Protecting internet connected devices, machines, and systems.

Icon Labs has just published a white paper: “Why PKI Matters for the IIoT.”*

This new IoT security white paper explains PKI, Authentication, and Certificate Management – how they work, what they are, and how OEMs, manufacturers, and developers can implement the latest technical developments in PKI security technologies.

“OEMs building IIoT devices, and enterprises deploying IIoT networks must be proactive by ensuring the proper security capabilities are built into both the devices and the networks in which they operate,” says Alan Grau, President of Icon Labs. “Strong authentication of all devices within an IIoT network is a critical requirement for securing these networks.”

Cyber-attacks against industrial control systems, water treatment plants, critical infrastructure, and other IIoT networks are on the rise as is the number of devices that hackers can target. As the number of devices grows, so does the range of opportunities to hack those devices, and subsequently alter the data. The bottom line is we now have a growing number of both targets and attacks, so we must put the cyber-security solution in place to protect these devices.

Just as cyber-attacks take many forms and exploit a wide range of vulnerabilities in the target device, so too is cybersecurity multi-faceted. A fundamental, but often ignored, aspect of cybersecurity for IIoT devices is strong authentication.

* PKI= Public Key Infrastructure is a set of technologies and services for managing authentication of computer systems.

 #ICONLabs #PAuto #Cybersecurity #IoT

A first in IoT Security.

Icon Labs has announced the availability of the Floodgate Certificate Authority (CA). Floodgate CA is the server side portion of their PKI solution and provides certificate management for companies choosing to implement their own certificate-based authentication using public key infrastructure.

“PKI will re-emerge as one of the most relevant authentication mechanisms for organisations addressing the IOT authentication problem. PKI’s flexibility is important when adapting to changing requirements and represents identity verification in a cross-platform, multiprotocol approach.” - Gartner Research

IoT security requires strong authentication. All IoT devices, including the smallest endpoints, must support mutual authentication, ensuring all communication is between known, trusted devices, and that all access is authorized. Certificate-based authentication using Public Key Infrastructure (PKI) provides a proven, reliable authentication method.

The Floodgate CA can be deployed on a hardened server or hierarchy of servers in a private environment to provide a closed PKI system without dependence upon public certificate authorities or other third-parties. It can also operate as a sub-CA of a public CA, allowing OEMs to choose the operating model based on their IoT authentication requirements.

Floodgate CA can be used with any PKI client, including Icon Labs’ Floodgate PKI Client Toolkit; an embeddable PKI client for IoT devices. Floodgate PKI Client enables even the smallest of IoT devices to generate keys, create certificate signing requests, and retrieve signed certificates from the Certificate Authority.

“This is the only security solution that provides both the client and server side required to automate secure provisioning and enrollment,” said Alan Grau, President of Icon Labs. “The Floodgate Certificate Authority and Floodgate PKI Client toolkit enables developers to easily and efficiently integrate certificate-based machine-to-machine authentication for IoT devices.”

The PKI client supports SCEP, EST, and OCSP on all RTOS, embedded Linux, and Windows devices. The Floodgate Certificate Authority encompasses a wide-range of potential use cases including key management, generating public key infrastructure certificates, and injecting pre-generated keys during the manufacturing process.

@iconlabs #PAuto #IIoT

Security for IoT edge devices.

The Floodgate IoT Security Toolkit has bee launched by Icon Labs. The solution enables IoT edge devices to be easily and securely integrated with IoT cloud platforms, including Verizon’s ThingSpace IoT Cloud Platform, and provides security management for remote IoT devices from a single user interface.

“Security concerns are consistently cited as one of the major issues impeding IoT deployments,” says Alan Grau, President of Icon Labs. “This solution provides designers an interactive and scalable drop-in security solution that protects IoT devices from the growing threat of cyber-attacks. Icon Labs’ Floodgate IoT Security Toolkit provides robust and easy to implement end-to-end security management for IoT devices - allowing a client application to harden and manage endpoints from the cloud.”

The new Icon Labs Floodgate IoT Security Toolkit provides connectivity to the cloud platform over a secure communication link for both normal device operation and for security management. The solution includes critical security countermeasures to protect the device from attack, intrusion detection to identify when the device is being attacked, and security management to respond to attacks.

Alerts from the intrusion detection module inform the user of security anomalies. These alerts are sent to the security management systems, allowing changes to security policies to be pushed out to each device in real-time. The management system also supports software updates to be securely transmitted and installed, all using the same management interface.

Critical security countermeasures included are secure boot, encrypted communication, an endpoint firewall, and mutual authentication based on PKI certificates.

The Floodgate IoT Security Toolkit is the industry’s most complete security platform for IoT devices, providing a full suite of device protection, secure credentialing services, and integration with IoT cloud services. The toolkit includes the following Floodgate Security Framework elements: secure boot, secure software updates, firewall, intrusion detection, MQTT, TLS, key management/SCEP, and a management agent.

