Internet of Things (IoT): Security Awareness Sandra Liepkalns, CRISC sandra.liepkalns@netrus.com
So What is the Internet of Things Network of physical objects embedded with: Electronics, software, sensors Network connectivity Ability for objects to collect and exchange data Objects to be sensed and controlled remotely across existing network infrastructure Direct integration between the physical world and computerbased systems Resulting in improved efficiency, accuracy and economic benefit
So What is the Internet of Things Each thing is uniquely identifiable through its embedded computing system Able to interoperate within the existing Internet infrastructure It is estimated that only 1% of things are connected to the Internet today and that IoT will consist of almost 30-50 billion objects by 2020
Smart IoT Implementations Cities Smart Parking Noise Urban Maps Traffic Congestion Smart Lighting Structural Health Waste Management Environment Forest Fire Detection Earthquake Early Detection Landslide and Avalanche Air Pollution Retail Product Management Supply Chain Control Intelligent Shopping Applications NFC Payments RFID Room Charges Water River Floods Water Quality Water Leakage Transportation Cars
Security Issues of IoT
So What are the issues with IoT Vendors are more concerned with getting the things out on the Internet Speed to Market, being first Connectivity is more important than security End Users may not know a device is connected Vendors may not understand threats and risks
IoT Threats and Risks Attacks on Devices Control or damage the device Use the device for distributed computing Attack other Systems with the Device Compromise and attack other systems/devices through distributed computing Use the Device for Information Gathering Network sniffing and data collection Vendor Views Who would want to attack a washing machine, toaster oven or wearable
Industrial IoT Smart Meters and Grid Controls Interconnected Minimal Human Monitoring mainly M2M SCADA Systems Minimal Security Designed as Closed System
Retail IoT Point of Sale Systems, Scanners, Kiosks Mobile Device Payment Applications Radio-frequency identification (RFID) Debit, Credit Cards, Hotel Near Field Communication (NFC) Mobile Payments Coupons Instore Customer Tracking Many systems are outdated & left unpatched
Smart Home IoT Security Privacy Authentication Internet Access Consumer Education http://www.zigbee.org/
Internet and the IoT Webcams Businesses, Cities, Vacation Resorts, Highways, etc. Open Webservers for IoT Devices Home Automation Accessible via Routers Unpatched or not Password Protected Smart Home WiFi Leakage WiFi Passwords
Today s Security Incidents Card Skimmers Cyber Espionage Point of Sales Intrusions Web Application Attacks Physical Loss or Theft Denial of Service Attacks Crimeware Errors Insider Misuse Everything Else
A World of Things Things are - Designed, Created, Implemented and Connected by People Data is Collected and Stored by People People are still our weakest link in Security and Privacy It is easier to integrate Security and Privacy upfront, than fix later
IoT Security Network Security Architecture Network, Application and Device Segmentation or Segregation Understand your network and how it functions Vendor Understand the device security capabilities Control vendor access to the network Understand the associated risks Implement Compensating Security Controls Monitoring IDS, SIEM, Network, Switches, Routers Applications
IoT Information Security & Privacy Information Security and Privacy is not just about having strong passwords, its about Governance, Risk Management, understanding where your Information resides, Implementing Security Controls, Monitoring and Reporting This means The Internet of Things as well!
Questions