thought leadership webinar - internet of things (iot): the next cyber security target
TRANSCRIPT
Internet of Things(IoT):The Next Cyber Security Target
Praveen Kumar GandiHead Information Security [email protected]
By
Disclaimer: The images used in this presentation belong to their respective copyright holders and are used for educational purposes only. All other rights are reserved.
Pre-Internet
Internet of CONTENT
Internet of SERVICES
Internet of PEOP
LE
Internet of THIN
GS
“HUMAN TO
HUMAN”“WWW” “WEB 2.0” “SOCIAL
MEDIA”
“MACHINE TO MACHINE”
• Fixed & mobile telephony• SMS
• E-mail• Information• Entertainment
• E-productivity• E-commerce• …
• Skype• Facebook• YouTube• Twitter• ….
• Identification, tracking, monitoring, metering ….• Semantically structured and shared data …
+ Smartnetworks
+ SmartIT platforms & services
+ SmartPhones & applications
+ SmartDevices, objects & tags
+ SmartData & ambient context
Evolution of Internet of Things
• According to Gartner's analysis, there will be nearly 26 billion devices on the Internet of Things by 2020.
• As per ABI Research, an estimation of more than 30 billion devices will be wirelessly connected to Internet of Things.
• And as per the MarketsandMarkets Analysis, the estimated revenue generated on these smart product sales by 2016 will be $1 Trillion.
Importance of Internet of Things
Source: Cisco
Internet of Things(IoT)• Originally, The Internet of Things (IoT) refers
to “the interconnection of uniquely identifiable embedded computing devices within the existing Internet infrastructure”.
• As the technology advances, the term Internet of Things(IoT) denotes to “Advanced connectivity of devices, systems, and services that goes beyond machine-to-machine communications (M2M) and covers a variety of protocols, domains, and applications”.
Source: http://en.wikipedia.org/wiki/Internet_of_Things
Internet of Things(IoT)
• The IoT represents an evolution of future as many physical devices communicate with each other everyday through internet and identify themselves with other devices.
• The other technologies like RFID, Sensor technologies, Wireless technologies, etc. will also be used as method of communication.
IPV6
Inexpensive and High Speed Connection
Big Data and
Cloud
Inexpensive and Powerful Hardware
Internet Evolution
Source:Cisco
Types of Internet of Things
Information Technology
• PCs• Servers• Virtualization• Routers• Switches
Personal Technology
• Tablets• Smart phones• Smart watches• Home energy• Home entertainment• Home control• Medical implants• Medical wearables
Operational Technology
• Industrial Control Systems(ICS)
• Supervisory control and data acquisition
• Medical machines• Kiosks• Manufacturing• Cloud service
infrastructure• Environmental
Monitoring
Do you know?• The First IOT device
is Internet Coke Machine at Carnegie Mellon University introduced in the year 1982”.
Internet of Things In Everyday Life
Internet of Things in Homes(Smart Homes)
How IoT works?
Source: Securing the IoT World by Aaron Guzman
Are Internet of Things Secure?
Smart Cars got pwned!!
Smart Lights can be Hacked
• Unsecure communication between bridge and application
•Vulnerability in smart bulb makes home black out by security researcher
•Fixed in Latest Version
Vulnerabilities in IoT Devices• Due to improper security model implementation and unsecure communication between the device and application. • Any device on the same Wi-Fi network can command or control these devices.
How far IoT can be hacked?
Remember “Fire Sale” in Die Hard 4.0
Hurdles Securing the IoT• There is no consistent or
official software update process or mechanism
• There is little or no understanding of the cyber threats embedded in their systems
• There is lack of accountability for device security
• Improper configuration or purpose-built features that equate to security flaws
• Data privacy
Securing the IoT
• Keep your Software/firmware Updated
• Ensure that connectivity is Secure. eg: Two Factor Authentication
• Secure the location of the data being reported by IoT-linked devices.
• Encrypt the System.eg: Two-Person Controls
Securing the IoT
• Ensure Supply Chain Security. Prevention of counterfeit hardware by procedures to certify manufacturers’ supply chain processes to prevent the introduction of malicious code.
• Support IoT security. We must support regulation that requires that IoT devices meet security standards, just as we require standards for our electrical devices with UL approval requirements.
Securing the IoT
• Use out of band (OOB) systems – closed systems (intranets) that are not open to the public.
The Defence Department uses IoT linked devices, but they are mainly out of reach from hackers because they are OOB. Defence weapons systems and even sensor-wearing soldiers report critical status information to centralized control centres that feed decision makers. While less vulnerable to being hacked, these OOB systems are subject to insider attacks.
Securing the IoT
• Support Standardization. Eg: OWASP
Securing the IoT
Source: IoT-Attack-Surfaces-Defcon-2015
Securing the IoT
• Stay informed. National Institute of Standards and Technology and Federal Guidance such as Federal Information Processing Standards (FIPS) address critical steps that are needed to secure and protect information and critical systems.