This solution is available today and has been integrated with Verizon’s ThingSpace IoT Platform and Verizon’s IoT Secure Credentialing Servicer (IoT SC), and demonstrated on the Renesas Synergy platform from Renesas Electronics America, Inc. The Floodgate toolkit supports any embedded OS including embedded Linux, Nucleus, ThreadX, UC/OS-III, LynxOS, VxWorks and other RTOSes.

#IconLabs #IoT #PAuto #Security

Just how vulnerable is the IoT?

The recent Mirai Botnet attack caused an outage in internet services for numerous large-scale internet-based companies. Could it have been stopped?.

Alan Grau

OEMs can build in protection at the device-level that will protect against a botnet attack. Building protection into the device itself provides a critical security layer. Given these new security capabilities, the devices are no longer depending on the user (in home, non-technical consumers) to update the user name and password as the sole layer of security. In addition, the security can be customized to the needs of the device.

This article from Alan Grau of Icon Labs argues that this attack didn’t have to happen.

#IoT? #IconLabs #Cybersecurity #Pauto

IIOT Security Guide for Design Engineers.

Icon Labs has published a resource for embedded designers working with Internet of Things (IoT) applications: a white paper focusing on “Device Security for the IIoT” (pdf). Developed with Renesas Electronics America, a premier supplier of advanced semiconductor solutions, as a deep-dive guide for design engineers developing networked and web-connected equipment and solutions, the white paper outlines security requirements for Industrial Internet of Things (IIoT) devices and software solutions that are available today for securing these devices.

The IIoT is driving investment in new technology and manufacturing methodologies as companies rush to capitalize on a predicted trillions of dollars of economic gain. Unfortunately, traditional security solutions do not scale down to support the RTOS-based devices that make up the bulk of the IIoT. New solutions and approaches are required for these systems that perform critical functions in factories, the electric grid, transportation infrastructure, and other industrial segments.

“It is critical for system engineers to address security issues at every layer, from the sensors and actuators, to the controllers and the connected operations and business systems,” said Julian Psaila, Director, Marketing, General Purpose Unit, at Renesas Electronics America. “Although traditional IT-endpoint security and network-monitoring solutions protect IT business applications, such solutions won’t work for the embedded devices closest to the physical systems, which must be protected against cyberattacks by integrating security directly into the devices themselves.”

“Minimising vulnerabilities requires specialized security software,” said Alan Grau, CEO of Icon Labs. “To support enterprise security standards, embedded devices must incorporate the following key features: secure boot code, secure application updates, tightly controlled authentications, and secure communication protocols.”

The white paper covers new IIoT security platforms, as well as access control, security protocols, asymmetric and symmetric encryption, hardware security modules, intrusion detection, secure boot, secure firmware update, Data at Rest (DAR) Protection, and security management & visibility.

 #Icon_Labs #PAuto #IoT

International distribution for cybersecurity solutions.

Icon Labs has added six distributors for its industry recognized Floodgate cyber security solutions. Icon Labs now has distribution partners worldwide including in Scandinavia, Israel, France, Canada and Britain as well as in the United States.

Icon Labs’ Floodgate Security Framework solution provides a platform for developing secure, connected devices. The platform makes it easy for device developers to incorporate security into the architecture of the device itself and provides security management and visibility, device hardening, data protection, and secure communications. Natively securing the devices themselves provides extra layers of protection, audit, and compliance independent of the secure perimeter, reducing the need for expensive and complicated security appliances.

Icon Labs’ Floodgate Security Framework provides:
• Security policy management
• Event and command audit log reporting
• Integration with the McAfee ePolicy orchestrator (ePO)
• Integrated embedded firewall
• Firmware and intrusion detection support
• Support for RTOS and Embedded Linux based devices

“Modern industrial automation, utilities, and embedded devices are complex connected systems that often perform critical functions,” says Alan Grau, CEO of Icon Labs. “Industry, governments, businesses, etc., have recognized that no longer can they rely on just protecting the network. They need to protect the devices themselves. They are now requesting that security be built into all the various components and devices that make up the network. Even small edge devices can be the entryway for cyber-attacks and need to be protected. Icon Labs and our network of distribution partners are rising to meet that challenge!”

"Our customers tell us that providing cybersecurity is becoming an essential requirement for any device that is connected to the internet. They understand that every day these threats are becoming more dangerous, more critical," says Thierry Le Gall, General Manager of I.S.I.T in France. "By adding the Icon Labs Floodgate Security Framework to our portfolio, we are able provide developers with the ability to effectively build in high quality security into products."

"Icon Labs is the leader in providing cybersecurity - an increasing requirement for embedded systems, particularly in safety-critical and high-integrity world," says Chris Hills, founder and CTO of Phaedrus Systems in the UK. "By adding the Floodgate Security Framework to our portfolio, we are able provide developers with the ability to build security into their architecture."

