Welcome to Siva's Blog

~-Scribbles by Sivananda Hanumanthu
My experiences and learnings on Technology, Leadership, Domains, Life and on various topics as a reference!
What you can expect here, it could be something on Java, J2EE, Databases, or altogether on a newer Programming language, Software Engineering Best Practices, Software Architecture, SOA, REST, Web Services, Micro Services, APIs, Technical Architecture, Design, Programming, Cloud, Application Security, Artificial Intelligence, Machine Learning, Big data and Analytics, Integrations, Middleware, Continuous Delivery, DevOps, Cyber Security, Application Security, QA/QE, Automations, Emerging Technologies, B2B, B2C, ERP, SCM, PLM, FinTech, IoT, RegTech or any other domain, Tips & Traps, News, Books, Life experiences, Notes, latest trends and many more...
Showing posts with label application security. Show all posts
Showing posts with label application security. Show all posts

Saturday, December 4, 2021

DevSecOps - Reference Architecture and Recommendations

DevSecOps - Reference Architecture and Recommendations

What is DevSecOps?

DevSecOps is the philosophy of integrating security practices within the DevOps pipeline, ensuring two seemingly opposed goals: speed of delivery and secure code. Critical security issues are dealt with as they become apparent at almost all stages of the SDLC process, not just after a threat or compromise has occurred. It’s not only about additional tools that automate tasks, but also about the mentality of your developers.

Recommendations for a comprehensive DevSecOps?

  1. IDE Plugins — IDE extensions that can work like spellcheck and help to avoid basic mistakes at the earliest stage of coding (IDE is a place/program where devs write their code for those who don’t know). The most popular ones are probably DevSkimJFrog Eclipse, and Snyk.
  2. Pre-Commit Hooks — Tools from this category prevent you from committing sensitive information like credentials into your code management platform. There are some open-source options available, like git-houndgit-secrets, and repo-supervisor.
  3. Secrets Management Tools allow you to control which service has access to what password specifically. Big players like AWS, Microsoft, and Google have their solutions in this space, but you should use cloud-provider-agnostic ones if you have multi-cloud or hybrid-cloud in place.
  4. Static Application Security Testing (SAST) is about checking source-code (when the app is not running). There are many free & commercial tools in the space (see here), as the category is over a decade old. Unfortunately, they often result in a lot of false positives, and can’t be applied to all coding languages. What’s worse is that they take hours (or even days) to run, so the best practice is to do incremental code tests during the weekdays and scan the whole code during the weekend.
  5. Source Composition Analysis (SCA) tools are straightforward — they look at libraries that you use in your project and flag the ones with known vulnerabilities. There are dozens of them on the market, and they are sometimes offered as a feature of different products — e.g. GitHub.
  6. Dynamic Application Security Testing (DAST) is the next one in the security chain, and the first one testing running applications (not the source code as SAST — you can read about other differences here). It provides less false positives than SAST but is similarly time-consuming.
  7. Interactive Application Security Testing (IAST) combines SAST and DAST elements by placing an agent inside the application and performing real-time analysis anywhere in the development process. As a result, the test covers both the source code and all the other external elements like libraries and APIs (this wasn’t possible with SAST or DAST, so the outcomes are more accurate). However, this kind of testing can have an adverse impact on the performance of the app.
  8. Secure infrastructure as code — As containers are gaining popularity, they become an object of interest for malware producers. Therefore you need to scan Docker images that you download from public repositories, and tools like Clair will highlight any potential vulnerabilities.
  9. Compliance as code tools will turn your compliance rules and policy requirements into automated tests. To make it possible your devs need to translate human-readable rules received from non-tech people into code, and compliance-as-a-code tools should do the rest (point out where you are breaking the rules or block updates if they are not in line with your policies).
  10. Runtime application self-protection (RASP) allows applications to run continuous security checks and react to attacks in real-time by getting rid of the attacker (e.g. closing his session) and alerting your team about the attack. Similarly to IAST, it can hurt app performance. It’s 4th testing category that I show in the pipeline (after SAST, DAST, and IAST) and you should have at least two of them in your stack.
  11. Web Application Firewall (WAF) lets you define specific network rules for a web application and filter, monitor, and block HTTP traffic to and from a web service when it corresponds to known patterns of attacks like, e.g. SQL injection. All big cloud providers like GoogleAWS and Microsoft have got their WAF, but there are also specialised companies like Cloudflare, Imperva and Wallarm, for example.
  12. Monitoring tools — as mentioned in my DevOps guide, monitoring is a crucial part of the DevOps manifesto. DevSecOps takes it to the next level and covers not only things like downtime, but also security threats.
  13. Chaos engineering. Tools from this category allow you to test your app under different scenarios and patch your holes before problems emerge. “Breaking things on purpose is preferable to be surprised when things break” as said by Mathias Lafeldt from Gremlin.
  14. Vulnerability management — these tools help you identify the holes in your security systems. They classify weaknesses by the potential impact of malicious attacks taking advantage of them so that you can focus on fixing the most dangerous ones. Some of the tools might come with addons automatically fixing found bugs. This category is full of open source solutions, and here you can find the top 20.

