The Global Cyber Alliance (GCA) launched the Automated IoT Defence Ecosystem (AIDE), a cybersecurity development platform for Internet of Things (IoT) products.
AIDE enables small businesses, manufacturers, service providers and individuals to identify vulnerabilities, mitigate risks and secure IoT devices against the growing volume of threats to this interconnected environment.
A complementary resource to the AIDE platform is the GCA ProxyPot, a custom IoT honeypot solution developed by GCA, which is capable of replicating one IoT device across multiple IP addresses and physical locations to identify global attack risks quickly, efficiently and accurately.
Together, the AIDE and ProxyPot platforms allow organizations and individuals to have greater visibility into the types and scale of threats facing the IoT devices deployed into various environments, including smart cities and other smart ecosystems.
“The number of Internet-connected devices has grown exponentially over the last decade and with it the cyber risk to companies, organizations and individuals deploying these devices on their network,” said Philip Reitinger, president and chief executive of GCA. “The launch of the AIDE platform furthers GCA’s mission of providing scalable, implementable solutions to organizations of all sizes and budgets to secure their devices and reduce risk.”
With an estimated 14.2 billion Internet-connected devices currently in use and a projected increase to 25 billion by 2021, the challenge to identify, analyze and mitigate IoT threats has dramatically increased. Also cause for concern, a recent survey found less than 1 in 3 organizations maintain a privileged-access security strategy for their IoT devices, making the organizations an ideal target for threat actors.
The AIDE platform offers capabilities for data collection, analysis and automated defense on a scale not previously attained. As part of its first effort to leverage the AIDE and ProxyPot technologies, GCA is working with Attivo Networks to build a SCADA honeyfarm to collect threat intelligence on attacks targeting industrial control systems.
“We are thrilled to be working with GCA to provide the benefits of deception technology to organizations around the world. IoT devices are notoriously difficult to secure and apply typical prevention measures. As a result, innovative solutions like deception technology are playing a critical role in the early threat detection and response to cyberattacks,” said Marc Feghali, co-founder and vice president of product management at Attivo Networks. “By creating customized decoys that blend in with production connected devices, organizations can quickly detect attackers, engage them, capture their attack methods, derive their attack signature and divert them away from real IoT infrastructure, mitigating the risk of attacks on Operational Technology (OT) infrastructure.”
AIDE allows for the following:
Collection: AIDE platform will automatically collect IoT attack data through three methods:
1. Honeyfarms located around the world, including a GCA honeyfarm with more than 1,200 devices, and data feeds from partners
2. Virtual IoT devices located on simulated networks
3. ProxyPots that can be distributed around the world and backed by real and virtual IoT devices
Analysis: AIDE aggregates attack data into an analysis platform that is available to companies, academia, nonprofits and other entities to study IoT attack signatures and patterns. In exchange for access to the data, researchers will share any algorithms developed to help AIDE generate additional information products.
The analysis platform will be used to generate data feeds available to GCA partners and the security community. These feeds will be made widely available throughout the cybersecurity ecosystem to enable IoT attack mitigation.
Automated Defense: The real-time threat feeds generated by the platform can limit and mitigate identified attacks while preventing any further compromise of IoT devices. AIDE allows an edge router/policy enforcement point to use threat feeds to mitigate attacks against the local environment and also relies upon an application of the capabilities of the “Manufacturer Usage Description” standard, through which manufacturers can specify the types of activities and communications that are allowed on their devices. This type of automated defense offers small businesses and home users a way to have free or low-cost protection for their small office and consumer network (home IoT) devices that often have no other way to address IoT vulnerabilities.
“The bad guys do not discriminate when deciding which organizations to target for IoT attacks, so our defenses shouldn’t either,” said Adnan Baykal, GCA Global Technical Advisor. “With AIDE, any organization can access our threat feeds for data, conduct analysis and even search specific activity by username, source IP, destination IP, commands, hashes and geographic location. As we continue to establish partnerships and sponsors, the platform will continue to improve and provide added value to those within the ecosystem.”