John Ansbach General Counsel, GDT January 8, #IoTISACA

Transcription

1 John Ansbach General Counsel, GDT January 8, #IoTISACA

2 Internet connected adult diapers Wireless sensors detect urinary events in incontinent seniors System stamps and stores the time and severity of the event, opening up the potential for a personalized care plan based on aggregated data

3 Forever changing the workplace and marketplace Very real and immediate impact Changes in information security, risk and risk mitigation, policy requirements, data storage and privacy The more you know about IoT the more prepared and effective you ll be

4 Agenda What is IoT? Examples of IoT Standards Developing issues with Cybersecurity & Privacy Next Steps

5 What is the Internet of Things?

6 The Internet of Things (IoT) is the network of physical objects accessed through the Internet. These objects contain embedded technology to interact with internal states or the external environment. In other words objects can sense and communicate [ ] chang[ing] how and where decisions are made, and who makes them. Source: Cisco

7 The term itself has been around since 1999 Kevin Ashton, a British technology pioneer who cofounded the Auto- ID Center at MIT, invented the term "the Internet of Things It was the title of a presentation he gave to execs at Proctor & Gamble He used IoT to describe a system where the Internet is connected to the physical world via ubiquitous sensors

8 IoT refers to the interconnection of uniquely identifiable embedded computing- like devices within the existing Internet infrastructure. Things, in the IoT, can refer to a wide variety of devices such as heart monitoring implants, biochip transponders on farm animals, automobiles with built- in sensors, or field operation devices that assist fire- fighters in search and rescue

9 IoT is emerging as the third wave in the development of the Internet the 1990 s fixed Internet wave connected 1 billion people the 2000 s mobile wave connected another 2B IoT has the potential to connect 10 times that by 2020

10 Almost a 5- fold increase in the # of IoT devices in 8 short years

11 We are here

12 Five IoT verticals of adoption, according to Goldman Sachs

13

14 Cisco CEO John Chambers estimates the potential market value of IoT at $19 trillion Other more conservatives estimates put the number shy of $10 trillion by 2020 Either way, the potential for extraordinary economic and financial growth driven by IoT will drive changes in nearly every industry, sector, location and 1 st world economy within the next 5-6 years

15 The Internet of Things has the potential to change the world, just as the Internet did. Maybe even more so. - - Kevin Ashton, writing in RFID Journal in 2009

16 What does IoT Look Like Today?

17 Consider the connected shoe.

18

19 The chip contains a cluster of tiny wells, about the size of a pinprick, which store the drug. Each well is sealed with an ultrathin layer of platinum and titanium At programmed times or at the patient's command, an external radio- frequency device sends a signal to the chip, which applies a voltage to the metal film, melting it and releasing the drug. The wells melt one at a time.

20 Google announced in July a partnership with Novartis to develop a connected contact lens with the potential to monitor the wearer s blood sugar levels The lens uses miniature sensors and a radio antenna thinner than a human hair to track glucose levels, which could then be monitored by smart phones Source: NY Times, July 15, 2014

21

22

23 Basically, if you can think of a thing, chances are someone is working on how to connect it to the Internet

24 Are there any? Do we need them?

25 So here s the problem: How do billions of devices made by th0usands of different manufacturers running on various different platforms and operating systems across numerous networks within multiple industries talk to one another securely and efficiently? Answer: standardization

26 Standards will enable more secure data processing, transmission and storage allow for measurement and monitoring of capabilities, success support data privacy efforts, requirements and regulation Truth be told, the questions isn t why standards? The question is, whose standards?

27 Dozens of consortiums, commercial alliances, and standards groups have been formed in the past few years of them profess essentially There are now literallyall thousands of the same goal: to speed the standards, created by hundreds ofiot, groups. growth of the by creating standards for, as There are even groups common that have been standards group AllSeen formed to bring the groups together. All Alliance outlines, have in common the desire to expedite the interoperable products that can discover, and growth of what some people thinkconnect, will be interact directly with of other the biggest and most lucrative wave nearby devices, systems, and technology since, well, ever. services regardless of transport layer, device type, platform, operating system, or brand.

