Defining the IoT

We arrive then at the problem of how to define the IoT and how to distinguish the IoT from today's internet of, well, computers. The IoT is certainly not a new term for mobile-to-mobile technology. It is far more. While many definitions of the IoT exist, we will primarily lean on the following three throughout this book.

The ITU's member-approved definition defines the IoT as follows:

"A global infrastructure for the information society, enabling advanced services by interconnecting (physical and virtual) things based on existing and evolving, interoperable information and communication technologies."

The IEEE's small environment description of the IoT is as follows:

"An IoT is a network that connects uniquely identifiable 'things' to the internet. The 'things' have sensing/actuation and potential programmability capabilities. Through the exploitation of the unique identification and sensing, information about the 'thing' can be collected and the state of the 'thing' can be changed from anywhere, anytime, by anything."

The IEEE's large environment scenario describes the IoT as follows:

"The Internet of Things envisions a self-configuring, adaptive, complex network that interconnects things to the internet through the use of standard communication protocols. The interconnected things have physical or virtual representation in the digital world, sensing/actuation capability, a programmability feature, and are uniquely identifiable. The representation contains information including the thing's identity, status, location, or any other business, social or privately relevant information. The things offer services, with or without human intervention, through the exploitation of unique identification, data capture and communication, and actuation capability. The service is exploited through the use of intelligent interfaces and is made available anywhere, anytime, and for anything taking security into consideration."

Each of these definitions is complementary. They overlap and describe just about anything that can be dreamed up and can be physically or logically connected to anything else over the internet or wireless networks. Regardless of definition nuances, the services that the IoT provides to a business, government, or private citizen are the truly valuable aspects of the IoT that we must assure. As security practitioners, we must be able to understand the value of these services and ensure that they are kept available and secure.

Defining cyber-physical systems

Cyber-Physical Systems (CPSes) are a huge, overlapping subset of the IoT. They fuse a broad range of engineering disciplines, each with a historically well-defined scope that includes the essential theory, lore, application, and relevant subject matter needed by their respective practitioners. These topics include engineering dynamics, fluid dynamics, thermodynamics, control theory, digital design, and many others. So, what is the difference between IoT and CPS? Borrowing from the IEEE, the principal difference is that a CPS—comprising connected sensors, actuators, monitoring and control systems—does not necessarily have to be connected to the internet. A CPS can be isolated from the internet and still achieve its business objective. From a communications perspective, the IoT is comprised of things that, necessarily and by definition, are connected to the internet and, through some aggregation of applications, achieve some business objective:

The CPS, even if technically air-gapped from the internet, will almost always be connected in some way to the internet, whether through its supply chain, operating personnel, or out-of-band software patch management system. On-going research in the field of cybersecurity continues to demonstrate effective methods of jumping air-gaps to compromise isolated systems. 

It is worthwhile to think of the IoT as a super-set of CPSes, as CPSes can be enveloped into the IoT simply by connectivity to the internet. A CPS is generally a rigorously engineered system designed for safety, security, availability, and functionality. Emergent enterprise IoT deployments should take note of the lessons learned through the engineering rigor associated with CPSes. For more information on building resilient CPSes, consult the National Institute of Standards and Technology (NIST) Framework for Cyber Physical Systems (https://s3.amazonaws.com/nist-sgcps/cpspwg/files/pwgglobal/CPS_PWG_Framework_for_Cyber_Physical_Systems_Release_1_0Final.pdf) and its related efforts to the IoT-Enabled Smart Cities Framework and others (https://www.nist.gov/el/cyber-physical-systems).