devopsy.kinsta.cloud

Tag: IoT

How Integration Can Keep Up with Digital Demands

Integration holds the key to accelerating innovation, but in many organizations, business systems and application integrations haven’t kept up with the demands of digital. Data still exists in a siloed blend of on-premises systems and unconnected cloud applications, and IoT has added another layer of complexity into the mix.

Understanding the three trends below, and how to leverage them, will help organizations continue to drive innovation for years to come.

The Rise of the Integration of Things

It’s no secret that the adoption of IoT is increasing, generating massive amounts of data from devices and sensors. As the number of devices increases in response to the explosive growth of IoT, the amount of data increases exponentially. This explosion of devices–and its associated data–is driving the need to leverage that data for the benefit of the business, such as improved customer experience, cost and downtime reductions or efficiency and productivity gains.

Integration is the key piece that will enable businesses to get control of this data and put it to work. Without the right integration tools, it’s only possible to leverage IoT at specific levels. Essentially, integration provides the ability to connect the data from IoT devices and enterprise applications, orchestrate workflow and enrich IoT data with contextual information from other systems for better decision-making.

Organizations can even use integration to link IoT platforms together for a comprehensive view of data, analytics and actions–making it easier and quicker to analyze, draw conclusions from and determine how to use the data. On top of this, they can also create complex and sophisticated responses when something goes wrong by leveraging automated integration workflows.

As we continue to connect our devices, the Integration of Things will be as important as the Internet of Things.

Blurred Lines Between Application Development and Integration

For cloud applications to survive and thrive, they require built-in integration with other apps and data sources. Otherwise, users are constantly switching contexts from one tool to another when trying to complete a task, and content is scattered across the organization in multiple applications and departments. Because of this, the lines between application development and integration will blur as apps are compelled to have integration embedded under the covers.

There will be many benefits to this. First, organizations will easily create and deploy integrations directly within their products, fully baked into the user experience. These in-app integrations to third-party sources will unlock additional capabilities for users, empowering them to do more.

Second, building integrations without the right tools and specialized integration know-how requires a lot of work. Embedded integration eases the pain of monitoring API changes and documentations so that maintenance is smoother and cheaper.

Finally, business services can involve complex interactions with cloud apps and data that require ordering, have dependencies or may even need to be reversible on demand. Organizations can handle these sophisticated jobs by leveraging advanced integration orchestration to manage app interaction–meaning that instead of using manual code for complex data mapping, they can create a visual drag-and-drop data flow.

AI Powers Smarter APIs

Businesses have already been leveraging intelligent automation to improve operations, drive innovation and personalize the customer experience. As we head into the new decade, API management will harness the power of AI with innovative ways of protecting and controlling APIs and the applications they serve.

Service mesh, an increasingly popular way of discovering and observing services in distributed networks, will evolve into app mesh, an application-aware model of monitoring, managing and securing your APIs. API policies will be able to reconfigure dynamically based on traffic, security threats and identified patterns. Additional layers of defense will come from bots deployed in an organization’s network to constantly monitor behavior and these bots will use machine learning to improve automated threat responses for APIs.

The integration landscape is changing, but understanding how to harness these trends will ensure organizations are well-equipped to take advantage of evolving technologies for innovation.

— Ann Marie Bond

February 7, 2020
Five Technology Trends to Shape Future Investments

Humans invented technology to introduce innovative products in the market. Technology’s relentless cycle of innovation has now touched humanity, redefining what it means to be a human, a meaningful change that is impacting business priorities and is expected to do so in the future.

The most important tech investment for C-level executives relates to digital transformation, artificial intelligence (AI), Internet of Things (IoT) and cybersecurity. With 71% of the world expected to use mobile phones by 2024 and the successes of mobile banking in developing countries, experts predict that mobile and blockchain technologies will also join to bring about more financial inclusions.

Here are five things that C-suite business people should invest in.

Digital Transformation: Everything Online

As one of the weapons in the arsenal of business innovation, digital transformation has become such a buzz word that it turns people on. According to a report by Forrester, 90% of the executives believe digital transformation is a necessity for their business, and around 60% believe they lag behind in digital transformation. By the end of 2020, a company would either have transformed or will be on its way to adapt to digital transformation.

IoT: A Thousand Points of Entry?

Business implementation of IoT and blockchain are very popular these days. However, if we look to enterprises it’s a different story. Costs, security and current political climate are the major hurdles for the enterprise-level implementation of IoT. To get the most out of this innovative technology, businesses need to determine what stands in their way and then work on strategies to sort things out. So until the issues are dealt with, IoT will be seen as a promising technology that’s not ready for prime time.

