After the attack, Northdale County Council has decided to redesign their ANPR system following newly released cyber security guidance.

To reduce cyber security risk, three possible actions can be taken:

  • Reduce exposure;
    • Make it more difficult for an attacker to access the device.
  • Reduce exploitability;
    • Configure the device so that it is more difficult to hack.
  • Reduce impact;
    • Change the way the system works so that a successful attack would have less of an impact.

Within cyber security, there is the concept of defence-in-depth. It is not a good idea to rely on a single cyber security measure, even if it appears to be highly effective, so the authority opts to do all three.

In the ANPR use case, exposure can be reduced by introducing security requirements on the mobile telecoms aspect of the procurement. The most common approach is to require the use of a private access point name (APN). You can think of this like having a router on your home broadband connection.  In the early days of home broadband, users connected their computer directly to a DSL modem. This exposed your computer directly to the public internet, and internet worms were able to freely spread between vulnerable computers. Thus, telcos started supplying routers to home broadband users. The router segregates your home computers on your own private network and places a firewall between your network and the internet. Devices on your home network can freely communicate, but inbound communications from the internet are blocked unless they were solicited by your device. A private APN does the same thing for your IoT device’s mobile data connection. Devices on your APN can communicate freely, but internet connectivity is restricted.

This fits with the IEC 62443 principle of segregating your operational systems into zones and conduits. An authority can conduct a risk assessment of the different types of IoT devices across their estate and choose to operate different private APNs for different classes of device.

Requiring a private APN is by no means the only security consideration when selecting a mobile telecoms provider. There are other security considerations as well, such as how access to the private APN is secured, whether the provider protects against unauthorised attempts to reconfigure SIM cards and how a provider handles a misused or stolen SIM card. There are specific considerations around the use of eSIMs and 5G. Before procuring SIM cards for IoT devices, or when reviewing the security of existing arrangements, authorities should consult specific IoT security guidance. One potential approach is to ensure service providers follow the GSM Association’s (GSMA) IoT Security Guidelines for Network Operators.

Should malicious input reach your IoT device, such as an ANPR camera, either from the internet, another network, a compromised device on the same network, or even an actor with physical access, you want your device to be hardened against it. Unsecure device firmware can have vulnerabilities that were introduced in the software development process and/or lack security features that protect against unauthorised access or breaches of data confidentiality, integrity or availability. The device’s configuration, when not properly set, can also allow an attacker to compromise the device.

When an IoT device such as a CCTV camera is procured, the purchaser needs to ensure that:

  • The device has been developed following a secure development framework such as IEC 62443-4-1.
  • The device implements some minimum set of security requirements such as the DCMS Code of Practice.
  • The vendor is committed to vulnerability monitoring and the release of security updates that can be easily implemented.
  • The vendor provides guidance to facilitate secure configuration by the delivery team.
  • The vendor and its supply chain are not potentially compromised by an incompatible overseas regulatory framework (e.g. forced to plant backdoor access by a foreign government).

Reducing the potential impact of a successful cyber-attack is another method of mitigating cyber security risk. In the ANPR use case, the worst potential impact of a cyber-attack is the leaking of millions of personal records, which could lead to regulatory action and a very significant fine. Various system design changes could reduce this worst potential impact.

Other IoT-type use cases would have their own unique considerations based on the application. Some smart streets systems have a critical impact when availability is disrupted, so further investigation and higher approval level may be warranted before taking action that may impact service availability. As a result playbooks need to consider whether any disruptions could have serious consequences for public safety and mobility along with visibility to the public and whether loss of availability of certain functions could damage public trust and confidence.

Secure Decommissioning
Case Study 2 – A Secure Transport Payment Service