In depth

In March 2020, the IMDA launched the IoT Cyber Security Guide ("Guide") to provide guidance for enterprise users and vendors on deploying IoT technology in a secure manner. The Guide covers cyber security aspects of IoT systems in the acquisition, development, operation and maintenance of these systems.

To further support the Real Estate Industry Transformation Map, the Building and Construction Authority, with the IMDA's support, is transforming the Facilities Management ("FM") industry through the adoption of smart FM systems. In this vein, the IMDA proposed Annex C with a case study on smart buildings, which is premised on threat modelling.

Further, the IMDA stresses the importance of businesses (1) conducting threat modelling on a frequent and regular basis, including determining the appropriate model for threat modelling based on the business; and (2) regularly reviewing and adapting their security framework and policies.

Annex C provides high level, non-exhaustive details on five out of seven items from the threat modelling checklist provided in the Guide. A summary of each item is set out below.

Section 1: Identifying the target of protection

Annex C envisions a Target of Protection ("TOP") that has two system boundaries: (1) the Proximity Network ("PN"); and (2) the Commercial Building Network. The security needs of these assets, together with other assets identified (typically assets and data flows interconnected to an IoT Edge Gateway in the PN), will then be assessed with respect to the Confidentiality, Integrity, Availability triad.

Annex C also seeks to remind businesses that the three attributes of Operational Technology, Safety, Resilience and Reliability are important to the security of a Smart Building eco system. This is especially so if the device layer includes physical systems such as lift and escalators.

Section 2: Defining the security problem

Annex C identifies the concerns that contribute to system accessibility and system susceptibility for the assets under the TOP. Under each security problem, Annex C sets out the threats, vulnerabilities, operating environments and assumptions to define the security problem.

As an illustration, taking the IoT Cloud as an asset, Annex C considers the following: 

(a) In relation to system accessibility, attack surfaces such as API calls, HTTPS traffic, storage SW, memory, VM, OS, firmware, middleware, server software, having regard to all stages of the system lifecycle.

(b) In relation to system susceptibility, reference to "OWASP® Top 10 Application Security Risks" and scanning for relevant known vulnerabilities from prominent vulnerability repositories such as https://www.cve.org/. 

Section 3: Conducting a risk assessment

Annex C highlights that any risk assessment is context sensitive. In this case, Annex C first provides assessments in relation to (1) system accessibility and susceptibility and (2) attacker capability, with the risk classified as high, moderate and low, according to the given rationale. Next, the checklist provides for an assessment of priority for mitigation of the threats for each asset, with holistic considerations for the above-mentioned factors.

As an illustration, taking the same asset of an IoT Cloud, system accessibility would be rated as 'high' because it is hosted in a public cloud. Similarly, system susceptibility would be rated as 'high' because it may contain certain vulnerabilities.

Regarding the attacker capability, an IoT Cloud is also ranked as 'high' because it is valuable to a range of attackers (such as script kiddies, criminals, hacktivists and terrorists) who may have high capabilities and resources.

Taken together, this would place the IoT Cloud asset as a high priority item for mitigation in subsequent sections. 

Section 4: Defining Security Objectives

Annex C contemplates defining security objectives, which includes: (1) ensuring the confidentiality of sensitive data; (2) providing proper access controls; (3) ensuring the integrity of the system; and (4) preventing multitenancy from compromising security, among others.

Section 5: Defining Security Requirements

A template of common security considerations for vendors is provided. Businesses must determine the appropriateness and applicability of the checklist and adjust according to their needs. Annex C also highlights the commercial practice of having a technology solution provider elaborate on how they address the listed security requirements in Section 4.

Commentary

The proliferation of the internet and technology now means that data from a traditionally isolated building's operational technology network is available to businesses to aid in the decision making process. However, this also means that these networks are exposed to common IoT vulnerabilities. Reference to Annex C provides a starting point for businesses in the FM industry with smart systems to reevaluate their cyber security needs and infrastructure.

The IMDA has noted that Annex C is a case study to illustrate good practices for voluntary adoption. We would be happy to provide you with advice tailored to your specific needs on how to better protect your cyber security objectives.

For further information and to discuss what this development might mean for you, please get in touch with your usual Baker McKenzie contact.

*****

© 2022 Baker & McKenzie.Wong & Leow. All rights reserved. Baker & McKenzie.Wong & Leow is incorporated with limited liability and is a member firm of Baker & McKenzie International, a global law firm with member law firms around the world. In accordance with the common terminology used in professional service organizations, reference to a "principal" means a person who is a partner, or equivalent, in such a law firm. Similarly, reference to an "office" means an office of any such law firm. This may qualify as "Attorney Advertising" requiring notice in some jurisdictions. Prior results do not guarantee a similar outcome.