gsa - mckinsey collaboration christian knochenhauer ... · collaboration between gsa and mckinsey...
TRANSCRIPT
GSA - McKinsey collaboration
Security in the Internet of Things
Christian Knochenhauer, McKinsey & Company
The IoT is considered to be a key growth driver for the semiconductor industry in the coming years – and security is the key challenge to overcome
SOURCE: McKinsey and GSA IoT survey (n=229; VP-level+ executives from semiconductor companies); iSuppli; Gartner; IDC; expert interviews; McKinsey Global Institute; GSA and McKinsey & Company “IoT collaboration”
What are key challenges to overcome for success in IoT?
Survey results from 2015 GSA-McKinsey IoT Industry perspective
Key challenges in the IoT for the semiconductor industry
2000 - 2007
2007 - 20152015 – 2020+
3% p.a. 4% p.a.
Average industry revenue growth
3 - 5% p.a.
Key growth drivers
Personal com-puting/internet
Wireless com-munications Internet of Things
Current trends
… and IoT is likely to pick up• Considered most important growth
driver by many executives
• IoT installed base to grow by 15-20% p.a. to 26-30bn devices in 2020
• Economic impact > USD 2 tr in 2025
Wireless as key growth driver will slow down…
▪ Security issues#1
▪ Low customer demand / lack of “lighthouse applications”
#2
▪ Lack of common standards#3
• PCs
• Laptops
• Servers
• Smartphones
• Network infrastructure
• Smart home
• Wearables
• Healthcare
• Industrial
• Connected car
• Cloud/big data
• 16% growth p.a. 2009 - 13
• Market maturity expected to slow growth down to 3% p.a. 2014 - 18
McKinsey and the Global Semiconductor Alliance have jointly assessed challenges and opportunities from “Security in the Internet of Things”
1 Daniel Artusi, VP & GM Connected Home Division, Intel Corporation; Vivek Bhan, SVP Engineering, Dialog Semiconductor; Stan Boland, CEO, FiveAI; Graham Budd, COO, ARM; Guillaume D’Eyssautier, Executive Chairman, sureCore; Thomas Fitzek, VP Chip Card & Security Division, Infineon; Dr. Udo-Martin Gómez, CTO, Bosch Sensortec; Dr. Georges Karam, President and CEO, Sequans Communications; Dr. Maria Marced, President, TSMC Europe (GSA EMEA Leadership Council Chairwoman); Sami Nassar, VP Cybersecurity Solutions, NXP Semiconductors; Svein-Egil Nielsen, CTO, Nordic Semiconductor; Dr. Yannick Levy , VP Corp. Business Development at Parrot, was a member of the Steering Committee until his death in January 2017
Collaboration between GSA and McKinsey to develop a perspective on the implications of IoT for the semiconductor industry
Interviews with 30 C-level executives from broader IoT ecosystem, complemented by surveyof semiconductor executives
2016 deep-dive on IoT Security 2015 GSA/McKinsey collaboration on IoT
Final report published jointly in report and in MoSC, extensive material available
Numerous industry presentations and discussions e.g., GSA EMEA Executive Forum, IMEC, ARM Conference Korea, and many more…
• Continued collaboration between GSA and McKinsey on "Security in the IoT"
– Assessment of security-related challengesfor semiconductor companies
– Identification of opportunities for monetarization on security features
– Focus on 3 industry verticals: Automotive, Industrial, and Smart Buildings
• Monthly GSA Steering Committee with 10 C-level executives from major semi players1
• 30+ C-level executive interviews and survey with > 100 industry experts
• Industry conference on “Security in the IoT” with 70+ industry executives on Nov. 8 in Munich
• Semiconductor challenges with security in the IoT
• Vertical-specific challenges – short teaser on automotive
• How to focus as a semiconductor company: Value creation opportunities
Topics for today
According to our research, the challenges in IoT security liealong 4 dimensions for semiconductor players
Gap in technical sophistication
Immature security standard landscape
1
2
$ 4 Challenging monetization of security by semiconductor players
?