Reference Architectures of DevSecOps?

Refer: https://cdn2.hubspot.net/hubfs/4132678/Resources/DevSecOps%20Reference%20Architectures%20-%20March%202018.pdf

References:
https://medium.com/inside-inovo/devsecops-explained-venture-capital-perspective-cb5593c85b4e

    Sunday, January 17, 2021

    Continuous Security Best Practices

    9 Pillars of Continuous Security Best Practices

    1. Leadership 
    2. Collaborative Culture
    3. Design for DevOps
    4. Continuous Integration
    5. Continuous Testing
    6. Continuous Monitoring
    7. Continuous Security
    8. Elastic Infrastructure
    9. Continuous Delivery/Deployment
    Refer: https://devops.com/9-pillars-of-continuous-security-best-practices/

    Thursday, December 31, 2020

    Open Source Miracles : Semgrep

    Semgrep is a lightweight static analysis for many languages. Find bug variants with patterns that look like source code. This Open Source tool can be used for SAST (Static Application Security Testing) by the Developers and Security Engineers.

    Semgrep is a fast, open-source, static analysis tool that excels at expressing code standards — without complicated queries — and surfacing bugs early at editor, commit, and CI time. Precise rules look like the code you’re searching; no more traversing abstract syntax trees or wrestling with regexes.

    Refer: https://github.com/returntocorp/semgrep

    Monday, August 17, 2020

    Helping your business truly win with DevOps, IT Apps and Agile

    Helping your business truly win with DevOps, IT Apps and Agile

    This small scribble is all about a book named "The Phoenix Project" with summary notes and key takeaways...

    • How can you think your department as a production factory with a lot of agility
    • How fast you can make the changes to the failures so that business can run and win
    • How can we continually learn something from an existing system by putting tension into it
    • How seamlessly we can plan unplanned work like any other planned project activities; and once done with them, we need to see how can we completely get rid off them completely
    • How can we have parallel projects and programs which can benefit businesses

    Sources:

    https://itrevolution.com/wp-content/uploads/files/PhoenixProjectExcerpt.pdf

    https://www.magnusdelta.com/blog/2017/9/16/thephoenixprojectsummary

    https://medium.com/@lopamudramisra/the-phoenix-project-summary-4fdfbabba318

    Saturday, July 4, 2020

    Collective Software Architects' experiences together!

    This is a book review from my other blog readings and thought to repost here as reading experiences...
    Collective Software Architects'  experiences together in one blog here...