AI: A Real Game-Changer

Every so often a technology comes along that has the potential to completely change everything around it. The last such thing was cloud computing. Like cloud computing, AI has been around for a long time. AI, machine learning and deep learning are catching up with the initial promises and it will become more evident in the coming years.

Most common usage of AI and machine learning will be seen in business intelligence, automating the repeated tasks, and making future prediction using the previous data. Previously, AI has been used for decision making using data analytics and this is expected to increase in the coming years with more businesses investing in the AI-driven decision-making system. Another use of AI that will be more common is digital identity verification for online businesses.

Ultimately, AI/machine learning and deep learning will be seen more frequently in the years ahead. However, the promises it brings are far fetched and it’s worth waiting to see the true potential of AI.

Quantum Computing: The Next Big Thing

Currently, in R&D, quantum computing will open new ways by solving problems that require a lot of computation. Google’s investment in quantum R&D is expected to grow and more researchers will shift their focus from AI to quantum. With the emergence of 5G, the quantum research industry will see a boom.

DevOps: For a Customer-Centric Approach

According to the Forrester report, firms will embrace a customer-centric approach as the DevOps speeds flatter. DevOps continues to impress the heart and minds. However, with a slow-release speed, engineers are experiencing a stress point. DevOps teams must see this as an opportunity to approach DevOps differently. Within the next six to 12 months, DevOps adoption will change and the team will implement new strategies. Testing will revolve around previous radical methods and new technology will help developers to learn new skills.

— James Efron

January 24, 2020
Predictions 2020: Key Trends that Will Shape the Autonomous Digital Enterprise

As 2019 comes to an end, and we look toward trends driving innovation in 2020 and beyond, technology advancements in hyper automation, AIOps, edge computing and the convergence of IT service management and IT operations management will be at the forefront.

Autonomous Digital Enterprise

In order to thrive in the 2025 futurescape, organizations will need to evolve to Autonomous Digital Enterprises (ADE), a state where intelligent, integrated, value-creating functions can operate with minimal (ideally zero) human involvement or interference, across every facet of the organization, and its ecosystem of partners.

This concept is based on the notion that every company today is being disrupted by technology and that’s fundamentally changing their business model. The notion of every company being a technology company means that software becomes more than just a system of record to be the system of action, the system of insights and the system of engagement.

Edge Computing and IoT

Over the next couple of years, partnerships will prove to be the pathway to success in realizing value from edge computing and IoT solutions. By using seamlessly integrated, multi-vendor, commercial off-the-shelf solutions, enterprises will experience more success than they would with single-vendor niche products. At the end of the day, what we need is an ecosystem of integrated solutions as opposed to a single silver bullet. This ecosystem will be able to harness data and look at it in meaningful ways and translate information into insight that then translates into actions that businesses can take to optimize the use of IoT assets.

Convergence of IT Service Management and IT Operations Management

As IT service management and IT operations continue to converge in 2020, CIOs will rely on AI. More than ever, CIOs will need to address this convergence and work to break down silos between these departments. To obtain a comprehensive view of the IT landscape, CIOs will begin to adopt AI, cognitive and robotic process automation. This will bring end-user support and managed back-end infrastructure more closely together.

If we look beyond traditional IT and service management, in the near future we will have the ability to go to market with fully integrated solutions that enable boundary-less operations across AppDev, SecOps, ITOps and service management. This will further enable the use of DevOps in organizations using the power of AI to improve existing capabilities and create new capabilities. This doesn’t mean companies have to start from the ground up on AI efforts, rather they need to look for software solutions that can offer prebuilt AI/ML solutions that drive change.

AIOps

The demand for AIOps in the enterprise will continue to rise as AI and machine learning have taken the industry by the jugular. Due to an expansion in the number of workloads—both in public cloud and on-premises—and an increase in application complexity, investment in AIOps will increase and ultimately lead to better business outcomes. Today’s challenges place a premium on differentiated vendor solutions powered by AI/ML and big data analytics techniques that can help modern IT operations evolve from traditional monitoring to observability to actionability.

All of these trends open realms of possibilities for what businesses can achieve in 2020—as long as they can harness the massive amounts of data enterprises have access to and the technology that will allow them to unlock those insights.

Want to learn more about what to expect in 2020? Join us Jan. 23 for our Predict 2020 Virtual Summit featuring discussions from some of the industry’s best and brightest offering up their visions for the future. Sign up today for this free daylong virtual event.

— Ram Chakravarti

December 24, 2019
NetFoundry Network Overlay Advances DevSecOps

NetFoundry, at the recent KubeCon + CloudNativeCon 2019 conference, announced the general availability of a developer platform designed to make it easier for organizations to bake a zero trust networking framework within their applications.