3 Strong demand for security, but missing transparency on value add
Challenges are similar across verticals, but root causes differScale1: 0 = Not challenging/irrelevant; 3 = most challenging/relevant
Automotive
Industrial
Smart Buildings
1 Center scaled to 1 in graphic
Gap in technical sophistication
Sophistication of currently available technology is insufficient
End-2-end security of system solutions insufficient due to wide technical variety and legacy components
1a
1b
Immature security standard landscape
Competing large players are fighting to establish proprietary ecosystems
Existing standard setting bodies' roadmaps far behind pace of technological advancement
There is uncertainty about howstandards/regulations are going to be set and by who
2a
2b
2c
1 2
1a
4a 3a
2a
2c
1b
2b
3b4b
$Customer's willingness to pay for enhanced security
4a
Players owning control points up the stack exert commoditization pressure
4b
4 Challenging monetization of security by semiconductor players
Customers of semiconductorplayers do not value security enough
3a
End users do not value security enough
3b
?3 Strong demand for security, but missing transparency on value add
End-2-end solution security currently insufficient due to challenges in securing complex systems of individual components
3. OEMs/component players have little leverage on overall system security• OEMs often do not consider security as
differentiating factor• Focus on own product / individual
component limits ability to solve security for the entire complex system
2. System operators / integrators have limited resources and expertise• Weakest link in system determines its
overall security• Defenders need to secure own system
against all different attack vectors• Usually can’t match expertise of
attackers across every single threat and individual components
1. Attackers are highly specialized• Highly specialized on
one specific attack vector that they exploit across all potential targets
• Focus on the weakest link that can be attacked at the lowest effort/cost
1CHALLENGES - GAP IN TECHNICAL SOPHISTICATION
Attackers usually choose the cheapest of several possible attacks –Single component view may lead to wrong conclusions on end-2-end security
60
500
40
30
20
10
0
50
70
5-10
Password guessing
5-10
EMA attacks
5-15
Evil network/ rerouting
Smartcard hacking
80-500
Password snooping/ fingerprint cloning
Malicious mobileapp
5-15
Phishing
1-5
SS7 intercept/ tracking
5-15
10-40
5-15
E-mail virus
20-50
Web drive-by
Remote attack vectors Attacks from local network
Local attacks (non-intrusive)
Local attacks (intrusive)
Attack effort
Thousand EUR, consumer examples
SOURCE: Expert interviews
1CHALLENGES - GAP IN TECHNICAL SOPHISTICATION
SW infrastructure/ framework1
Application layer
SW infrastructure and apps
IndustrialAutomotive Smart Buildings
Apple Homekit
MQTT7
(e.g. EVRYTHNG)
GE Predix
Wireless HART
CCC2
Mirror Link
AndroidAuto3
Zigbee
Thread5
Siemens Mind-Sphere
Industrial Internet Consortium (IIC)
Samsung Smart-Things
IEEE IoT Architecture Framework (P2413)
Open Connectivity Foundation (OCF)4IP500
Bluetooth, WLAN, IPv6, RFID, NFC, low-power wide-area (SIGFOX, LORA, RPMA), cellular8 (LTE CAT-M1, CAT-NB1, 3GPP Release 13) …
ConnectivityPhysical connection standard
Comm. Protocol
Standardization efforts are ongoing, but the landscape is still crowded with industry players competing for ecosystem controlIoT standardization efforts (examples)
SOURCE: Press clippings; company websites; GSA and McKinsey & Company “IoT collaboration”
1 Defined set of software functions that facilitate development of applications and interoperability of hardware; 2 Connected Car Consortium; 3 Part of the Open Automotive Alliance; 4 Merged with Allseen Alliance in 20165 Lead by Google, Samsung, Qualcomm, ARM, NXP; 6 Lead by AT&T, Cisco, IBM, GE, and Intel; 7 ISO messaging protocol for networks with limited bandwidth; 8 Cellular also provides middleware/infrastructure, e.g. authentication
NOT EXHAUSTIVE
Interest group
Open standard initiative
Industry player
2CHALLENGES - IMMATURE SECURITY STANDARD LANDSCAPE
Customers of semiconductor players with high security level requirements, but mostly not willing to pay a security premium
10th percentile
90th percentileAverage
Automotive Smart Buildings
Industrial “What premium are your customers willing to pay for the next tier of enhanced chip security?”
