The evolution of new IoT-based infrastructures in the society – challenges for the national security

This study was initiated because of the expected increase of Internet of Things (IoT) in our society, which will accelerate with the 5G deployment. IoT will be used to entertain us, make our everyday life more simple, cities more resource efficient, industries more cost efficient, and give us better public services. It may also give us an improved national defense. IoT are often complex systems consisting of multiple different technologies, such as wireless protocols, cloud services, big data and artificial intelligence. The increased use of IoT will result in new infrastructures, provide new abilities and characteristics to existing infrastructures, and it will be difficult to tell which of the infrastructures are critical. Increased IoT usage will provide many advantages, but it will also challenge our national security interests. We have through this research identified three basic challenges named increased data collection, larger attack surfaces and more complex infrastructures. IoT systems often gather detailed data from their users and/or environment, and these data are often sent abroad. Tests performed by us on some arbitrary consumer IoT products confirm this. It is difficult for the end user to protect herself from this data gathering, and it is an obvious challenge regarding both foreign intelligence and privacy. As IoT systems consists of multiple technologies and components, which may be located at different geographical areas, they will have a large attack surface. This increases its vulnerability regarding attacks on confidentiality, integrity and availability. IoT systems will be part of very complex infrastructures. This complexity is because of all the dependencies between the infrastructures, and the fact that they are dynamic. This makes them vulnerable, and is what we consider the greatest challenge with the increased IoT usage. As we see it, the development is driven by global commercial interests that are difficult to control. We have identified two important areas when it comes to meeting the challenges caused by the increased IoT usage. First is establishing methods for risk assessment of complex infrastructures. It is necessary to have an updated and correct risk picture when doing event handling and assessing various preventing measures for critical infrastructure and national safety. This must include the complexity and describe the uncertainty that obviously will be present. We do lack the necessary methods and knowledge to perform such risk pictures today. The second area relates to continuously develop and maintain knowledge within multiple disciplines. It will be essential to have methods for converting this knowledge into practice.