Company CEO Galeal Zino said NetFoundry has created a network fabric overlay to manage and secure communications between endpoints and applications. Developers now can embed a programmable zero trust networking framework within their applications using a NetFoundry Developer Platform, which consists of software development kits, application programming interfaces (APIs) and connectors, said Zino. DevOps teams can either consume the entire NetFoundry Developer Platform or only the open source components that have been included.

At the same time, NetFoundry announced it has joined the Cloud Native Computing Foundation (CNCF) to advance the adoption of open source networking services for containerized applications.

Rather than having to become intimately familiar with networking protocols, Zino says NetFoundry provides a layer of abstraction using software to eliminate the need to rely on virtual private networks (VPNs) or network address translation (NAT) tools.

As the number of endpoints and applications they need to connect to have significantly increased, DevOps teams are finding they need to master each type of dedicated network established for endpoints ranging from mobile computing devices to internet of things (IoT). That endeavor can be cumbersome at best. NetFoundry is making the case for a programmable network overlay that allows endpoints to access applications over public internet connections securely.

As programmable overlays become more widely available, the rate at which network operations will be incorporated into best DevOps processes is likely to increase. Network managers will continue to set up the physical underlay that enables networking; however, how applications employ that underlay increasingly will be determined by invoking a programmable overlay. A programmable network overlay also provides the benefit of further separation of duties between DevOps teams and networking professionals in a way that doesn’t require networking teams to become deeply involved in every application development project.

That approach should reduce significantly the amount of time now required to deploy or update a distributed computing application. DevOps teams today may be able to push code into production faster than ever. However, configuring the networking services those applications require remains a set of manual tasks that have become a significant bottleneck to making IT teams more agile.

It remains to be seen to what degree programmable network overlays will provide something of a demilitarized zone (DMZ) between DevOps teams and networking professionals. Today most networking services are provided via either directly on top of networking infrastructure or using network overlays controlled by networking teams. But it still takes days to weeks for networking professionals to respond to requests for services from DevOps teams. It’s clear the way networking services are provisioned across the enterprise needs to change substantially.

— Mike Vizard

November 24, 2019
IoT, AIOps and OMG!

The task of keeping networking straight while expanding the definition of network to include both physical and virtual networking has fallen heavily upon the op-centric side of DevOps–or what I like to call devOPS. What is defined as networking has grown, sometimes at a ridiculous rate. While the terms are familiar, how you manage them in truly virtualized environments is different than traditional hardware management. More agile, but different.

And that means those who deal with networking in DevOps have to know more, manage more and debug more–all while working on other parts of the DevOps toolchain. It’s been a slog through increasing capability with increasing workload.

There is a confluence of new and different things that promise to set this lopsided progress right. We’ll look at them individually, then talk about the sum of the parts.

Internet of Things (IoT)

For most of us, when we hear IoT, we think of millions of devices slamming data into a centralized service. iPhones, for example, returning information to Apple. Or highly specialized devices such as utility meters that report far more frequently than humans could go out and read them. But IoT is many things, and increasingly IoT is networking devices. They hold a wealth of information about the state of the network at any given moment, and that information is increasingly being funneled into APIs that IT or management apps can take advantage of. Considering that some of those management apps are also getting data from application tooling and server health status, there is a wealth of information coming together in one place.

AI Operations (AIOps)

A networking device can be doing a lot in any given second, and generating data as it works. Servers can be on their way offline when they feed the information out, or maybe sitting idle and wanting more work shipped their way. Application bottlenecks might be identified in the wealth of application tooling information, but buried under the wealth of other response data being shipped back. AIOps aims to help the devOPS side deal with these issues by limiting what makes it to human attention and drawing correlations between issues. Finding that an over-burdened network connection is associated with an apps performance degradation is an easy one to talk about, even though it is pretty simplistic. AIOps can make the connection before a human gets involved, and then the staff member can decide what to do about the actual root cause.

It’s not at all perfect yet–we’re not generally talking about AIOps making a ton of decisions, rerouting traffic or spinning up new instances to resolve issues at this point–but it is definitely in the “useful tool” category. The cost in person-hours to analyze and reduce problems is definitely cut by the use of AIOps as it exists today, and that benefit will only grow moving forward.

The biggest problem is the one that bedevils all data interchange, and in fact is the biggest issue in the world of big data–data standardization.

Enter OMG

No, my OMG in the headline wasn’t what you thought. It was the Object Management Group (OMG). They’ve been around forever, and have done a pretty good job of developing useful standards, particularly in the area of data interchange. I’ve followed them for a long time, and used their standards since … well, anyone remember CORBA? That was my first set of OMG standards.

