our discussion to two
component trends within the larger IoT landscape, namely ubiquitous networkconnected
technologies, and object-embedded information produced and consumed
by those pervasive technologies.
The past decade has seen staggering growth in the number of devices that humans
use to directly produce and consume network information. As of 2010, there were
over 12.5 billion such devices on the Internet, up from 500 million in 2003, and we
estimate that there will be 50 billion by 2020 [1].
However, there are also an increasing number of technologies that do not require
human interaction to produce and consume network information. In 2020, we
estimate that there will be over a trillion such systems.
Further, the number of objects that do not directly connect to the Internet, yet
contain embedded information, is also on the rise. Much focus in the context of the
Internet of Things has been placed on RFID tags, of which over 15 billion have been
produced [3]. However, objects may also contain embedded information in the form
of barcodes (representing over 5 billion machine-object interactions per day [4]),
serial numbers, and other forms of machine-consumable object symbology, which
are present on the vast majority of objects involved in commerce.
The Internet of Things is defined as much by its interconnectivity as by its
comprising entities. Early attempts at understanding the relationship between
entities of the IoT were focused on their statistical relationships. Using this
approach, one might project a world population of 7.6 billion in 2020, and each
person matched up with 6 connected devices, over 130 sensors, and innumerable
embedded information objects. Simple statistical relationships, however, do not
reflect the actual distribution of objects and technology, or the dynamic nature of
the interactions between IoT entities. Usman Haque has suggested that we think of
the IoT in terms of environments, as opposed to objects or sensors [5]. In order to
assess the threat implications of the IoT, we will first discuss the relevant surface
characteristics of these environments, and their dynamic nature. What systems and
information are present in this environment at this time? What interactions are
possible between them? Then, we will consider the agency of those characteristics
in the frequency and effects of various cyber attacks.
1. INTRODUCTIONThere are currently more objects connected to the Internet than there are peoplein the world [1]. This gap will continue to grow, as more objects gain the abilityto directly interface with the Internet or become physical representations of dataaccessible via Internet systems. This trend toward greater object interaction in theInternet is collectively described as the Internet of Things (IoT). As with previousglobal technology trends, such as widespread mobile adoption and datacentreconsolidation, the changing information landscape associated with the Internet ofThings represents considerable change to the attack surface and threat environmentof the Internet and Internet-connected systems.The precise definition of the Internet of Things is a subject of some debate, due tothe influence of several contributing trends, as well as various interpretations ofthe phrase in everything from scientific research to marketing materials [2]. Forpurposes of attack surface and threat analysis, let us confine our discussion to twocomponent trends within the larger IoT landscape, namely ubiquitous networkconnectedtechnologies, and object-embedded information produced and consumedby those pervasive technologies.The past decade has seen staggering growth in the number of devices that humansuse to directly produce and consume network information. As of 2010, there wereover 12.5 billion such devices on the Internet, up from 500 million in 2003, and weestimate that there will be 50 billion by 2020 [1].
However, there are also an increasing number of technologies that do not require
human interaction to produce and consume network information. In 2020, we
estimate that there will be over a trillion such systems.
Further, the number of objects that do not directly connect to the Internet, yet
contain embedded information, is also on the rise. Much focus in the context of the
Internet of Things has been placed on RFID tags, of which over 15 billion have been
produced [3]. However, objects may also contain embedded information in the form
of barcodes (representing over 5 billion machine-object interactions per day [4]),
serial numbers, and other forms of machine-consumable object symbology, which
are present on the vast majority of objects involved in commerce.
The Internet of Things is defined as much by its interconnectivity as by its
comprising entities. Early attempts at understanding the relationship between
entities of the IoT were focused on their statistical relationships. Using this
approach, one might project a world population of 7.6 billion in 2020, and each
person matched up with 6 connected devices, over 130 sensors, and innumerable
embedded information objects. Simple statistical relationships, however, do not
reflect the actual distribution of objects and technology, or the dynamic nature of
the interactions between IoT entities. Usman Haque has suggested that we think of
the IoT in terms of environments, as opposed to objects or sensors [5]. In order to
assess the threat implications of the IoT, we will first discuss the relevant surface
characteristics of these environments, and their dynamic nature. What systems and
information are present in this environment at this time? What interactions are
possible between them? Then, we will consider the agency of those characteristics
in the frequency and effects of various cyber attacks.
การแปล กรุณารอสักครู่..