“The battle against cyber-attack is never ending,” says Tomer Bogin, CEO of ScaleIL in Israel. “The Icon Labs Floodgate platform enables our customers to develop cost effective solutions against a constantly evolving threat menace. Not only does Floodgate provide a defense, it also allows us to monitor the attacks so that we know who and what is doing the attacks.”

#ICONLabs #PAuto

Protection from cyber-attacks.

The low cost and easy to install Floodgate Defender firewall appliance is available from Icon Labs. The compact Floodgate Defender Mark III (4 inches by 3.75 inches by 1.25 inches) provides a critical layer of security for legacy devices that comprise The Internet of Things including SCADA networks, military equipment, critical infrastructure controllers, and medical devices.

“A large portion of our critical infrastructure is controlled by legacy devices that were originally designed for use on closed networks and therefore contain little or no security. Even though they perform critical functions managing our power grid, factories, communication networks, and hospitals, most are easy targets for cyber-criminals and cyber-terrorism,” said Alan Grau, President of Icon Labs. “Many of these devices cannot be updated to include security, and replacing them with new secure versions will take years. The Floodgate Defender provides a simple and cost-effective solution to stop these attacks.”

The Floodgate Defender device is plugged in between the Internet or WAN and the device. It includes two Ethernet ports for easy installation. It can be easily configured with communication policies customized for the device it is protecting by using a web-based management interface. The Floodgate Defender enforces the policies, blocking attacks before a connection can be established with the target device, without requiring any change to the network or the target device. The Floodgate Security Manager, or other security management systems, can access the event log to audit and manage policies.

The Floodgate Defender’s patented technology protects legacy devices from a broad range of cyber-attacks.

Features include: - Filtering by IP addresses, ports, and protocols - Stateful packet inspection - Deep packet inspection for ModbusTCP and other industrial protocols - Detection and reporting of suspicious traffic *Floodgate Security Manager *McAfee ePO *McAfee SIEM - Integration with security management systems including: - Ethernet pass-through upon power failure to facilitate continuous operation in critical environments

The Floodgate Defender includes an innovative security coprocessor from Maxim Integrated Products, Inc. that provides secure key storage and a cryptographic accelerator. This improves the resistance of encryption functions, enables secure boot, and ensures the security of both the Floodgate Defender device itself and the devices it is protecting.

“We are pleased to partner with Icon Labs to incorporate our secure microcontroller into this new compact firewall that protects installed networked devices with insufficient security. This exclusive combination of our technology with Icon Labs’ software is a significant advancement in creating the “Internet of Secure Things,” said Christophe Tremlet, Senior Business Manager, Maxim Integrated.

"Embedded devices have failed to maintain pace with the increasing number of attacks targeting them, making them easy targets for industrial espionage, hacktivists or even terrorist groups. These devices need the same level of security used to protect enterprise networks,” said Jared Weiner - Analyst, M2M Embedded Software & Tools, VDC Research. “Floodgate Defender provides these devices with a critical, missing layer of security.”

#IconLabs #PAuto #Cybersecurity

Embedded protection for IoT Modbus devices.

The Floodgate Modbus Protocol Filtering product has been launched by Icon Labs.  This extension to Icon Labs’ Floodgate Security Framework adds critical protection capabilities for Industrial IoT and RTOS-based devices. 

The Floodgate Modbus Protocol filter provides the critical missing layer of security for Modbus/TCP devices.  Integrated into the device, Floodgate Modbus Protocol filtering utilizes deep packet inspection to enforce virtual network segmentation and to control packets processed based upon source network address, function code, and packet data contents.

“The Modbus/TCP protocol currently lacks any real security, making these devices sitting ducks for even moderately skilled hackers,” said Alan Grau, President of Icon Labs. “Several attempts to add security to Modbus/TCP have been proposed, but none provide a cost-effective solution for legacy devices while maintaining interoperability with the protocol standard.  Modbus packet filtering addresses this problem by enforcing policies and inserting a layer of control without changing the underlying protocol.”

Floodgate Modbus Protocol filtering is an extension of the Floodgate Firewall, an endpoint firewall solution designed for embedded and RTOS-based systems. The solution integrates with the native TCP/IP stack on the device and provides control over the packets processed by the device.  The Modbus Protocol filtering extension provides control over the Modbus packets processed by the device based upon Modbus function code, originating IP address, or Modbus packet content.  Integration with the Floodgate Agent enables detection and reporting of malicious traffic. 

“Achieving security while maintaining interoperability with legacy solutions is critical to the adoption of the Industrial IoT,” stated Warren Kurisu, Director of Product Management – Runtime Solutions, Embedded Systems Division, Mentor Graphics. “Adding a layer of protection for Modbus/TCP devices closes a critical security loophole for Industrial Automation Systems.”