Now they’ve started an Artificial Intelligence Platform Task Force (AIPTF). This group will be looking at all areas of AI to set standards, but the interesting bits for this blog will be in data standardization and communication. Standardizing data and how it is communicated is the next big step in this process, and hopefully the OMG will set us down that path. They’re not specifically looking to address infrastructure big data needs, but their work will likely guide AIOps moving forward. And there is huge potential in that movement. If AIOps gets some standards that help it to be more proactive, we may actually end up with auto-fixing algorithms for obvious and easy issues. We already have the systemic ability in container managers to increase the number of instances serving an application if the existing ones get over-loaded, if we could expand that type of auto-growth to include networking issues and consider cores used by instance to find the best solution. Members of the team that are more devOPS will have more time to focus on new development. And that’s a huge plus.

The Future is Bright

Whether the work at OMG benefits us will depend upon whom is involved in the various subgroups they have planned to implement, and cooperation with other ongoing efforts at standardization. Yet I’m hopeful that, like with that original CORBA spec, they will provide a roadmap that others can follow to put us on the path to the much-maligned self-healing network. Giving devOPS a chance to keep up, while leaving them ultimately in control of what happens. Current iterations of AIOps do this to a lesser extent, but more inputs and more automated analysis of those inputs will only make AIOps more powerful. Standardization will make AIOps more able to make use of data and better focused on their specific problem at hand. I see the confluence of all three trends to be a huge positive to the industry if we manage to take advantage of it. And some vendor out there will see the potential, taking advantage of it for us, we just have to find them and use their solutions.

Meanwhile, paw through the data available to you by hand again, and keep knocking those walls down.

— Don Macvittie

November 6, 2019
What is so Special About AIOps for Mission Critical Workloads?

As the wave of digitization sweeps more enterprises with each passing day, the threats posed to organizations, particularly IT organizations, have never been more complex and pressing. With cybercrime statistics, including those for more targeted crimes (such as phishing) pointing towards an alarming frequency of attacks, the stakes for securing enterprises have been higher.

However, many IT organizations have been unable to smoothly transition into pushing the digitization of their organizations forward. This inability to support and drive digital transformation isn’t a result of a lack of effort on behalf of these organizations. Instead, it has everything to do with the unavailability of the proper management tools needed.

Unfortunately, many IT organizations lack the tactics and tools needed to overlook the smooth shift to digitization on such a grand scale, which often leads to the degradation of critical business applications, along with IT slowdowns and outages. Luckily, however, artificial intelligence for IT operations (AIOps) arrives like a beacon of hope for revolutionizing IT application, along with increasing business agility.

The Failure of Enterprise in Tackling the Burgeoning Complexity of IT Infrastructure

A primary reason behind the ever-present issue of IT slowdowns in enterprises and organizations that is frequently overlooked is the fact that the customer-facing side of IT (applications) is growing increasingly complex with each passing day.

As the increasing number of applications continue to occupy more and more space, the IT infrastructure grows into a vast and hybrid structure which often spans across multiple clouds on a grand scale.

Although the vastness of the IT infrastructure is a byproduct of the digitization drive taking enterprises by storm, it is still worlds away from the security infrastructure of yesterday, which was much easier to manage and analyze.

From the Internet of Things (IoT) connecting thousands of devices onto an organization’s network to complex issues such as bottlenecks, application slowdowns and outages, along with performance latency and the ever-present threat of phishing attacks via a free host website (000webhostapp, being the most commonly used host), organizations are just setting their systems up for failure at some time in the foreseeable future.

Owing to the flourishing complexity of the IT infrastructure, an organization’s system fails to cope with new, dynamic workloads for any multitude of reasons. Usually, the system is utilizing extra resources or is under the influence of a recent addition to the system.

In instances of outages or IT slowdowns, the pressure to fix the IT infrastructure falls on the IT team, who are tasked with the immense responsibility of analyzing and diagnosing the issues as they occur in real-time, along with coming up with a solution that satisfies customers and prioritizes the business aspect of an organization as well.

Unfortunately, however, without access to the proper tools and techniques, the IT team can only conjure security patches that resolve the problem for the moment but fail to withhold security in the long run. Also, without the ability to effectively predict a pattern for the ever-present security threats, the IT team is operating on a whim rather than basing their solutions on the rationale.

How Can AIOps Help the Situation?

To leave the momentous challenge of perfecting an organization’s IT infrastructure solely on the IT team is not only outdated, but it is also impractical. Taking into consideration the complexity of the threats facing enterprises, a solution that arches above each aspect of cybersecurity in an organization should be implemented.

Today, that solution arises in the shape of AIOps. The hybrid IT infrastructure has become too complex to be handled through traditional tools and tactics, which is why AI, along with machine learning and automation, has to step in to bridge the gap.

Unlike other security strategies, AIOps integrates a wholly modern and unique approach, which allows for the AI to view systems in terms of business outcomes. Simply put, rather than analyzing and diagnosing identities, infrastructure and applications independently, the AIOps platform follows the path taken by the user into the complex IT infrastructure and back out of it.

