Cloud & IoT Security: Threats, Protocols, and Real-World Risks

TAKEAWAYS:

• Cloud security relies on shared responsibility models (e.g., AWS vs. customer) and zero-trust architectures to mitigate insider threats and data breaches.
• IoT devices are inherently insecure due to weak authentication (default credentials) and lack of patch management, making them prime targets for botnets (e.g., Mirai).
• Encryption (TLS, IPsec) and access controls (role-based, MFA) are critical for securing cloud-to-device traffic, but key management remains a weak link.
• Regulatory compliance (GDPR, NEPSE’s data protection laws) and end-to-end encryption (e.g., WhatsApp) are non-negotiable for financial/IoT transactions.
• Supply chain attacks (e.g., SolarWinds hack) exploit third-party vendors to compromise cloud providers, requiring vendor risk assessments.
• Edge computing (e.g., NTC’s 5G towers) shifts security to distributed nodes, requiring lightweight cryptography (e.g., AES-128) to balance performance and security.

1. Cloud Security: Models, Threats, and Countermeasures

Cloud security is a shared responsibility between providers (e.g., AWS, Google Cloud) and customers. The three service models differ in who controls security:

Key Threats in Cloud Environments

Countermeasures

• Encryption: Use TLS 1.3 for data in transit and AES-256 for data at rest (e.g., Ncell encrypts SMS traffic with TLS).
• Zero-Trust Model: Assume breach; enforce multi-factor authentication (MFA) and least-privilege access (e.g., Khalti’s API keys rotate every 24 hours).
• Isolation: Virtual Private Clouds (VPCs) segment cloud resources (e.g., NEPSE’s trading servers are isolated from public APIs).
• Compliance: Follow ISO 27017 (cloud-specific security standards) or Nepal’s Data Protection Act (2075) for financial data.

WORKED EXAMPLE: Calculating Cloud Cost vs. Security Risk Scenario: A startup uses AWS S3 to store customer payment data. The provider encrypts data at rest, but the startup must:

1. Enable S3 Object Lock to prevent deletion for 7 years (compliance with Nepal’s Payment Systems Act).
2. Use AWS KMS to manage keys (cost: $1/user/month).
3. Implement VPC Flow Logs to detect unusual traffic (cost: $0.05/GiB).

Calculation:

• Storage cost: $0.023/GB (first 50TB).
• KMS cost: 50 users × $1 = $50/month.
• Flow Logs: 10TB/month × $0.05 = $0.50/month. Total: ~$50.50/month for basic compliance.

2. IoT Security: Devices, Networks, and Attack Vectors

IoT devices (e.g., smart meters, Pathao’s GPS trackers) are high-risk due to:

• Default credentials (e.g., "admin:admin" on 30% of IoT devices).
• No built-in security updates (e.g., NTC’s old routers lack firmware patches).
• Sensory data exposure (e.g., Daraz’s warehouse sensors transmitting unencrypted telemetry).

IoT Security Layers

Common IoT Attacks and Mitigations

WORKED EXAMPLE: Securing Pathao’s GPS Fleet Problem: Pathao’s 500+ vehicles transmit GPS data via unencrypted MQTT (Message Queuing Telemetry Transport), vulnerable to spoofing. Solution:

1. Encrypt MQTT traffic with TLS 1.3 (cost: $0.002/message).
2. Use IoT certificates (each vehicle has a unique X.509 cert).
3. Rate-limit GPS updates to 10/sec/vehicle (prevent DDoS). Result: Reduced spoofing attempts by 90% (verified via NTC’s traffic analytics).

sequenceDiagram
    participant Hacker as Attacker
    participant Device as IoT Device (e.g., NTC Traffic Camera)
    participant C2 as Botnet C2 Server
    participant Cloud as Cloud Security (NTC Analytics)
    Hacker->>Device: Brute-force (admin:admin)
    Device-->>Hacker: Credentials stolen
    Hacker->>C2: Register device
    C2->>Device: DDoS payload
    Device->>Cloud: 90% spoofing blocked (rate-limiting)
    note right of Device: Mitigation: X.509 certs + 10/sec GPS limit

3. Encryption in Cloud and IoT: TLS, IPsec, and Key Management

TLS (Transport Layer Security) for IoT/Cloud

• Handshake Process:

  sequenceDiagram
      participant Client
      participant Server
      participant CA
      Client->>CA: Request public key
      CA-->>Client: Public key (certificate)
      Client->>Server: "Hello" + cipher suite
      Server->>Client: Server cert + encrypted pre-master secret
      Client->>Server: Decrypted pre-master secret
      Client->>Server: Finished (symmetric key established)

• Use Case: eSewa’s mobile app uses TLS 1.3 to encrypt payment tokens before sending them to banks.

