{"data":{"news":{"items":[{"title":"Challenges Vs Benefits Of Edge Computing Security","date":"2019-12-06 11:22:25","id":1883,"author":"","blurb":"","blurb_image_uid":"https://dxfpracgmlczp.cloudfront.net/2019/12/1575603429592_network-2402637.jpg","blurb_expanded_image_uid":null,"article":"\n\t\n\n\n

As ABB – a multinational corporation headquartered in Zurich, Switzerland, that's focused on robotics, power, heavy electrical equipment and automation technology areas – implements edge computing in its factories, CSO Satish Gannu is tasked with securing the emerging collection of equipment and the data that resides in it.

\n\n

According to Gannu, he must ensure the integrity, security and privacy of the data on the devices, as well as safeguard against any malware moving from the cloud through the network to the end devices themselves.

\n\n

"In our factory, if we're trying to take actions in milliseconds, we need to do it on the edge. But once you start collecting data, [edge computing] security is paramount from day one," he said.

\n\n

"The edge is within the IT boundary, so there is [a] huge amount of security in front of it. But, at the same time, we are building a tunnel from the edge into the cloud. So, now, you're giving a connection outside your boundaries—the cloud—and that [will] allow things to get through the tunnel. That's why it's important that the traffic can leave [the edge], but what comes back into the tunnel needs to be authenticated," he continued. "It's all about control where the data is. Whether the data is on the edge or in the cloud, you have to figure out who has access to it and who is monitoring it."

\n\n

Gannu said he has a layered approach to securing his company's edge computing initiative and the data that resides in it, using a host of protocols and technologies – from firewalls to secure storage to a secure registration process to authenticated traffic.

\n\n

As edge computing gains steam, security executives like Gannu are facing a similar jump in edge security challenges, as they seek to set and enforce security, privacy and compliance standards around a growing number of devices on the edge, an expanding network of connections and the various new software deployments enabling the actual compute power along the fringes of the network.

\n\n

"There are new risks involved in edge computing, but you can't say it's less [secure]; it's just a different set of security issues you have to consider," said Kevin Curran, a senior member of the Institute of Electrical and Electronics Engineers and a professor of cybersecurity at Ulster University.

\n\n

New Edge Computing Security Risks

\n\n

According to experts, edge computing introduces several new security risks.

\n\n

One of the most prominent concerns is the physical security of the devices, which are more vulnerable to malicious attacks and mishaps of all kinds than typical office equipment and technology safely held within corporate walls, said Proteus Duxbury, a transformation expert at PA Consulting, based in London.

\n\n

"In a highly distributed model, there's a physical security and integrity threat, because there's no guarantee [someone] might not monkey with your device. So, the physical security of handsets, edge devices and micro data centers needs to be examined," Duxbury said.

\n\n

He noted that micro data centers, such as those being deployed by telecommunication companies—in some cases, at the base of cell towers—introduce a level of physical vulnerability that didn't exist with corporate data centers and large cloud providers.

\n\n

Meanwhile, many organisations will be challenged to understand, track and monitor what data they have and where, what protections are required at the various points based on the data and vulnerabilities specific to each endpoint and how to govern what could soon be a sprawling infrastructure at many companies.

\n\n

"You're introducing more vulnerability into the system when you're keeping data on the edge. But it's not because it's a new threat, but more the volume of what we're now doing on the edge," Duxbury explained.

\n\n

Edge Computing Security Offers Benefits

\n\n

Although edge computing comes with new challenges, experts said it also offers some security-related benefits.

\n\n

"In some ways, it's more resilient, because instead of one or two or even three data centers, where if they're close enough together that, say, a big storm could impact them all, you have distributed data and compute on the edge, which makes it much more resilient to malicious and nonmalicious events. This allows us to be resilient with data and processing," Duxbury said. "And there's less data going out to a centralised location and through communication lines, whether it's fiber-optic or telephone cables. So, there's probably less risk, because the data isn't leaving the edge and going across the internet," he continued.

\n\n

Similarly, edge computing may offer some protection against a catastrophic attack where a single incident can compromise large amounts of a company's data, said Jamie Bourassa, vice president of edge computing for Schneider Electric.

\n\n

"In some ways, there's more security with edge, because now your data is spread out [and] you're not concentrating and centralising your data. So, the impact of a breach can be highly contained," he said.