Ideally, AIOps platforms run automated investigations that derive the root cause of existing and recent issues on a regular basis. When it comes to managing a business-critical application, an AIOps platform can detect an unusual response within the system, whether it’s an anomaly in a workload profile or variant response to critical workload.

Other benefits to incorporating AIOps as a security tool include tapping into the truly unique set of capabilities offered, including predictive capacity management and forecasting/predictive abilities. The predictive ability of AIOps allows for the AI to smartly notify IT teams about any attack or potential outage, or slow down, before they actually happen so they may act accordingly.

By taking a different approach to the pressing issues faced by enterprises today, AIOps manages to do what several security strategies have failed to accomplish—provide organizations with an end-to-end, app-centric approach to security, which also takes into consideration the context at hand.

Moreover, AIOps will push organizations to shift their focus from reactive problem solving and cause them to optimize their IT infrastructure on a more proactive basis. Fundamentally, AIOps provides IT teams with the necessary tools to diagnose and combat both internal and external threats to an organization’s security infrastructure.

After the integration of AIOps within an organization’s infrastructure, enterprises can turn their attention into optimizing the balance of critical workloads, along with prioritizing business functions and improving applications, rather than worrying about security.

What Hurdles Can Enterprises Expect with AIOps?

Despite the countless benefits AIOps brings to the table, certain obstacles arise when it comes to the implementation of the security model into organizations.

Perhaps the most apparent obstruction organizations have to deal with is the extensive amount of time investment AIOps requires. Like every other security tool centered around an AI or machine learning technology, time is absolutely pivotal for the learning to actually take place. A simple way to smoothen the transition, AIOps must be fed with data, statistics and analytics originating from multiple data centers.

Another common issue that arises, mainly because of a lack of research, is when an AIOps platform fails to perform as per the specific requirements of an enterprise. Keeping this in mind, CIOs must voice their concerns about fine-tuning AIOps before committing to a vendor.

AIOps abilities in performing an in-depth analysis into the IT and security infrastructure—within the context of the applications it performs—gives the unique chance to stay ahead of the threats they face.

— Rebecca James

October 18, 2019
IoT Security Concerns

The Internet of Things (IoT) is being hailed as the next step in our technological development. It’s hard to argue with that. The abilities it provides are as captivating as they are numerous: smart cars and homes, automatized agriculture, advancements in medicine that help with after-stroke recovery and the list goes on.

However, while the IoT is truly a huge topic nowadays, we must not let our fascination with it overcome us. It’s too easy to forget about security and privacy concerns when you hear about exoskeletons that can increase a person’s strength and dexterity–trust me, I know. But we can’t afford to forget about them.

It does seem, though, in our pursuit of the interconnected device environment, the security of those devices was somewhat left behind. Let’s take a look at what the primary IoT cybersecurity hindrances are and what can be done to overcome them.

When Security Struggles To Keep Pace

One example of the quantity of devices outrunning their quality safety-wise is smart homes. They are very popular now, and according to the IDC forecast this trend is not going away:

Data source: IDC Worldwide Quarterly Smart Home Device Tracker.

While undeniably convenient, smart homes can pose a potential threat to their users. To do their job, they must collect information about those users. And the more interconnected the entire system gets, the more trouble can a single weak link cause.

Take smart door locks, for example. Some of them come with facial recognition algorithms. That in itself is a pretty big privacy concern. Facial recognition can be used with an alarming accuracy to identify and track individuals. It can have various purposes, but very few of them (if any) are benevolent.

To add to that, within the smart home system, a smart lock is going to be connected to other devices. Maybe it is safe from cyberattacks on its own, but is the smart thermostat safe? What about the smart water kettle? It only takes one vulnerability to get access to a lot of one’s private data.

This risk can be somewhat mitigated by users taking certain precautions: installing AV software to protect their devices, updating the said devices regularly to prevent exploits, setting up a VPN on their routers to safeguard all of their internet traffic, etc. But how many users are actually going to go through with all this trouble?

Physical Problems

It should be noted that data breaches and cyberattacks are not the only threats the IoT faces. Some problems arise from poor design.

For example, among other considerations presented in the June NIST publication, a non-descriptive appearance of an IoT device is mentioned. If it’s just a black box with no markings on it to indicate what software and hardware it runs on, updating it (as well as keeping track of its activities) becomes a very unpleasant chore. It is especially true if there are thousands of such devices located on the premises of a company.

Alternatively, the support of a certain device may get discontinued well before the company plans to replace it. It is also possible the news of its discontinuation can be missed by the company, thus creating a possible vulnerability.