Higher than 20%
0% or even yearly ASP decline expected
10-20%
>0 - 10%
42%
15%
28%
15%
Break-ins need to be avoided at all cost
Occasional security breaks are acceptable
Technology needs to capture 98% of risks
Technology needs to avoid most common breaks (>90% of volume)
31%
7%
38%
23%
“What is the risk acceptance of your customers for the most common use cases?”
SOURCE: GSA industry survey, team analysis
3CHALLENGES - MISSING TRANSPARENCY ON VALUE ADD
Majority of security solutions are concentrated in software layers of the stack
Percentage of total response options (N=219)
Security is commonly seen as a “software problem”
“Companies think of software solutions only. There’s no perception that security needs to be embedded”
“Fingerprinting and hardware encryption are the only two value-add security products I see semi players offering”
“Security is a software-level problem. It always has been”
“Everyone has a role to play in the security value chain except semi”
Semiconductor players are not perceived as partner of choice to solve security by most market participants
100%
Connectivity companies
Suppliers of components (e.g., Tier 1)
Semiconductor companies
Security solutions providers
Independent consultants
25%
18%
18%
17%
22%
4
SOURCE: Expert interviews, GSA industry survey
CHALLENGES - MONETIZATION OF SECURITY BY SEMICONDUCTOR PLAYERS
• Semiconductor challenges with security in the IoT
• Vertical-specific challenges – short teaser on automotive
• How to focus as a semiconductor company: Value creation opportunities
Topics for today
High security of connected cars is required, while attackers have an inherent advantage by targeting the most vulnerable entry pointConnected car: potential threat vectors
Attackers can target multiple entry points
Key Store
Private Data
ECU
ECU
ECU
ECUAttack on Vehicle Bus (Injection/capture)
Malicious Firmware update
Malware Delivery ThruSpecial Encoding in music
HU
Exploiting Open SourceSoftware Vulnerabilities
Attack from Apps in mobile Device
Attack on Key/Certificate Stores
Compromised ECU Controlled by Virtual SW
CAN
I
II
III
▪ Malicious Firmware update: can be done OTA or directly via the car’s physical OBD port
▪ Attack from Apps in mobile Device: Apps with malicious code can access the infotainment system through a connectivity bridge (e.g. in-car WiFi, BT)
▪ Compromised Actuator Controlled by Virtual SW: Hacking into OEM server to negatively alter vehicle control software to the extent of taking control of critical ECUs
I
II
III
Threat scenarios
SOURCE: Harman, ABI research, expert interviews
AUTOMOTIVE VERTICAL DEEP-DIVE
It is currently unclear how a "security standard" should look like - A common pool of traffic situations is a possible solution
Automotive security standardization: unbound-condition standard
• “Security against a undefined set of harmful scenarios in a non-bounded environment”
• Currently unclear how to formulate or test • Would include setting a “minimum security
requirement” by authorities or common agreement
Threat vectors
Current automotive standardization: Fixed-condition measurements
• Based on meeting performance criterial in a defined test environment
• E.g., fuel consumption/emissions in test driving cycle on test station
Measurements
Possible Solution: industry agreement on a "common pool of traffic situations"• Pool defines a set of traffic situations tthat all autonomous vehicles need to cope with • Pool is regularly updated, OEMs guarantee compliance against pool • Solves liability challenge of OEMS, but needs social acceptance of "incomplete" security
AUTOMOTIVE VERTICAL DEEP-DIVE
• Are actively entering autonomous driving market from different starting point in value chain
• Have advantages in time-to-market and software capabilities
New entrants/digital attackers
Autonomous driving leading OEMs
• Have decided to offer leading edge ADAS/autonomous driving systems and are actively pushing technology development
Fast follower OEMs
Automotive OEMs are likely to play different roles in shaping the security standards of autonomous cars