    • Architects are expected to know the technologies and software platforms on which their organizations run as well as the businesses that they serve.
    • Always put the customer’s long-term needs ahead of your own short-term needs and you won’t go wrong.
    • "Essential Complexity" represents the difficulty inherent in any problem.
    • "Accidental Complexity" grows from the things we feel we must build to mitigate essential complexity.
    • In large-scale software, though, removing accidental complexity while retaining the solution to the essential complexity is challenging.
    • Prefer frameworks derived from working code rather than ones cast down from ivory towers.
    • Projects are built by people, and those people are the foundation for success and failure.
    • Being clear and concise in the way you communicate your ideas is vital to the success of any software project.
    • Having the developer on your side creates a collaborative environment whereby decisions you make as an architect are validated. In turn, you get buy-in from developers by keeping them involved in the architecture process.
    • Experienced architects understand that they need to “sell” their ideas and need to communicate effectively in order to do that.
    • A better expression than ‘common sense’ is contextual sense — a knowledge of what is reasonable within a given context.
    • Sufficiently different nonfunctional properties of a subsystem create a boundary across which managing inconsistent representations is tractable.
    • To the extent that the business community fails to fulfill its responsibility to provide direction, answer questions, and make business decisions for the software development team, it is actually delegating the business decision making to software developers. The architect must provide the macro-context for this ongoing series of micro-decisions made by developers, by communicating and protecting the software architecture and business objectives, and must seek to ensure that developers do not make business decisions.
    • The long-term interests of the software development team are best served when business drives.
    • The pursuit of speculative generality often leads to solutions that are not anchored in the reality of actual development. They are based on assumptions that later turn out to be wrong, offer choices that later turn out not to be useful, and accumulate baggage that becomes difficult or impossible to remove,
    • A good architect should be able to spot a problem, call the team together, and without picking out a victim, explain what the problem is or might be and provide an elegant workaround or solution.
    • Build as a big bang event in project development is dead.
    • You’ll commonly see attempts to require overtime or sacrifice “less important scheduled tasks” (like unit testing) as a way to reduce delivery dates, or increase functionality while keeping the delivery dates as is.
    • Every software architect should know and understand that you can’t have it all.
    • Enough cannot be said about the importance of building a solid data model from Day One.
    • While business rules and user interfaces do evolve rapidly, the structures and relationships within the data you collect often do not.
    • Migrating data from one schema to another in situ is difficult at best, time consuming always, and error prone often.
    • The database is the final gatekeeper of your precious data. The application layer, which is by design ephemeral, cannot be its own watchdog.
    • The presence of two options is an indicator that you need to consider uncertainty in the design.
    • All architecture is design but not all design is architecture. Architecture represents the significant design decisions that shape a system, where significant is measured by cost of change.
    • Effective architecture is one that generally reduces the significance of design decisions.
    • Issues that seemed trivial early in the project become critical after it is too late to fix them.
    • Individuals often face resistance when the rest of the team does not share their experience or knowledge.
    • Defensiveness is easy. Learning to stop it is hard. Pride in our accomplishments is easy. Recognizing our limitations without conscious effort is hard.
    • Did you give everyone’s ideas the respect and acknowledgment they deserved?
    • If it looks good, it probably is good.
    • The architect should constantly be on the lookout for decisions that will have to be made soon.
    • Effective software architects understand not only technology but also the business domain of a problem space. Without business domain knowledge, it is difficult to understand the business problem, goals, and requirements, and therefore difficult to design an effective architecture to meet the requirements of the business.
    • Programming is an act of design, not an act of construction.
    • Over time, a good solution to the right challenge will probably outlast all others.
    • Was the solution an appropriate one for the problem? Did it solve the needs of the problem? Keep these as your measure — you will be a lot happier. Be happy with all that old stuff.
    • Expanding scope is the enemy of success because the probability of failure grows faster than expected.
    • Question any requirements not explained in terms of measurable value to the customer. If it has no effect on the company’s bottom line, why is it a requirement?
    • Important requirements usually remain important as the business changes, while others change or even evaporate.
    • Stewardship, taking responsibility and care of another’s property, is the appropriate role of an architect.
    • Value stewardship over showmanship; never forget that you are playing with other people’s money.
    • It’s not ethical to worsen the lives of others, even a small bit, just to make things easy for yourself.
    • We should plan to deploy one component at a time - it forces us to create well-defined interfaces between components.
    • When we deploy software, we are exposing ourselves to the accumulated technical risk embodied in the code. By deploying one component at a time, we spread technical risk out over a longer period of time.
    • It’s rare to find a technique that simultaneously provides higher commercial value and better architectural qualities, but early deployment of individual components offers both.
    • Performance of the people building the system is often called productivity, and it is important because it directly affects the cost and schedule of the project.
