Search for:

Singapore: New Annex C of the IMDA IoT Cyber Security Guide

By , and 6 Mins Read

In brief

As part of its efforts to offer enterprise users and their vendors better guidance on deploying Internet of Things (“IoT“) technologies, the Info-communications Media Development Authority (“IMDA“) has published Annex C: Case Study on Smart Buildings (informative) (“Annex C“) to the IoT Cyber Security Guide. Annex C provides a starting point for businesses in the Facilities Management industry with smart systems to reevaluate their cybersecurity needs and infrastructure.

As part of the threat modelling checklist, Annex C recommends the following:

  1. Identifying the target of protection
  2. Defining the security problem with consideration of factors such as the threats, vulnerabilities, operating environment and assumptions
  3. Conducting a risk assessment
  4. Determining the security objectives
  5. Defining the security requirements by way of a vendor disclosure checklist

Importantly, users of the guide are reminded that they should customize the content in Annex C according to their business needs.

In depth

In March 2020, the IMDA launched the IoT Cyber Security Guide (“Guide“) to provide guidance for enterprise users and vendors on deploying IoT technology in a secure manner. The Guide covers cyber security aspects of IoT systems in the acquisition, development, operation and maintenance of these systems.

To further support the Real Estate Industry Transformation Map, the Building and Construction Authority, with the IMDA’s support, is transforming the Facilities Management (“FM“) industry through the adoption of smart FM systems. In this vein, the IMDA proposed Annex C with a case study on smart buildings, which is premised on threat modelling.

Further, the IMDA stresses the importance of businesses (1) conducting threat modelling on a frequent and regular basis, including determining the appropriate model for threat modelling based on the business; and (2) regularly reviewing and adapting their security framework and policies.

Annex C provides high level, non-exhaustive details on five out of seven items from the threat modelling checklist provided in the Guide. A summary of each item is set out below.

Section 1: Identifying the target of protection

Annex C envisions a Target of Protection (“TOP“) that has two system boundaries: (1) the Proximity Network (“PN“); and (2) the Commercial Building Network. The security needs of these assets, together with other assets identified (typically assets and data flows interconnected to an IoT Edge Gateway in the PN), will then be assessed with respect to the Confidentiality, Integrity, Availability triad.

Annex C also seeks to remind businesses that the three attributes of Operational Technology, Safety, Resilience and Reliability are important to the security of a Smart Building eco system. This is especially so if the device layer includes physical systems such as lift and escalators.

Section 2: Defining the security problem

Annex C identifies the concerns that contribute to system accessibility and system susceptibility for the assets under the TOP. Under each security problem, Annex C sets out the threats, vulnerabilities, operating environments and assumptions to define the security problem.

As an illustration, taking the IoT Cloud as an asset, Annex C considers the following: 

(a) In relation to system accessibility, attack surfaces such as API calls, HTTPS traffic, storage SW, memory, VM, OS, firmware, middleware, server software, having regard to all stages of the system lifecycle.

(b) In relation to system susceptibility, reference to “OWASP® Top 10 Application Security Risks” and scanning for relevant known vulnerabilities from prominent vulnerability repositories such as https://www.cve.org/. 

Section 3: Conducting a risk assessment

Annex C highlights that any risk assessment is context sensitive. In this case, Annex C first provides assessments in relation to (1) system accessibility and susceptibility and (2) attacker capability, with the risk classified as high, moderate and low, according to the given rationale. Next, the checklist provides for an assessment of priority for mitigation of the threats for each asset, with holistic considerations for the above-mentioned factors.

As an illustration, taking the same asset of an IoT Cloud, system accessibility would be rated as ‘high’ because it is hosted in a public cloud. Similarly, system susceptibility would be rated as ‘high’ because it may contain certain vulnerabilities.

Regarding the attacker capability, an IoT Cloud is also ranked as ‘high’ because it is valuable to a range of attackers (such as script kiddies, criminals, hacktivists and terrorists) who may have high capabilities and resources.

Taken together, this would place the IoT Cloud asset as a high priority item for mitigation in subsequent sections. 

Section 4: Defining Security Objectives

Annex C contemplates defining security objectives, which includes: (1) ensuring the confidentiality of sensitive data; (2) providing proper access controls; (3) ensuring the integrity of the system; and (4) preventing multitenancy from compromising security, among others.

Section 5: Defining Security Requirements

A template of common security considerations for vendors is provided. Businesses must determine the appropriateness and applicability of the checklist and adjust according to their needs. Annex C also highlights the commercial practice of having a technology solution provider elaborate on how they address the listed security requirements in Section 4.