IPsec for IoT Networks

• Security Associations (SA) define:
  • Encryption algorithm (AES-128/256).
  • Authentication method (HMAC-SHA256).
  • Key lifetime (e.g., 1 hour).
• Example: NTC’s VPN for remote fiber nodes uses IPsec to encrypt traffic between towers.

WORKED EXAMPLE: IPsec SA Database for NTC NTC’s 100 fiber nodes each have an IPsec SA with:

• Phase 1 (IKEv2):
  • Encryption: AES-128.
  • Auth: SHA256.
  • Key lifetime: 8 hours.
• Phase 2 (ESP):
  • Payload: Encrypted IP packets.
  • Anti-replay: 32-bit sequence numbers.

Calculation:

• SA overhead: 20 bytes per packet (1% of 2KB MTU).
• Rekeying cost: 100 nodes × 2 rekeys/day = 200 rekey operations/day.

+---------------------+---------------------+
| IP Header (20 bytes) | ESP Header (8 bytes) |
+---------------------+---------------------+
| Encrypted Payload   | ESP Trailer (8 bytes)|
+---------------------+---------------------+
| Integrity Check     | (AH if used)        |
+---------------------+

4. Regulatory Compliance and Standards

mindmap
  root((GDPR Principles))
    Lawfulness
    Purpose Limitation
    Data Minimization
    Accuracy
    Storage Limitation
    Integrity & Confidentiality
    Accountability

5. Edge Computing Security

Edge computing (e.g., NTC’s 5G base stations) shifts processing closer to devices, but introduces:

• New attack surfaces: Compromised edge nodes can bypass cloud security.
• Lightweight encryption: AES-128 is used instead of AES-256 to reduce latency.
• Trust models: Zero-trust for edge (e.g., Ncell’s 4G modems verify each other via IKEv2).

WORKED EXAMPLE: Securing NTC’s 5G Edge Nodes Challenge: 5G base stations must authenticate 10,000+ IoT devices per node. Solution:

1. Pre-shared keys (PSKs) for low-power devices (e.g., smart meters).
2. Ephemeral certificates for high-risk devices (e.g., Pathao’s GPS).
3. Rate-limiting: Block >100 failed auth attempts/IP.

+---------------------+       +---------------------+
|   Cloud Data Center |<---->|       Edge Node      |
+---------------------+       +---------------------+
                                      |
                                      v
+---------------------+       +---------------------+
|   IoT Device (e.g., |<---->|   Pathao GPS Tracker |
|      Smart Meter)   |       +---------------------+
+---------------------+

In the Real World

1. eSewa’s Cloud Security:
   • Idea: Uses AWS KMS for key management and TLS 1.3 for payment transactions.
   • Why it matters: Prevents MITM attacks on mobile wallets (e.g., blocking fake "bank verification" SMS).

2. Daraz’s IoT Warehouse Security:

   • Idea: Deploys IPsec VPNs between warehouse sensors and cloud inventory systems.
   • Why it matters: Stops supply chain spoofing (e.g., fake "low stock" alerts to divert goods).

3. NTC’s 5G Edge Security:

   • Idea: Implements IKEv2 for device authentication and AES-128 for edge traffic.
   • Why it matters: Reduces latency while blocking botnets (e.g., Mirai variants targeting IoT routers).

Exam Tip

1. Compare Cloud vs. IoT Security:

   • Cloud: Focus on shared responsibility, zero-trust, and compliance (e.g., GDPR).
   • IoT: Focus on device hardening, lightweight crypto, and supply chain risks.

2. Diagrams Are Your Friend:

   • Always draw cloud service models (IaaS/PaaS/SaaS) and IoT attack flows (e.g., Mirai).
   • Label IPsec SA parameters (e.g., "AES-128 + SHA256").

3. Real-World Tie-Ins:

   • For cloud, link to eSewa’s breach (weak APIs) or NEPSE’s compliance (ISO 27017).
   • For IoT, cite Pathao’s GPS spoofing or NTC’s router vulnerabilities.

4. Key Terms to Memorize:

   • Zero-trust, IKEv2, ESP/AH, GDPR’s "right to erasure", Mirai botnet.
   • Avoid: Vague answers like "use encryption"—specify TLS 1.3 or AES-256.

5. Calculation Questions:

   • Expect cost-benefit analyses (e.g., "How much does IPsec add to NTC’s fiber traffic?").
   • Use MTU overhead (20 bytes for IP + 8 bytes for ESP = 28 bytes extra per packet).

Final Warning: Examiners hate answers that say "security is important." Instead, name the threat (e.g., "default credentials in IoT devices enable Mirai botnets") and provide a mitigation (e.g., "enforce MFA via IKEv2").