    • To be an effective software architect you must understand the basic architecture and design patterns, recognize when those patterns are being used, know when to apply the patterns, and be able to communicate to other architects and developers using them.
    • Enterprise architecture patterns define the framework for the high-level architecture. Some of the more common architecture patterns include event-driven architecture (EDA), service-oriented architecture (SOA), resource-oriented architecture (ROA), and pipeline architecture.
    • Application architecture patterns specify how applications or subsystems within the scope of a larger enterprise architecture should be designed.
    • Integration patterns are important for designing and communicating concepts surrounding the sharing of information and functionality between components, applications, and subsystems.
    • Anti-patterns, a term coined by Andrew Koenig, are repeatable processes that produce ineffective results.
    • Context is king, and simplicity its humble servant.
    • While newsgroups rage with the flames of technology debates of X versus Y, it is idle amusement. The reason these debates rage is often not because of huge disparities in their technical merits, but rather because there are more subtle differences between them, and what features individuals value more than others when there is no guiding context to act as a trump card.
    • In architecture as in all other operative arts, the end must direct the operation. The end is to build well. Well building has three conditions: Commodity, Firmness and Delight.
    • Duplication is evil. Repetitive work slows down development.
    • It’s not the domain logic that is copied; it’s the infrastructure code that just has to be there to make it work.
    • It’s crucial that you can envision the effects your examples have.
    • As an architect, you need to be highly sensitive to any kind of repetitive patterns, since anything you write will (ironically) be repeated.
    • Repetition in code is something that developers eventually learn to filter out and ignore when reading the code, once they figure out where the interesting variabilities are found, but even if the developers get used to it, it slows them down.
    • Repetition won’t go away unless someone does something about it. That someone is you.
    • Be ready to respond to events at any time in any order, regaining your context as needed. Make asynchronous requests concurrently instead of calling methods one by one. Avoid complete chaos by modelling your application using event-driven process chains or state models. Reconcile errors through compensation, retry, or tentative operations.
    • Building loosely coupled systems is a bit of a drag, so why do we bother? Because we want our systems to be flexible so they do not break apart at the slightest change.
    • Building a system that is flexible generally means the architecture is more complex and it’s more difficult to get the proverbial “big picture.”
    • An architect strives to merge realities with vision; past success with future direction; business and management expectations with development constraints. Creating these bridges is a major part of being an architect.
    • Like Janus, a software architect needs to be a keeper of doors and passageways, spanning the old and the new, incorporating creativity with sound engineering to fulfil today’s requirements while planning to meet tomorrow’s expectations.
    • From an architect’s point of view, the hard part is to find the natural places to locate boundaries and define the appropriate interfaces needed to build a working system. This is especially difficult in large enterprise systems, often characterized by few natural boundaries and intertangled domains.
    • A bounded context is an area where a model or concept is uniquely defined,
    • The role of an architect is usually to impose constraints, but you also have the opportunity to be an enabler.
    • Make sure developers have the tools they need.
    • The work life of a developer should be hands-on and practical, but also should be actively academic.
    • Let developers make their own decisions wherever it won’t contradict the overall goal of the software design. But put constraints where they count, not only to guarantee quality, but also to further empower developers. Create standards for the sake of consistency, but also to reduce the number of troublesome, insignificant decisions that aren’t part of the essential problem developers are solving.
    • One type of documentation that ages well, doesn’t require much effort, and almost always pays off is a record of the rationale behind decisions that are made regarding the software architecture.
    • The documentation should answer the basic questions “What was that decision we made?”, and “Why did we make that decision?”. A secondary question that is often asked and should be documented is “What other solutions were considered, and why were they rejected?”
    • Best practices in software architecture state that you should document the rationale behind each decision that is made, especially when that decision involves a tradeoff
    • At an individual level, we are all trying to grow and come to understand how to build larger and larger systems. The course of our careers will take us toward ever-increasing challenges, for which we want our past experiences to help guide us.
    • Testing your knowledge against the real world is scary, particularly when you find out that something dear is myth, incorrect, or was never true; it’s hard to be wrong.
    • Given the state of so much of our software, it is clearly important for us to take every opportunity to share the things we know, what we think we know, and what we’ve seen.
    • Stamping patterns all over a project unnecessarily is over-engineering.
    • The support and maintenance of an application should never, ever be an afterthought.
    • Sometime accepting a constraint or giving up on a property can lead to a better architecture, one that is easier and less expensive to build and run.
    • When creating your architecture, you should explicitly use principles, axioms, and analogies to guide the creation. This gives the architecture a number of benefits that are not present if you simply create by implicitly leveraging your experience, opinions, and tastes.
    • An architecture with clear principles is an architecture that frees its architect from reviewing everything and being everywhere. It gives architects greater leverage
