When we created Enea Aptilo IoT CCS, we knew we would disrupt the Cellular IoT industry, and now we have some evidence.
This is a very broad award category, where we compete with solutions of many different kinds, so just being shortlisted is already feeling like a win for us. Fingers crossed for December 6 in London.
Mobile Breakthrough Annual Awards Recognizes Top Mobile and Wireless Companies and Solutions Around the Globe.
Mobile Breakthrough, is a leading independent market intelligence organization that recognizes the top companies, technologies, and products in the global wireless and mobile market today.
The Enea Aptilo IoT Connectivity Control Service (IoT CCS) is the industry’s first hyperscale connectivity control solution to manage security, policy, and automation for cellular IoT. Hosted as a service on Amazon AWS and delivered as a unique instance per mobile operator, on top of what they already have, new innovative IoT services can be created fast.
Mobile operators can easily tailor IoT connectivity services to the specific needs of different customer types, while business customers can manage their IoT services in a self-management portal enabled by Enea’s extensive APIs. Importantly, the IoT CCS also reduces the cost of daily operations.
With IoT CCS, mobile operators can provide a Multitenancy Private APN. The IoT traffic is routed to IoT CCS through a single secure IPsec tunnel and then separately routed to multiple enterprises through secure Enterprise VPNs. The mobile operator needs only to provide a standard signaling interface to enable IoT CCS to act as the “mobile core” for IoT.
The operator’s self-management portals, enabled by IoT CCS, allow their customers to control IP assignment, authentication, security, policies, and global connectivity from a single user interface. Through their customer self-management portals, mobile operators can automate the setup of VPNs without having to create a unique APN for each customer.
“The traditional way to build everything from the ground up no longer works with the modern way of thinking – that is, maximizing current investments by adding services delivered from the cloud to what you already have. This is the sweet spot for our IoT connectivity services,” said Johan Terve, Senior Director of Marketing at Enea. “Aptilo IoT CCS adds a flexible, smart, and secure IoT connectivity control layer on top of any current and future mobile core. Operators can deliver innovative IoT services in days rather than months, at a fraction of the alternative cost. Our mission is to provide game-changing and secure IoT connectivity, for operators that want to innovate in the IoT era.”
The mission of the annual Mobile Breakthrough Awards is to honor excellence and recognize innovation, hard work, and success in a range of mobile and wireless technology categories, including Cloud Computing, Mobile Management, Wireless and Broadband, Mobile Analytics, IoT, Smart City, and many more. All nominations were evaluated by an independent panel of experts within the wireless industry.
“Usually, operators’ mobile core and OSS/BSS teams prioritize stability before being fast on their feet, implementing every change requested by demanding customers. Mobile operators also typically offer Private APNs to their IoT enterprise customers, with the traffic terminated in an Enterprise VPN,” stated James Johnson, managing director, Mobile Breakthrough. “With IoT CCS, mobile operators can free themselves from these limitations. It gives them the freedom to innovate IoT services that were impossible to achieve in a strict 3GPP environment. We’re so pleased to award Enea and their breakthrough IoT CCS with the highly competitive ‘ IoT Platform of the Year’ award.”
Additionally, with IoT CCS, mobile operators can offer a private, secure global SD-WAN to each enterprise customer rather than a Private APN. Enterprise IoT customers can also include trusted partner companies in this secure SD-WAN.
Along with IoT CCS, mobile operators’ enterprise IoT customers receive FortiGate, a next-generation firewall from Fortinet, to protect their devices with the settings and policies they need. Lastly, mobile operators can add international MNO partners or the global connectivity hub functionality to their IoT CCS instance and provide a unified IoT connectivity service even if eSIMs have been localized.
This is an excerpt from our white paper Hyperscale Cellular IoT. The full white paper is available here if you like what you read. Don’t hesitate to contact us if you have any questions.
Ronen Shpirer, Director of 5G Solutions Marketing at our partner Fortinet has contributed this text. If you haven’t already, please read our blog post about Cellular IoT Security threats first.
You cannot overestimate the importance of a secure IoT solution. Security is often considered the factor most likely to inhibit both the development of IoT services and their adoption.
The potential impact of a successful cyberattack on an IoT ecosystem may cause failure in critical services and industries and even physical danger to individuals and the environment. It is, therefore, crucial that IoT solution providers show a commitment to providing a service that is secure by design.
IoT solutions encompass many layers, including the devices themselves, but also on-premises gateways, access networks, service platforms, application servers, and internet access gateways. Attacks come in many forms; any of these components could be a target or a steppingstone to a higher-valued target.