28 Here s a short list of some of the groups and alliances working on IoT standards

29 IETF Internet Engineering Task Force IEEE Institute of Electrical and Electronics Engineers OneM2M IoT-GSI (Global Standards Initiative on IoT)

30 But wait, there s more

31 OMA (Open Mobile Alliance) IIC (Industrial Internet Consortium) AllSeen Alliance who s members include

32

33 By the way, just yesterday at CES 2015, AllSeen announced an additional new tool in the standards wars, it calls Alljoyn Gateway Agent

34 "The AllSeen Alliance believes that consumers should have control over these devices and their data - - with the assurance that these connections are both private and secure. The AllJoyn Gateway Agent is the industry's first standard way to connect IoT devices and applications with such confidence." The AllJoyn Gateway Agent enables four things that are critical for the fast- developing Internet of Things: remote access and management; security and data privacy; interoperability; and use of open standards, according to the AllSeen Alliance. It's an open- source software framework that's designed to connect devices "regardless of brand, transport, platform or operating system."

35 Eventually, standards will evolve for IoT. There won t be one standard to rule them all, but there will be broad reaching standards in certain industries (home and health) and for certain security or transmission protocols. We re not there now, however, and the longer that IoT develops without standardization the more risk and exposure there will be for enterprise and consumers.

36 The Downsides of Connectivity

37 "Everyone has the best intentions, and that's why this road to 'Internet of Things' is paved to hell," said Mark Stanislav, a researcher at Duo Security.

38 IoT represents some amazing opportunities for enterprise to lower costs, gain efficiencies and improve service and product offerings The downside of IoT is that all that connectivity and production of massive amounts of data (alongside a current lack of standards) dramatically increases the potential for cybersecurity intrusions and infringement upon privacy

39 The chip contains a cluster of tiny wells, about the size of a Recall the Microchips drugwhich store the pinprick, drug. delivery system from earlier Each well is sealed with an Failure to take medications as ultrathin layer of platinum prescribed causes 10 and titanium percent of hospital admissions and At programmed times or at 125,000 deaths the patient's command, an annually external radio- frequency device sends a signal to the chip, which applies a voltage But what could happen if to someone the metal film, melting it hacked the radio signal controlling and releasing tthe he drug. The device? What personal medical wells melt info one at a time. could be accessed?

40 Or in the workplace Forget about networked printers and iphones. What do you do when the coffee maker and refrigerator in the break room come equipped with hidden spambots and wifi access? Researchers have already hacked a building control system at Google s Australia office. Does that make you think twice about installing a Nest thermostat on your premises? What happens when workers watches and glasses even their suit coats and dress shoes are connected to the Net?

41 Companies are going to have to identify and address these issues aggressively as they embrace IoT both within their own workplaces and within their product and service offerings

42 As a starter, there are three areas that will require some new or additional attention in the IoT world: Customer facing privacy policies Internal Infosec policies (including BYOD and DocRetention) B2B commercial agreements (including cloud storage agreements)

43 Customer facing privacy policies Consider all of the data that will be generated by IoT sensors What info is collected, shared, stored, sold to others? Organizations not previously accustomed to having data will need to develop robust, compliant privacy policies that describe what data they view or collect and how they keep it private

44 Infosec, BYOD and DR Policies Companies are going to generate enormous amounts of data from IoT devices & sensors Where will they store it? For how long? Who will have access to it? How will it be secured? Organizations will need a written information security policy that answers these questions and tells others (business partners, regulatory agencies) how they plan to keep secure the volumes of data being generated

45 B2B commercial agreements (including cloud) In master services agreements or master products agreements, companies will need to consider what data is being generated in the work being performed or the services being delivered Address risk and liability in these agreements, given the IoT landscape, especially for data loss or data breach Who is responsible for securing what data, where and how? Already seeing an increasing number of agreements with new and enhanced requirements around security and data storage / handling

46 And don t forget big data s role in IoT cybersecurity and privacy

47 IoT data will be utilized to drive enterprise analytics Enormous amounts of data will be captured, stored and analyzed But where, when and how that information is handled and stored will be critical

48 In short, IoT will alter the playing field as much if not more than PCs and mobile devices have, combined Vast amounts of data, increasing security concerns, rising privacy issues The IoT savvy leader will see this coming and help to lead their company with confidence and vision

49

50 Become knowledgeable about IoT Use Google News alerts, Twitter Read articles Watch IoT videos Understand what IoT is and apply that knowledge to your company and its mission How is your company using IoT? Do they have an IoT strategy? Understand what data you all are collecting and storing, and where, so you can be and remain secure Work with IT folks and collaborate on solutions

51 IoT is an exciting megatrend - it offers amazing advancements in health, community, defense It s likely to propel organizations forward in ways we have yet to imagine But for those of us whose job it is to protect our organizations and help guide them, IoT presents a shifting and uncertain landscape Engage, become IoT- wise and help lead your organization forward

52