    • Start with a walking skeleton, keep it running, and grow it incrementally.
    • Seeing the system entirely by the structure of its underlying information — can reduce even the most complicated system down to a tangible collection of details.
    • Data sits at the core of most problems.
    • What we don’t want to do is apply a complicated solution to an easy problem.
    • Keep the simple stuff simple.
    • Your code is your currency.
    • As an architect, your primary goal should be to create a solution that is feasible, maintainable, and of course addresses the issue at hand.
    • If you design it, you should be able to code it.
    • Not everything need directly translate in monetary gains, but our investments should result in added value.
    • The ROI of each option can be determined by examining its costs and projected profits, and can be used as a base for selection from available options.
    • Consider architectural decisions as investments and take into account the associated rate of return;
    • Even if your system is bleeding edge and developed in the latest technology, it will be legacy to the next guy. Deal with it!
    • Good design will document itself in many ways.
    • Legacy tends to be a bad word in software circles, but in reality, all software systems should endure the tag. It is not a bad thing,
    • If you can only think of one solution to a problem, you’re in trouble.
    • If you find yourself in the situation where you automatically know the solution, without having done any comparison to other approaches, stop, take a step back, and ask yourself if you can think of another way to do it.
    • A good architect reduces complexity to a minimum and can design a solution whose abstractions provide solid foundations to build upon, but are pragmatic enough to weather change.
    • The great architect understands the impact of change — not just in isolated software modules, but also between people and between systems.
    • The architect’s role is not necessarily to manage change, but rather to ensure that change is manageable.
    • Shortcuts taken during the initial development phase of a project can result in significant maintenance costs later.
    • Poorly designed features can become the foundation for future features, making corrective action later even more costly.
    • Don’t give in to the temptation to make your design, or your implementation, perfect! Aim for “good enough” and stop when you’ve achieved
    • Show the business domain experts the respect you expect to receive; this is the last group of people you want viewing you as unapproachable.
    • Don’t allow yourself to become a disgruntled genius who spends all of his time trying to impress others by making witty, condescending statements about how poorly the company is run. They won’t be impressed. They’ve met that guy before and they don’t really like him.
    • Find a way to establish a good relationship with the business and don’t let your ego damage it.
    • Before anything, an architect is a developer.
    • If you don’t know what a thing should be called, you cannot know what it is. If you don’t know what it is, you cannot sit down and write the code.
    • An architect should be able to look at a whole mess of concepts and data and process and separate them into smaller pieces or “chunks.” The important thing about those problem chunks is that they are stable, allowing them to be solved by a system chunk that is finite and stable in scope.
    • If the problem is stable, then when it is solved, it is solved permanently.
    • Diligence also requires an architect to succeed at the deceptively simple task of making and keeping commitments.
    • Better is possible. It does not take genius. It takes diligence. It takes moral clarity. It takes ingenuity. And above all, it takes a willingness to try.
    • Don’t be clever. Be as dumb as you possibly can and still create the appropriate design.
    • There’s usually no huge advantage to being the first to adopt new technology, but there can be several drawbacks.
    • Your customer is not your customer. Your customer’s customer is your customer.
    • During requirement gathering, allow your customer to express only the Platonic ideal, his concept and goals, rather than dictating a solution or even using technical terms.
    • No matter how in-depth, how well researched, and how well thought-out your design, it will never come out looking the same as in your head.
    • By accepting that design is an ongoing and empirical process in a forever-changing world, we learn that the design process must be flexible and ongoing,
    • If you can control how people perceive the architectural approach you propose, it’s virtually guaranteed that you can control how they will react to your proposal.
    • Make a strong business case for your architecture. People who have the budget authority to sponsor your ideas are almost always business-driven.
      • Establish the value proposition.
      • Build metrics to quantify.
      • Link back to traditional business measures.
      • Know where to stop.
      • Find the right timing.
    • Make data and schema management a seamless part of your automated build and testing process early on and include an undo button;
    • Sometimes the best solution is no solution. Many software problems need not be solved at all. They only appear as problems because we look only at the symptoms.
    • Make sure it’s tough to crack the starting lineup, and once you’ve got a winning team, go the extra mile to keep it together.
    • It is simply not possible to future-proof an architecture.
    • Your goal as an architect is to be aware of and measure the threat of acceptance problems and work toward mitigating those threats.
    • Many missed requirements and bugs in software can be traced to ambiguous, general language.
    • The architect should also look at doing user interaction testing while the product is still in beta with actual end users, and incorporate their feedback into the final product.
    • It is the architect’s responsibility to make the most common interactions not only easy but also rewarding for the end user.
    • Resist trying to design a large complete system to “meet or exceed” the known requirements and desired properties, no matter how tempting that might be. Have a grand vision, but not a grand design.
    • Design the smallest system you can, help deliver it, and let it evolve toward the grand vision.