\n\n

Meanwhile, IoT device vendors have been adding more edge computing security elements to their products after being criticised in recent years for not doing enough on that front. California's 2018 IoT security law, which, starting in 2020, requires manufacturers of connected devices to include security features designed to prevent unauthorised access, modification, and information disclosure, has helped push the issue further to the forefront.

\n\n

Fundamentals Still Apply

\n\n

Curran said organisations and IT leaders need to cultivate new skills within their security teams to cope with the new types of security and compliance challenges that edge computing brings, noting that security workers will have to develop more knowledge in security virtualised network infrastructure, rules-based access control policies, and multi-tenant virtualised server infrastructure.

\n\n

He added that they must also retain all the conventional security and compliance acumen they've needed thus far, as the security, compliance and privacy risks, as well as the governance needs that exist today, aren't going away with edge computing.

\n\n

In fact, experts pointed out that edge computing security and capabilities are vulnerable to denial-of-service attacks, ransomware and other conventional types of threats.

\n\n

Despite the newness of edge computing, experts advise IT leaders to develop security, privacy and compliance plans for their edge computing capabilities as they would for their conventional technology infrastructure and data holdings.

\n\n

"The fundamentals haven't changed: You're evaluating the risk. You go through the threat and risk analysis and decide what needs to be done," Gannu said.

\n\n\n","article_image_uid":"https://dxfpracgmlczp.cloudfront.net/2019/12/1575603426707_network-2402637.jpg","article_expanded_image_uid":null,"article_image_caption":"Article by Mary K. Pratt, TechTarget","publications":"5","tags":"Cybersecurity,edge computing","category":"Others"},{"title":"Don’t Let Edge Computing Security Concerns Derail Your Plans","date":"2019-12-02 14:33:39","id":1878,"author":"","blurb":"","blurb_image_uid":"https://dxfpracgmlczp.cloudfront.net/2019/12/1575268940217_abstract-art-blur-bright-373543.jpg","blurb_expanded_image_uid":null,"article":"\n\t\n\n\n

The edge is a place where IT pros get nervous. Employees using mobile devices to perform work outside of the office are just the start of that anxiety. With IoT expected to change how organizations measure the efficiency of all sorts of machinery and with autonomous vehicles predicted to revolutionize driving, IT teams will certainly have their hands full keeping track of devices and sensors processing information on the edge.

\n\n

While edge computing security worries shouldn't be dismissed, they also shouldn't prevent organizations from taking advantage of edge computing, according to several industry insiders. With proper deliberation, they say, the edge can be secured.

\n\n

For example, when Neil MacDonald, vice president and distinguished analyst at Gartner, advises clients about edge security, he tells them, "There is risk in anything, whether it's your own data center or a public cloud, like AWS or Azure. There is always risk." Once an organization acknowledges that certainty about edge computing, it should "put out on the table what all those possible risks are and what are all of the possible mitigating controls."

\n\n

It seems like simple advice, but sometimes, MacDonald said, organizations don't recognize the full value of their IT assets, including data. In turn, they don't always undertake necessary cybersecurity measures. But, if data is out on the edge -- vulnerable to attack -- organizations need to make a full assessment of its value and determine what it will take to protect it.

\n\n

"What is the nature of the data being collected? What would be the business outcome if that data is stolen or tampered with? You need to focus on those bad outcomes and what the risks are," MacDonald said.

\n\n

Edge computing isn't going away

\n\n

Securing centralized computing seems a lot easier than securing the edge. There is familiarity and comfort in centralized computing. Users follow uniform system protocols, and it's easier for IT to monitor security, lessening the chance of data breaches and other incidents.

\n\n

But, while central processing will continue to have a role in the enterprise, tantalizing business opportunities are increasingly out on the edge. The workplace efficiency of mobile devices, the possible safety gains from autonomous and computer-assisted driving, and the promise of enhanced efficiency through IoT have organizations jumping for joy as they envision all of those and even more technological possibilities.

\n\n

By many indications, edge computing is poised to explode. Today, only about 20% of enterprise data is being produced and processed outside of centralized data centers, but by 2025, that is expected to increase to 75% and could reach 90%, according to Gartner.

\n\n

Still, there's no escaping that edge computing is, after all, at a distance from centralized control and thus a great source of worry for the C-suite. Envision a transportation company with thousands of telemetric devices out in the field collecting troves of data on vehicle performance and driver safety. Or picture an energy company with thousands of IoT sensors on hundreds of windmills spread out on a desolate landscape. The possibility of physical and virtual tampering of such a large array of devices makes edge computing security an unshakable concern.