• Are expected to adopt technology when proven and cost-efficient
• Focusing on specific features for their customer segment
… leading to two most likely scenarios
• Major players continue pushing own standards, leading to a fragmentedtechnical solution space
• Industry standard consortium define common standards
• Standards are potentially co-developed with group of selected OEMs
• Ad Hoc consortiae of few OEMs are formed (e.g. mapping company HERE)
• Likely followed by standard setting by industry consortium/ legislator through co-development
• Other, e.g. new entrants define standards first and develop sufficient scale quickly enough
Different scenarios are possible on who will define the technical and security standards for autonomous driving
SOURCE: expert interviews, GSA industry survey
20
14
32
34Dominantplayers
Industrystandardsconsortium
Group ofselectedplayers
Other1
1 Including government, new entrants
Scenario likelihood, percent
AUTOMOTIVE VERTICAL DEEP-DIVE
Security in itself has no "value" and is hard to monetize, unless positioned as enabler of optional features
Security: 0 €
ADAS/autonomous driving : 3000-5000 €
Value of option for a new premium car
• Security of a car is hygiene factor for end customers
– “Must have”, not a distinguishing factor
– Zero willingness to pay
• OEMs apply “net zero” logic on all costs
– Material costs for any car model are fixed and cannot increase for new versions
– For any new generation, components need to either have decreasing cost or new features
– Any new component’s cost needs to be saved somewhere else in the car
• Price added for driver assistance systems currently is 3,000-5,000 EUR/car(over lifetime), to be expected constant for autonomous vehicles
• Cybersecurity is one recognized cost element enabling these features
– OEMs have recognized need to attribute cost to this new element
– 50-150 EUR/vehicle (over lifetime) depending on features currently estimated realistic “cybersecurity cost”
AUTOMOTIVE VERTICAL DEEP-DIVE
• Semiconductor challenges with security in the IoT
• Vertical-specific challenges – short teaser on automotive
• How to focus as a semiconductor company: Value creation opportunities
Topics for today
Semiconductor players can monetize on IoT security through innovation, expansion beyond the core business models and a sharpened value propositionImplications/themes from GSA industry survey and expert interviews
Formulate the value proposition sharperDevelop tailored security technology
Core technology business
Expand into adjacent business areas and new business models
• Close the gap to hackers for high-security use cases
• Develop “good enough” technology hitting price point and requirements for standard applications
• Convince customer of value created rather than try to find requirements and deliver against those
• Find tangible measures to create awareness with customers
• Address issues currently unresolved in the stack e.g., leveraging partners
• Enhance the addressed value pool beyond the value of devices
Increase willingness to pay by creating greater transparency on security level?
▪ Est. 1997 as a voluntary vehicle safety rating system today seen as the “quasi standard”
▪ Publishes reports on new cars and awards “stars ratings” based on performance in a variety of crash tests
▪ Supported by EU Commission and various EU governments
▪ Energy consumption labeling scheme est. by EU Directive for e.g., white goods and light bulbs
▪ Energy efficiency of appliance rated in classes ranging from A+++ to D
▪ Needs to be shown on sale display alongside the products price
Classification for features not directly observable by end users common in other industries
IEEE IoT Security Rating
Basic security
▪ Great demand for high security as confirmed in survey
▪ Willingness to pay increases with higher transparency on security
▪ Would it be possible to capture value with an IoT security seal?
Value creation potential through application to IoT
Thank you for your attention!
There is much more content in our report –don't forget to take your personal copy!