Security is not simply a hardened device operating system (OS) or an encrypted access link. It is a multi-layered solution that encompasses everything from the initial boot of the device to distributed denial-of-service (DDoS) protection at the network edge.
A significant hurdle in protecting IoT environments is having visibility of devices and traffic. This is the basis for any anomaly detection but also allows teams to verify that all is well in the network.
The goal should be to stop attacks before they can compromise the device. But where an attack gets through defenses, IoT security solutions must be able to detect signs of this and act immediately.
If attackers gain control over a device, they may cause severe damage, including:The consequences of compromised devices will vary. Compare water pump versus heart pump or streetlight versus traffic light. However, the pure volume of IoT devices will make attacks on non-life-critical devices very severe.
Next-generation firewalls must protect IoT traffic. Here we will give some examples of the role of a firewall showcased by FortiGate, Fortinet’s next-gen firewall, which is included in the Enea Aptilo IoT Connectivity Control Service™ (IoT CCS).
In a typical IT environment, traffic to unauthorized destinations may be common because of many reasons, and such communications are normally simply dropped. But in IoT and other machine-to-machine networks, such communications are usually a sign of misconfiguration or of compromised devices. For this reason, specific negative rules should be configured in a firewall with appropriate action to ensure that it generates an alert or it trigger automatic remediation.
Next-generation firewalls such as Fortinet’s FortiGate also feature intrusion prevention capabilities designed to detect and block a wide range of different IoT attacks. This includes protection against the aforementioned scanning attacks, exploits, fuzzing attacks, and more.
The FortiGate intrusion prevention system (IPS) function, which contains over 30,000 rules, including an optional industrial package. Rule packages are updated daily to ensure that protection is up to date.
Application Control can monitor or limit the protocols that the IoT device can use. Any unauthorized protocols can generate an alert and optionally be blocked. With FortiGate, application definitions include over 4,000 application rules in 24 categories. FortiGate covers all commonly used IoT protocols such as MQTT, AMQP, HTTP, and CoAP, and as for IPS, it can use TLS inspection with an appropriate configuration. A wide range of industrial protocols is also available for Industrial Internet-of-Things (IIoT) solutions.
Antivirus is important today mainly for the IoT infrastructure, such as the platform or web servers. But researchers expect that malware attacking the devices themselves—such as with the Mirai IoT malware, perhaps the most famous current example, will become more prevalent in the years to come.
FortiGuard Labs has almost 20 years of experience defending against malware of all types, and although device-targeted malware is rare today, the needed research is already underway to ensure that protection of the highest quality will be ready
Any botnet activity, whether detected by destination address, domain, or protocol, can generate an alert and be blocked. Furthermore, connections to other known bad destinations, as detected by the FortiGuard Indicators of Compromise Service, can generate a compromised alert. FortiGuard Labs maintains an updated list of known botnet destination address/port combinations that are checked against all outgoing sessions.
Botnets using fast-flux domains (in which a domain continually changes its IP address mapping) can be checked against the domain itself by intercepting and checking the Domain Name System (DNS) request. Finally, even if the destination address and domain are unknown, many botnets can be detected by their command-and-control protocol. By using these three methods in parallel, Fortinet ensures the best chance of detecting botnet-infected devices.
Fortinet has a comprehensive automation framework that allows a wide range of triggers to be linked to actions such as alerting, removing rogue devices from the network, or making API calls to other devices.
For example, any of the above detections can cause a device to be quarantined and blocked from further communications until the cause is established and remedial action is taken.
Policy-based control to send selected IoT traffic, such as software updates and analytics data, through VPNs.
This is an excerpt from our white paper Hyperscale Cellular IoT. The full white paper is available here if you like what you read. Don’t hesitate to contact us if you have any questions.
“With IoT comes a tremendous opportunity for mobile operators to sell managed security as a value-added service to Enterprise customers.”
IoT security threats make up a new challenge for enterprises. It is much more complex than traditional IT security:
Most enterprises do not have the resources to handle IoT security, so it is a potentially high-value service for mobile operators bringing additional revenue. Customers expect that their mobile operator adds a layer of protection. For more information on requirements, please read our blog post Cellular IoT Requirements.
The IoT platform is the critical heart of any IoT service, and in more extensive networks, the implementation may be a hierarchy of platforms. All signaling and data will pass through one or more platform nodes, so protecting them against attack is imperative.
In the following, we will explore some of the expected typical attacks.
IoT platforms may have vulnerabilities, just like any other software. In most cases, they will comprise coding bugs allowing buffer overflows and other memory corruptions, as well as unhandled corner cases. In addition, most IoT platform signaling is via some kind of application programming interface (API), so typical API attacks should be considered. Finally, data received by the platform will often result in a read or write to a database, so SQL attacks are also a threat to consider.