Commentary

The proliferation of the internet and technology now means that data from a traditionally isolated building’s operational technology network is available to businesses to aid in the decision making process. However, this also means that these networks are exposed to common IoT vulnerabilities. Reference to Annex C provides a starting point for businesses in the FM industry with smart systems to reevaluate their cyber security needs and infrastructure.

The IMDA has noted that Annex C is a case study to illustrate good practices for voluntary adoption. We would be happy to provide you with advice tailored to your specific needs on how to better protect your cyber security objectives.

For further information and to discuss what this development might mean for you, please get in touch with your usual Baker McKenzie contact.

*****

LOGO_Wong&Leow_Singapore

© 2022 Baker & McKenzie.Wong & Leow. All rights reserved. Baker & McKenzie.Wong & Leow is incorporated with limited liability and is a member firm of Baker & McKenzie International, a global law firm with member law firms around the world. In accordance with the common terminology used in professional service organizations, reference to a “principal” means a person who is a partner, or equivalent, in such a law firm. Similarly, reference to an “office” means an office of any such law firm. This may qualify as “Attorney Advertising” requiring notice in some jurisdictions. Prior results do not guarantee a similar outcome.

Categories:
Author

Andy Leck is the head of the Intellectual Property and Technology (IPTech) Practice Group and a member of the Dispute Resolution Practice Group in Singapore. He is a core member of Baker McKenzie's regional IP practice and also leads the Myanmar IP Practice Group. Andy is recognised by reputable global industry and legal publications as a leader in his field. He was named on "The A-List: Singapore's Top 100 lawyers" by Asia Business Law Journal 2018. In addition, Chambers Asia Pacific notes that Andy is "a well-known IP practitioner who is highlighted for his record of handling major trade mark litigation, as well as commercial exploitation of IP rights in the media and technology sectors. He's been in the industry for a long time and has always been held in high regard. He is known to be very fair and is someone you would like to be in the trenches with you during negotiations." Furthermore, Asian Legal Business acknowledges Andy as a leading practitioner in his field and notes that he “always gives good, quick advice, [is] client-focused and has strong technical knowledge for his areas of practice.” Andy was appointed by the Intellectual Property Office of Singapore (IPOS) as an IP Adjudicator to hear disputes at IPOS for a two-year term from April 2021. He has been an appointed member of the Singapore Copyright Tribunal since May 2010 and a mediator with the WIPO Arbitration and Mediation Center. He is also appointed as a Notary Public & Commissioner for Oaths in Singapore. He previously served on the International Trademark Association’s Board of Directors and was a member of the executive committee.

Author

Ren Jun Lim is a principal with Baker McKenzie Wong & Leow. He represents local and international clients in both contentious and non-contentious intellectual property matters. He also advises on a full range of healthcare, as well as consumer goods-related legal and regulatory issues. Ren Jun co-leads Baker McKenzie Wong & Leow's Healthcare as well as Consumer Goods & Retail industry groups. He sits on the Law Society of Singapore IP Committee and on the Executive Committee of the Association of Information Security Professionals. He is also a member of the Vaccines Working Group, Singapore Association of Pharmaceutical Industries, a member of the International Trademark Association, as well as a member of the Regulatory Affairs Professionals Association. Ren Jun is ranked in the Silver tier for Individuals: Enforcement and Litigation and Individuals: Prosecution and Strategy, and a recommended lawyer for Individuals: Transactions by WTR 1000, 2020. He is also listed in Asia IP's Best 50 IP Expert, 2020, recognised as a Rising Star by Managing IP: IP Stars, 2019 and one of Singapore's 70 most influential lawyers aged 40 and under by Singapore Business Review, 2016. Ren Jun was acknowledged by WTR 1000 as a "trademark connoisseur who boasts supplementary knowledge of regulatory issues in the consumer products industry." He was also commended by clients for being "very responsive to enquiries and with a keen eye for detail, he is extremely hands-on. His meticulous and in-depth approach to strategising is key to the excellent outcomes we enjoy."

Author

Ken Chia is a member of the Firm’s IP Tech, International Commercial & Trade and Competition Practice Groups. He is regularly ranked as a leading TMT and competition lawyer by top legal directories, including Chambers Asia Pacific and Legal 500 Asia Pacific. Ken is an IAPP Certified International Privacy Professional (FIP, CIPP(A), CIPT, CIPM) and a fellow of the Chartered Institute of Arbitrators and the Singapore Institute of Arbitrators.

Related Posts

Write A Comment