Icon Labs’ Floodgate Security Framework is a comprehensive security solution for embedded devices providing security management, secure boot, intrusion detection, secure firmware updates, and an embedded firewall. These capabilities provide the building blocks for achieving EDSA certification, ISA/IEC 62443 compliance, and/or compliance with the NIST cybersecurity framework.

Icon Labs’ products provide embedded security for IoT and Machine to Machine (M2M) solutions such as aerospace, military and space probes, industrial and medical control devices, and consumer electronics products. The Floodgate Security Framework provide a “defense in depth” solution to protect control units and endpoint devices from cyber threats, aid in compliance with regulatory mandates and guidelines, and gather and report command, event and device status information for audit requirements.

Security platform for IoT and industrial automation.

Icon Labs has integrated Icon Labs’ Floodgate security products with Renesas’ R-IN32M3 industrial network controller ICs and Renesas Synergy™ Platform. The integrated solution creates a secure platform for IoT and industrial automation and extends the Internet of Secure Things™ initiative into industrial control systems. This integrated solution is being jointly demonstrated at the Renesas Developers Conference (12-15 Oct CA USA).

Icon Labs’ Internet of Secure Things Initiative defines a platform for developing secure, connected devices.  The platform ensures that security is intrinsic to the architecture of the device itself and incorporates security management, visibility, device hardening, data protection and secure communications.    These capabilities provide the foundation for the Industrial Internet of Secure Things. Natively securing the devices simplifies protection, audit, and compliance - independent of the secure perimeter, reducing the need for expensive and complicated security appliances.

“Security has become a critical requirement for our customers in all segments especially in industrial and IoT applications.  Partnering with Icon Labs allows us to provide a complete security solution that is fully integrated with our hardware platforms,” stated Semir Haddad, Senior Marketing Director, MCU and MPU Products and Solutions, Renesas Electronics America.  “Icon Labs Floodgate product family provides a comprehensive security platform for developing secure, embedded devices using the new Renesas Synergy™ Platform for IoT or the R-IN32M3 ICs for Industrial Automation.” 

The integration of Icon Labs’ Floodgate products and Renesas’ hardware platforms provides:
• Integrated embedded firewall
• Modbus protocol filtering
• Intrusion detection
• Secure communication
• Authentication
• Small footprint crypto libs
• Integration with security management systems
  -Security policy management
  -Event and command audit log reporting

“The Industrial IoT provides unprecedented connectivity to the systems we interact with every day, and industrial automation systems are increasingly connected and charged with performing critical functions,” says Alan Grau, CEO of Icon Labs.  “Including security in these devices is a critical design task.  Security features must be considered early in the design process to ensure the device is protected from the advanced cyber-threats they will be facing now as well as attacks that will be created in the future.  By partnering with Renesas, we now are able to offer a solution in which critical security elements are integrated into the platform, ensuring that security is a foundational component of the device.”

---

Protecting IoT &embedded devices against cyber-attack.

Floodgate Security Manager (FSM ), a security management software suite specifically designed to protect IoT and embedded devices against cyber-attack has been launched by Icon Labs. FSM can be operated as either an on premise or a cloud-based security manager.

The Floodgate Security Manager provides device status monitoring, security policy management, command audit logging, and security event logging and reporting for devices running Icon Labs’ Floodgate Agent or other lightweight IoT management protocols such as COAP and MQTT. Floodgate Security Manager provides comprehensive reporting and auditing capabilities to help achieve EDSA Certification, ISA/IEC 62443 Compliance, and/or compliance with the NIST Cybersecurity framework.

“The current approach to security management for IoT devices is to repurpose legacy security management systems. While this solution works for some IoT gateways and other large IoT devices, it does not scale to the smallest IoT devices, especially small battery powered edge devices and sensor solutions,” says Alan Grau, President and Cofounder of Icon Labs. “Floodgate Security Manager is designed to provide the management services required by all IOT devices, including small, battery powered and mobile devices without the overhead and complexity of traditional enterprise security management systems.”

“With the IoT growing dramatically, it’s only a matter of time before hackers turn more attention toward embedded systems with limited onboard security resources,” said Steve Hoffenberg, a Director at industry analyst firm VDC Research. “New security technologies are needed not only to protect IoT device functionality and data, but also to protect conventional IT and the cloud assets to which the embedded systems are connected.”

Icon Labs products provide embedded security for IoT and Machine to Machine (M2M) solutions such as aerospace, military and space probes, industrial and medical control devices, medical systems, and consumer electronics products. The Floodgate Security Framework provides a “defense in depth” solution that protects control units and endpoint devices from cyber threats, aids in compliance with regulatory mandates and guidelines, and gathers and reports command, event and device status information for audit requirements.