Sheer Scale of the IoT Makes Threats Bigger, Too

Another concern with the IoT is it’s so overwhelmingly difficult to maintain secure. If there is the need to install crucial updates on hundreds of millions of devices, the task becomes all but impossible.

The hundreds of millions of devices example is not an exaggeration, either. Recently, several critical vulnerabilities were found in the VxWorks real-time operating system. Thankfully, this finding was not made by hackers but by a security firm. Some might think it should, therefore, be easy from now on for those vulnerabilities to be patched.

Here comes the problem. There are 2 billion devices that run on VxWorks. Although not all of them can be affected by the vulnerabilities found, hundreds of millions still can. Moreover, there are difficulties in finding all the devices that need a patch, as it’s not obvious what devices even run on this RTOS.

Many of the VxWorks devices are used in medicine. To update them, it is required they undergo the certification and testing processes, and that can take a long time. And before all the necessary testing is done, those devices remain vulnerable.

Making the IoT Safer

That’s why the approach to IoT device security must become more holistic than it is now. It is necessary for the IoT market itself to develop, as security and privacy issues were named one of the biggest problems hindering the implementation of smart devices.

According to the recent Deloitte webcast, one of the biggest threats of the IoT today is security measures and systems are not incorporated into the core design of devices and networks. Another top risk is the lack of security awareness and training among engineers. Yet another one is the lack of proper incident response processes due to the wanting skill levels of security professionals.

It’s obvious the IoT field can benefit immensely from the implementation of DevOps and, especially, DevSecOps. To ensure safety in the IoT, it is not enough to start worrying about it only after the fact, as an addition to other functions. On the contrary, it must become secure by design, and its safety must be a concern on all levels.

— Dean Chester

September 19, 2019
3 Ways IoT Developers Can Make Their Applications More Secure
When the IoT was still young, IoT application developers got away with making security an afterthought, as they built prototypes and minimum viable products designed to demonstrate the different ways the IoT could be used to transform the way we work, play and live. But the IoT has matured and grown to the point where today, Gartner estimates there were 8.4 billion connected things in 2017 and forecasts there will be 20.4 billion IoT devices deployed by 2020. With this growth has come a massive increase in number and sophistication of IoT security attacks, and the need for developers to make security not just a priority, but a top priority.

As the IoT hacks of Trendnet’s SecurView camera, St. Jude’s cardiac device and the Jeep Cherokee have demonstrated, when security is not a top priority, successful IoT attacks can cause significant real-world financial, reputational and even human damage.

While it is impossible to make IoT applications (or any type of software) 100% secure, there are several best practices that IoT application developers can adopt to strengthen the security of their IoT applications. These best practices include:
1. Following a set of approved cryptographic standards when building applications.
2. Using static code analysis programs that analyze application code to identify common coding mistakes that can lead to security vulnerabilities.
3. Instituting a vulnerability management strategy that identifies and repairs known vulnerabilities in IoT applications on a scheduled, ongoing basis.
These three best practices will not make IoT applications perfectly protected from malicious actors. However, they can significantly reduce an IoT application’s vulnerabilities and attack surface, making it much less likely a developer’s applications will be breached, generating angry customers and negative headlines.

Follow Approved Cryptographic Standards

Most developers understand that, if they hope to keep IoT data safe, they should encrypt this data, especially while it is in transit from device to cloud or vice versa. Yet, faced with tight development deadlines, as well as the need to make the most of their IoT devices’ limited bandwidth and processing capabilities, some developers choose to not encrypt their data or use weak cryptographic algorithms that promise to be faster or more lightweight than others but do not provide proper levels of security.

Experience shows taking encryption shortcuts can result in customers’ data being stolen, an application disabled or other problems. For this reason, developers need to work closely with their security teams to encrypt IoT application data appropriately, following standards and guidelines approved by internationally recognized experts such as the National Institute of Standards and Technology (NIST).

Choosing to use such approved standards does not have a major impact on IoT application development time, performance or functionality. NIST provides developers with guidelines on how to streamline integration of encryption standards into their applications. They also offer many different standards to choose from, so developers can find one that will provide their application with an appropriate level of security without sacrificing too much in terms of performance or functionality. Yes, it does require some additional work and effort, but if IoT developers want to make security a top priority, they need to make sure they are following approved cryptographic standards.

Use Static Code Analysis Programs

Many developers are familiar with static code analysis programs and their ability to discover common coding errors that can lead to bugs that affect software quality. However, these programs also can identify unsafe coding practices such as the use of improperly terminated strings, pointers to freed memory and buffer indexes allowed to go past the end of the buffer. These common coding mistakes create security vulnerabilities malicious actors can exploit in otherwise functional applications.

