White Networks

McAfee

Nov 14, 2014

4 MIN READ

Internet of Things (IoT) needs “white networks” to scale and deliver the assurance we require for machine-things; white as in “clean and pure”. The IoT will contain all the devices on the current internet, plus many new devices used for machine-to-machine and industrial applications and services. In contrast to a “white network” I would assess the regular Internet as “black” – filthy, full of attacks and threats and no place for a wave small, simple, cheap device which were never engineered for the open ocean of the internet; most home and small business networks are probably dark grey – unhygienic at best and usually poorly protected; enterprise networks are “ash grey” – not clean but a respectable balance of risk and cost, and perhaps the best military-grade networks as merely off-white: because there really is no such thing as pure networks. This illustrates the conditions of today’s heterogenous-network environments: even with good resources it is difficult to remain “clean”, and with little or no resources it is pretty much wishful thinking.

IoT services will be a vast range and combination of new Business-to-Business, and Business-to-Consumer applications: like home energy management, healthcare services, smart transportation, augmented reality in entertainment, and on and on. (In an up-coming book called “RIOT Control” we list several dozen examples of IoT use-cases, and security implications.)

It is a hallmark of many IoT/industrial/machine networks and devices that they are fragile: they do not respond well to “internet-like” conditions such as regular or occasional network probes and scans by adjacent devices, or seemingly random increases or decreased in traffic volumes, latency and packet loss. Many IoT services will see merely degraded network services as a service failure – a very different situation from what mosy users and applications expect from the current internet. Many industrial services will fail or become unpredictable in performance if subjected to even mild forms of reconnaissance or attack over the network. Similarly, a large population of devices coming onto the IoT will mean that some of them will be defective or possess manufacturing defects (hardware or software) which result in them generating excess or malformed network traffic, sometimes to the point of making the network unusable. Another affect of large numbers of devices coming on the network will be that some will not be properly secured physically, and will become platforms for unauthorized access to the IoT. They will become back doors and side doors into the IoT. In other cases, administrative errors in network management will see logically differentiated and segregated networks accidentally combined, or linked – with traffic from one “polluting” the other, with uncertain impacts on these fragile networks. Administrative errors such as this are already unfortunately common in both carriers and enterprises alike – the complexity of the IoT and the growth of the many interconnected networks supporting the IoT can only increase this operational challenge.

Another aspect of industrial/machine networks in the IoT is that they will increasing support critically sensitive, cyber-physical, logical-kinetic interfaces: the IT world controls the real world. In these instances, the potential for an IT security issue to manifest as physical harm and damage becomes very real. Already we are seeing instances of the potential criticality of the logical-kinetic interface and the hard that can result from insecure and fragile networks and devices.(See these story about failed in-home, IP-based security systems, or IP based utilities) .

White networks will be benefical as a simplified form of security for the simplified forms of networking required by industrial and machine applications. White networks will be a matter of allowing only very prescribed machine traffic, and then deny=* (all). In other words, a white network is like application whitelisting (where only allowed software may start and stop on desktops, devices and servers), but for networking: only explicitly allowed ports, protocols, sources, destinations, frequencies, volumes and possibly even application payloads and time-of-day, are allowed. (This list could even be extended to empirical criteria like environmental conditions, for instance, rain versus sun). Everything else is denied and sets off alarms.

White networks are highly antiseptic, and a value-added service which might be offered by carriers or IOT service providers. They will need to be configured for the IoT services in question – so they will not be a commodity. And they will need to be established and managed carefully. But, once established they should run and provide substantial assurance in an automated manner.