    Sunday, July 1, 2018

    GE IIoT Predix links as a reference...

    GE IIoT Predix links as a reference...

    GE IIoT Predix

    https://www.ge.com/digital/iiot-platform

    Predix

    https://www.predix.io/

    Predix catalog and services

    https://www.predix.io/catalog/services/

    GE Predix docs

    https://www.ge.com/digital/documentation/predix-platforms/index.html


    Thread Connect Integration Platform

    https://www.ge.com/digital/documentation/predix-platforms/tcip-overview.html

    https://github.com/thread-connect

    Apache Nifi

    https://nifi.apache.org/

    Sunday, May 13, 2018

    A few of my experiences as a Security Architect

    A few of my experiences as a Security Architect

    I got an opportunity to work a Security Architect role as well apart from my usual Software Architect or Leadership role in multiple organizations and wanted to mention a few of my experiences which can be beneficial for my own reference and others too who are practitioners...


    1. Embed Security as a practice in all phases of SDLC or Agile projects
      1. Security requirements tracking
      2. Security Threat modeling to achieve Secure Design & Architecture, based on the ranking we provide to risks, try to do risk mitigations and auditing in later part
      3. Make sure to have Secure Infra Design, Secure Product implementation, Secure Deployment or DevSecOps, and finally have a Secure Operations team who can monitor and report
      4. Automate the processes or steps whatever you can from the above-mentioned steps like
        1. An automated way of doing SAST (Static Application Security Testing)
        2. An automated way of doing DAST (Dynamic Application Security Testing)
        3. Apart from the above DAST, see if you can automate any other aspects of your product-specific Security testing
        4. An automated way of finding Open Source Software and Third Party libraries Vulnerability Assessment
        5. An automated way of doing Infracture Technology Hardening
        6. An automated way of doing Secure Configurations
        7. An automated way of doing Secure Deployments and leveraging DevSecOps processes
        8. An automated way of doing Monitoring and providing meaningful Security Analytics
        9. An automated way of doing Alerts and Notifications
        10. An automated way of raising Security bugs for tracking and closure of the raised earlier bugs
      5. Finally, feed some of the above and maybe not covered in above as documents or information for the purposes of Risk Management and Governance & Compliance requirements; Also, these details are really needed for Auditing purposes as well
    2. Apart from the above, have a dedicated RED Team within your organization who can manage the Security Tools chain and also perform 'defense in depth' with respect to overall Information Security and all layers in your product in a wing-to-wing manner
    3. Many times, it's a good idea to have external Penetration Testing performed by expert cybersecurity professionals before the release of the product to end customers
    4. Some of the best practices which I follow thoroughly to have a product very secure enough are
      1. Always, change the default passwords or keys of your devices or products so that those configurations are only known to you
      2. Have a Roles Based Access Control (RBAC) defined for your product and always assign the very least privilege or role possible for a given user of your product
      3. Don't trust all the machine/user to machine/user connections are trusted with respect to your product or your APIs; Have necessary OAuth or two-factor authentication implemented; Have necessary secure certificates while communicating
      4. Don't reinvent the wheel just because of Securing your products; Have a very simple reliable and resilient approach and use existing tools to achieve Security in your products. Try to see if there is already an available proven toolchain or component which can be leveraged
      5. Use generic centralized logging within your product components (like web apps, APIs, other Data, and Services) to capture the right sort of events messages which can be leveraged for Security Monitoring and then, in turn, provide meaningful insights
    5. Moreover,  implement an awareness program with the right set of documents, details, workshops, pieces of training so that the various groups in the organization are aware of Information Security and understand and practice them in their day to day product development activities