There are a variety of static code analysis tools available, both proprietary and open source that developers can use to alert them to coding errors that could create security vulnerabilities. Developers should research which ones best support their security and other code analysis needs, and then ensure that throughout the application development processes—and especially before deploying an application—they use these static code analysis programs to discover any coding errors that might lead to a security breach down the road.

Again, many developers might be tempted to skip this step, since the problems revealed by the program might prevent them from deploying and commercializing an otherwise functional application as fast as they would like. But, as the examples of IoT application hacks mentioned above demonstrate, cutting corners with security can often result in major problems down the road. If developers are dedicated to delivering their customers IoT applications with robust security, they need to commit themselves to using static code analysis programs to fix coding errors that might make their applications vulnerable to cyberattacks.

Monitor For and Repair Known Vulnerabilities

The media pays a lot of attention to so-called zero-day vulnerabilities—those that a software vendor has no prior knowledge about. However, the low-hanging fruit for most attackers is the ever-growing number of known vulnerabilities present in the millions of software components used in IoT applications that haven’t been fixed, either because the user of the component is unaware of the vulnerability or because they have not taken action to update their application to repair the vulnerability.

All IoT application developers should be aware of the known vulnerabilities their applications might have as result of incorporating third-party software components into their applications, be they open source components (such as a Linux operating systems and associated software) or proprietary components. However, keeping up to date on all the known vulnerabilities in an IoT application’s device firmware, operating system and other third-party software components is not simple. The enterprises that have built these software components, government agencies and other watchdogs often identify as many as 1,000 different vulnerabilities in these types of software components per month.

Fortunately, there are resources that can help developers stay up-to-date on new known vulnerabilities. For example, the National Vulnerability Database (NVD) is a public resource operated by NIST that catalogues known vulnerabilities in all types of software components, both proprietary and open source. To ensure their IoT applications do not have any known vulnerabilities, IoT developers can compile a security bill of materials (BOM) for their IoT application—a list of all the software components and versions used in the application—and then monitor the NVD for new known vulnerabilities with these components. Alternatively, there are a number of proprietary and open source tools that leverage free APIs to query the NVD database and then scan applications for vulnerabilities either by evaluating their components’ codebases or by discerning versions of exposed services (such as DNS, HTTP/S, NTP, SSH) on network interfaces.

However, simply being aware of known vulnerabilities does not fix those vulnerabilities. Which is why developers need to not just check for new known vulnerabilities on an ongoing basis, but also have a plan to regularly repair new known vulnerabilities with security updates. Ideally such a plan should allow these updates to be performed remotely (over the air) and automatically. Today, many consumer IoT applications already include an option to enable remote, automatic updates. The commercial IoT applications built by many developers sometimes need more coordination to enable such remote, automatic updates—but this should be the goal. In any event, even if the updates can’t be done remotely or automatically, it is essential that IoT developers have some sort of plan to deploy security updates for known vulnerabilities in their applications in a timely fashion.

Robust Security Will Enable Future Growth of IoT

IoT is at an important inflection point. The market continues to rapidly expand, with exciting new agricultural, supply chain, industrial, public safety, consumer and other IoT applications being launched every day. Yet, additional high-profile IoT application breaches could threaten the tentative level of trust businesses and consumers have placed in the IoT, especially as it increasingly is used to collect sensitive data or complete critical tasks.

To strengthen trust in IoT, developers need to dedicate themselves to making IoT security a top priority. Lip service is not enough–developers need to implement IoT security best practices, including the adoption of approved cryptographic standards, use of static code analysis programs to discover coding mistakes that can create security vulnerabilities and implementation of vulnerability management strategies that regularly identify and repair known vulnerabilities in their applications. If IoT developers make security a real top priority by implementing these and other IoT security best practices, the world’s trust in the IoT will grow and so will their business.

— Larry LeBlanc
August 6, 2019
How IoT Security Risks Derailing Robotics

Driven by advances in technologies such as artificial intelligence and deep learning, the mobile robots market is projected to grow to $54.1 billion by 2023 from $18.7 billion last year, according to Markets and Markets. But for robotics to progress, security for the internet of things (IoT) needs to be addressed fast, before the reputation of the entire industry suffers a permanent setback.

Every industry segment has a journey to maturity that involves ramping up how seriously it takes security. For robotics, that time has come. Failing to start robotics projects on the right software foundations will see confidence continue to drop, impeding the rate at which new solutions are created.

The future of robotics rests firmly on the shoulders of the IoT. Robots act as one part of intelligent ecosystems—they depend on IoT to link various sensors and smart meters, and pass data to and from third parties.

The self-driving car, for example, is a robot orchestrated by various smaller devices and smart sensors. In fact, robots are being created to tackle every conceivable problem. Take the Google-funded RangerBot, an underwater machine designed to track down a species of starfish responsible for coral reef destruction, or Small Robot Company, a startup tackling farming deficiencies with bots that autonomously feed, seed and weed arable crops.