\n\n

Alan Mindlin, technical manager for electronics manufacturing services provider Morey, advises worried organizations to first review the security strength of all edge-related devices that handle data at rest and in motion.

\n\n

"There's already a fair amount of encryption in the storage of a device. So, a bad actor can't crack it open and read the memory, and there is encryption on data that is sent. Starting there helps determine your position," Mindlin said.

\n\n

Essentially, follow the data trail on the edge by checking the effectiveness of data encryption on the application layer and storage layers, Gartner's MacDonald said. But that's just the beginning. Organizations also have to safeguard network connectivity, which, he said, is in many respects the same as securing a modern software-defined WAN.

\n\n

"Whatever local devices there are at that location, ideally, there should be attestation … and some assurance of proof of identity" through network access control, MacDonald said.

\n\n

Trust no one, not even the CSO

\n\n

While most organizations would concur that identity management makes or breaks security, Brian Hopkins, VP and principal analyst at Forrester, said his firm views it as an entirely broken practice.

\n\n

"The fundamental way we secure our systems is totally wrong," he said. "The way we think of it is there are a set of services we need and don't want anyone to hack into or shut down, and the way we secure it is draw a circle around it, put in layers of firewall so only the people who use it have access."

\n\n

The problem is that, once cybercriminals assume an approved identity, they have the freedom to roam a system with impunity. Hopkins said that's why Forrester recommends implementing a severe-sounding but beneficial security philosophy for edge computing: zero-trust security. Trust no one, not even the CSO, unless her technology passes a daunting sniff test.

\n\n

"Zero trust says that identity management is wrong because cybercriminals can bust down just about any firewall put up. Once they are verified, they're in the circle and can do harm," Hopkins said. "When you don't trust anyone, however, you look at everything, inspect every packet -- and very quickly -- and understand what is on that packet."

\n\n

Zero trust calls for more precise network segmentation -- the creation of so-called microperimeters to prevent hackers from moving laterally throughout a network. Many organizations already have pieces in place to implement a zero-trust policy -- automation, encryption, identity and access management, mobile device management and multifactor authentication -- and those processes require software-defined networking, network orchestration and virtualization.

\n\n

Yet, organizations have and will continue to hesitate to implement zero trust, Hopkins said, because "it's so fundamentally different and a big thing for companies to absorb."

\n\n

Again, no one claims enhancing edge computing security will be a walk in the park. "The number of combinations behind network connectivity is staggering, so it's very challenging how we connect what's going on in the data center in cloud to what's going on in the physical world," Hopkins added. "It's tough to implement a zero-trust idea."

\n\n

Setting a foundation for the edge

\n\n

In a sign that edge computing has taken hold in mainstream business, the people behind the scenes of technology -- the developers -- see the need to form accepted industry standards for the edge. One such example is Project EVE (for Edge Virtualization Engine), a Linux Foundation umbrella organization that aims to establish open, interoperable frameworks for edge computing that are independent of hardware, silicon, cloud or OSes.

\n\n

Zededa, an edge virtualization company based in California, donated the seed code to start Project EVE. Roman Shaposhnik, co-founder at Zedada, said the proper approach to edge is to treat it as something radically different from conventional computing. "No one is running just one cloud anymore," he said.

\n\n

Virtualization, Shaposhnik said, gives companies full control over how they partition and secure computing resources. Project EVE, for instance, verifies updates and activity through an edge device's hardware root of trust, preventing spoofing, malware injection and other malicious actions, he said. By decoupling software from the underlying hardware through virtualization, EVE lets users make over-the-air software updates, which should prompt organizations to apply security patches quicker than they usually do.

\n\n

No matter how an organization chooses to approach edge computing security, it needs to put a value on their data, Morey's Mindlin recommended. Value is usually commensurate with the money spent on and resources devoted to protecting that data.

\n\n

"How much is your data worth, and how much are you willing to spend to protect it?" he said. "Sometimes, people don't understand what their data is worth, and that is a different problem."

\n\n\n","article_image_uid":"https://dxfpracgmlczp.cloudfront.net/2019/12/1575268943189_abstract-art-blur-bright-373543.jpg","article_expanded_image_uid":null,"article_image_caption":"Article by Albert McKeon, TechTarget","publications":"5","tags":"edge computing","category":"Others"}],"pageInfo":{"hasNextPage":false,"hasPreviousPage":false,"totalCount":2,"totalPages":0,"currentIndex":0}}}}