    References:
    1. https://www.owasp.org/index.php/Category:Principle
    2. https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-27ra.pdf

    Happy reading and learning! :)

    Sunday, November 6, 2016

    IoT : The Internet of Things

     The Internet of Things is an emerging topic of technical, social, and economic significance. Consumer products, durable goods, cars and trucks, industrial and utility components, sensors, and other everyday objects are being combined with Internet connectivity and powerful data analytic capabilities that promise to transform the way we work, live, and play. Projections for the impact of IoT on the Internet and economy are impressive, with some anticipating as many as 100 billion connected IoT devices and a global economic impact of more than $11 trillion by 2025.

    At the same time, however, the Internet of Things raises significant challenges that could stand in the way of realizing its potential benefits. Attention-grabbing headlines about the hacking of Internet-connected devices, surveillance concerns, and privacy fears already have captured public attention. Technical challenges remain and new policy, legal and development challenges are emerging.

    This overview document is designed to help the Internet Society community navigate the dialogue surrounding the Internet of Things in light of the competing predictions about its promises and perils. The Internet of Things engages a broad set of ideas that are complex and intertwined from different perspectives. Key concepts that serve as a foundation for exploring the opportunities and challenges of IoT include:

    • IoT Definitions: The term Internet of Things generally refers to scenarios where network connectivity and computing capability extends to objects, sensors and everyday items not normally considered computers, allowing these devices to generate, exchange and consume data with minimal human intervention. There is, however, no single, universal definition.
    • Enabling Technologies: The concept of combining computers, sensors, and networks to monitor and control devices has existed for decades. The recent confluence of several technology market trends, however, is bringing the Internet of Things closer to widespread reality. These include Ubiquitous ConnectivityWidespread Adoption of IP-based NetworkingComputing EconomicsMiniaturizationAdvances in Data Analytics, and the Rise of Cloud Computing.
    • Connectivity Models: IoT implementations use different technical communications models, each with its own characteristics. Four common communications models described by the Internet Architecture Board include: Device-to-Device, Device-to-Cloud, Device-to-Gateway, and Back-End Data-Sharing. These models highlight the flexibility in the ways that IoT devices can connect and provide value to the user.
    • Transformational Potential: If the projections and trends towards IoT become reality, it may force a shift in thinking about the implications and issues in a world where the most common interaction with the Internet comes from passive engagement with connected objects rather than active engagement with content. The potential realization of this outcome – a “hyperconnected world” — is testament to the general-purpose nature of the Internet architecture itself, which does not place inherent limitations on the applications or services that can make use of the technology.

    Five key IoT issue areas are examined to explore some of the most pressing challenges and questions related to the technology. These include security; privacy; interoperability and standards; legal, regulatory, and rights; and emerging economies and development.

    Security

    While security considerations are not new in the context of information technology, the attributes of many IoT implementations present new and unique security challenges. Addressing these challenges and ensuring security in IoT products and services must be a fundamental priority.Users need to trust that IoT devices and related data services are secure from vulnerabilities, especially as this technology become more pervasive and integrated into our daily lives. Poorly secured IoT devices and services can serve as potential entry points for cyber attack and expose user data to theft by leaving data streams inadequately protected.

    The interconnected nature of IoT devices means that every poorly secured device that is connected online potentially affects the security and resilience of the Internet globally. This challenge is amplified by other considerations like the mass-scale deployment of homogenous IoT devices, the ability of some devices to automatically connect to other devices, and the likelihood of fielding these devices in unsecure environments.