As in any service platform, you must expose only the minimum services and not leave unused services running (as they may be set by default).
For example, Server Message Block (SMB) services are often enabled by default and are also a common vector for attack. Always check open ports and disable or remove any unnecessary services from the system.
This is another method of finding vulnerabilities. It is usually done locally in a controlled environment but can be used as a blunt-instrument attack on a live network. Examples include deliberate protocol anomalies or the use of extremely long fields, or invalid or unusual data. Hackers use all of these techniques to trigger programming errors. The goal is to find vulnerabilities or simply to cause disruption.
Denial-of-service attacks (DoS) could come via external interfaces (if there are any) or from the IoT devices themselves. A simple device malfunction causing a cyclic registration can cause a massive DoS attack if many devices behave this way simultaneously.
When transport layer security (TLS) is used for end-to-end protection of the communication, there should be at least one security device that decrypts the traffic to ensure that the protected traffic is as expected. If this is not the case, a compromised IoT device could use the encrypted connection, and it would hide the malicious traffic from the operator. A security device co-located with the IoT platform may offload the TLS processing and send decrypted traffic directly to the platform. Otherwise, it should re-encrypt the traffic to ensure that eavesdropping is impossible.
Hackers may also attack the IoT devices themselves. Most IoT devices will have limited connectivity and just communicate with a few destinations. These destinations include the IoT platform and application servers providing other services, such as firmware upgrades or data storage. The narrow scope of communication limits the attack possibilities, but we should always assume that the IoT platform or any application servers may become compromised. Here, an attack launched from inside the local network may occur.
Below, we will explore what such attacks may comprise.
Although IoT malware is not prevalent today, it will become more so as threat actors realize a better return on investment (ROI) for choosing to attack IoT.
Some IoT devices have limited functionality, which reduces the probability of vulnerabilities. However, on the other side, IoT device functionality is often custom-developed. This may introduce bugs that wouldn’t be present in general-purpose components. And the limited functionality may also include a lack of security features such as the capability to send encrypted traffic or set up VPN tunnels. Also, the sheer breadth of device types means that, for instance, an agricultural soil monitor differs significantly from an autonomous vehicle, even though they are both labeled IoT. No matter the device, the enterprise must expect exploits and put protection in place.
If an attacker can send traffic to a device, it may be possible to conduct a DoS attack, especially for constrained devices. For IoT devices with low traffic levels, simple rate-limiting rules should be effective against such an attack.
As any device connected to the cellular network an IoT device stands the risk of being attacked through signalling protocols. Within Enea we have leading expertise in this area through the recent acquisition of Adaptive Mobile Security. Learn more in their blogpost Role of CyberTelecom / Network Security in High Value M2M and IoT Apps.
We are proud to announce that Enea Aptilo IoT CCS is a winner of the 2022 IoT Evolution Product of the year award. This is the tenth finalist and sixth industry award-win for IoT CCS, so our slightly cocky comment “Oops, we did it again!” is justified.
What makes Enea Aptilo IoT CCS such an award magnet? Well, it ticks all the boxes regarding uniqueness and innovation and brings game-changing opportunities for mobile operators and their IoT customers.
Enea Aptilo IoT Connectivity Control Service™ (IoT CCS) introduces a new solution category that has never been seen before—a hyperscale programmable layer for cellular IoT connectivity control, security, and automation. It is delivered as a unique instance per mobile operator, hosted on Amazon AWS. With IoT CCS, mobile operators (and MVNOs) can innovate from the cloud and create new IoT connectivity services previously considered unthinkable. They can do so instantaneously and for a fraction of the alternative cost with our pay-as-you-grow service model.
Mobile operators can automate the setup of VPNs and do not have to deal with the work of creating a unique APN for each customer. Our experience with IoT CCS deployments shows mobile operators can reduce their VPN onboarding process from many weeks to a few minutes, handled by their customers instead of by expensive operations resources.
With Aptilo IoT CCS, which includes Fortinet’s FortiGate next-generation firewalls as an integral part, the mobile operator’s customers can manage their own IoT security.
In our comprehensive white paper Hyperscale Cellular IoT, you will get all the details about Enea Aptilo IoT CCS, but that is only in the last chapter.
In chapters 1-2 we address all factors that made us realize that service providers must use hyperscalers and add a programmable layer of policy control, security, and automation. These insights led us to create IoT CCS in close cooperation with our first MNO customer.
Almost all IoT business is global and security is more important than ever, so those topics have their own chapters. Download our white paper now, to explore the wonderful world of Hyperscale Cellular Connectivity.