However, while IoT is an established concept and connected devices are now mainstream, its full potential has not been realized in part because of security concerns. Ninety percent of consumers lack confidence in connected devices, according to a recent survey. These concerns are more than valid, as nearly half of companies are unable to detect when a breach occurs, and only 15% of budgets are earmarked for IoT security.

With IoT security a lingering weak spot, one major attack within robotics, could have a domino effect on the entire industry. Add to this the verticals that robots are beginning to infiltrate—health care and agriculture, for example—and the threat becomes immediate and very real.

Rising levels of sophistication within robotics go hand in hand with more targeted and damaging attacks. For example, telesurgery uses robotics to help surgeons perform procedures remotely. A malware bug in this scenario could mean the downing of tools, threatening the patient’s life.

Researchers at Brown University proved how easy it is to hack robots. The industry simply will not be sustainable without the backing of a secure, connected IoT network.

Robot manufacturers, therefore, must build with a security-by-design mindset. This begins by selecting a robust operating system from the outset—secure now, but also ready for future market demands.

Hackers are constantly evolving their activities and businesses must be flexible in their approach to security, shedding the old hardware-centric view of IoT security.

Software no longer can end when a device is shipped. It must align to the lifespan of a robot and be able to update whenever there is a potential flaw. The world of mobile took many years to get to grips with this. Robotics and IoT developers should learn from their mistakes.

One way developers can safely build and secure software is through snaps, containerized software packages on an open platform for building and publishing applications to an audience of millions.

If a security vulnerability is discovered in the libraries used by an application, the app publisher is notified so the app can be rebuilt quickly with the supplied fix and pushed out. This allowsr developers to stay focused on innovation while ensuring the longevity of the robotics hardware.

It remains unclear where the onus lies for IoT security, with nobody holding anyone else to account. Market constraints often prevent device makers from putting more budget than what is necessary into design security, when there is so much pressure to innovate ahead of competitors.

These issues need to be solved. Robotics has too much potential to let security concerns stunt their growth.

— Tom Canning

July 25, 2019
Akamai Extends Reach to the IoT Edge

Akamai today unveiled a strategic initiative to extend the reach of its global network out to applications deployed on the network edge.

Announced at the Akamai Edge World conference, the Edge Cloud portfolio will consist of a mix of existing, new and forthcoming offerings. In terms of new offerings, Akamai launched IoT Edge Connect, which provides access to the Message Queuing Telemetry Transport (MQTT) protocol that gives internet of things (IoT) applications access to a publish-and-subscribe service. Akamai claims IoT Edge Connect will scale to support hundreds of millions of endpoints and is capable of processing 10 times more messages than other IoT or in-app messaging cloud solutions. Those capabilities not only will optimize data delivery, but also should also reduce the amount of power devices will need to send messages, according to the company.

Scott MacGregor, senior director of engineering at Akamai, said IoT Edge Connect will join Akamai Over The Air (OTA) Updates, an existing service for updating applications using a wireless cellular network, in the Edge Cloud portfolio. Those two offerings will be joined in the future by a key-value store that will make it possible to store data on a local IoT gateway and a tool for running functions on an IoT endpoint, he said.

Akamai intends to provide the same capabilities it makes available to web applications to a new generation of edge computing applications that need access to a global network, MacGregor noted. In some cases, the data those applications need to access will be stored on local gateways. In other cases, the data being accessed will be stored within the network managed by Akamai. DevOps teams tasked with building IoT applications would view the Akamai network as just another platform they need to push code to from whatever continuous integration/continuous deployment (CI/CD) platform they choose to employ, he said.

In general, MacGregor said many organizations underestimate the challenges associated with building and deploying distributed IoT applications at unprecedented levels of scale. IoT applications that span global networks are challenging to build, and the processing occurs at the edge, on local gateways and in the cloud.

Akamai, of course, is not the only provider of a global network looking to entice organizations to leverage their infrastructure to deploy edge computing applications. Everyone from carriers including AT&T and Verizon to cloud service providers such as Amazon Web Services (AWS) and Microsoft are making similar cases. It’s too early even to hypothesize which platform providers might ultimately triumph. Akamai, however, is counting on its relationships with developers to become an edge computing force to be reckoned with, said MacGregor.

Akamai made its mark in the enterprise by providing a global content delivery network (CDN) that web developers leverage to extend the reach of their applications by leveraging cache memory Akamai makes available on a global network. Since then, the company has been extending the service to include a range of security services that isolate web applications from various potential threats. If Akamai has its way, those same services soon will be pervasive across a broad range of edge computing applications.

— Mike Vizard

June 12, 2019