    As a matter of principle, developers and users of IoT devices and systems have a collective obligation to ensure they do not expose users and the Internet itself to potential harm. Accordingly, a collaborative approach to security will be needed to develop effective and appropriate solutions to IoT security challenges that are well suited to the scale and complexity of the issues.

    Privacy

    The full potential of the Internet of Things depends on strategies that respect individual privacy choices across a broad spectrum of expectations. The data streams and user specificity afforded by IoT devices can unlock incredible and unique value to IoT users, but concerns about privacy and potential harms might hold back full adoption of the Internet of Things. This means that privacy rights and respect for user privacy expectations are integral to ensuring user trust and confidence in the Internet, connected devices, and related services.

    Indeed, the Internet of Things is redefining the debate about privacy issues, as many implementations can dramatically change the ways personal data is collected, analyzed, used, and protected. For example, IoT amplifies concerns about the potential for increased surveillance and tracking, difficulty in being able to opt out of certain data collection, and the strength of aggregating IoT data streams to paint detailed digital portraits of users. While these are important challenges, they are not insurmountable. In order to realize the opportunities, strategies will need to be developed to respect individual privacy choices across a broad spectrum of expectations, while still fostering innovation in new technology and services.

    Interoperability / Standards

    A fragmented environment of proprietary IoT technical implementations will inhibit value for users and industry. While full interoperability across products and services is not always feasible or necessary, purchasers may be hesitant to buy IoT products and services if there is integration inflexibility, high ownership complexity, and concern over vendor lock-in.

    In addition, poorly designed and configured IoT devices may have negative consequences for the networking resources they connect to and the broader Internet. Appropriate standards, reference models, and best practices also will help curb the proliferation of devices that may act in disrupted ways to the Internet. The use of generic, open, and widely available standards as technical building blocks for IoT devices and services (such as the Internet Protocol) will support greater user benefits, innovation, and economic opportunity.

    Legal, Regulatory and Rights

    The use of IoT devices raises many new regulatory and legal questions as well as amplifies existing legal issues around the Internet. The questions are wide in scope, and the rapid rate of change in IoT technology frequently outpaces the ability of the associated policy, legal, and regulatory structures to adapt.

    One set of issues surrounds crossborder data flows, which occur when IoT devices collect data about people in one jurisdiction and transmit it to another jurisdiction with different data protection laws for processing. Further, data collected by IoT devices is sometimes susceptible to misuse, potentially causing discriminatory outcomes for some users. Other legal issues with IoT devices include the conflict between law enforcement surveillance and civil rights; data retention and destruction policies; and legal liability for unintended uses, security breaches or privacy lapses.

    While the legal and regulatory challenges are broad and complex in scope, adopting the guiding Internet Society principles of promoting a user’s ability to connect, speak, innovate, share, choose, and trust are core considerations for evolving IoT laws and regulations that enable user rights.

    Emerging Economy and Development Issues

    The Internet of Things holds significant promise for delivering social and economic benefits to emerging and developing economies. This includes areas such as sustainable agriculture, water quality and use, healthcare, industrialization, and environmental management, among others. As such, IoT holds promise as a tool in achieving the United Nations Sustainable Development Goals.

    The broad scope of IoT challenges will not be unique to industrialized countries. Developing regions also will need to respond to realize the potential benefits of IoT. In addition, the unique needs and challenges of implementation in less-developed regions will need to be addressed, including infrastructure readiness, market and investment incentives, technical skill requirements, and policy resources.

    The Internet of Things is happening now. It promises to offer a revolutionary, fully connected “smart” world as the relationships between objects, their environment, and people become more tightly intertwined. Yet the issues and challenges associated with IoT need to be considered and addressed in order for the potential benefits for individuals, society, and the economy to be realized.

    Ultimately, solutions for maximizing the benefits of the Internet of Things while minimizing the risks will not be found by engaging in a polarized debate that pits the promises of IoT against its possible perils. Rather, it will take informed engagement, dialogue, and collaboration across a range of stakeholders to plot the most effective ways forward.

    Refer for more details: https://www.internetsociety.org/wp-content/uploads/2017/08/ISOC-IoT-Overview-20151221-en.pdf