Now, in addition
to standard computers and servers,
there are many other devices that utilize our networks,
and these make up the Internet of Things.
The term Internet of Things is used to describe
a global network of appliances and personal devices
that have been equipped with sensors,
software, and network connectivity
to report state and configuration data.
These IoT devices can be managed remotely
over an IP network like the internet as well.
You've probably seen or even used
some of these devices yourself,
including building and home automation systems,
heating, ventilation, and air conditioning controllers,
IP video systems, audiovisual systems,
physical access control systems,
and scientific and industrial equipment.
Building and home automation systems
are going to focus on the management of lighting, HVAC,
water, and security systems.
These systems efficiently manage all the devices
in real time to save money on utility costs
and to increase the comfort of a building's occupants.
It's important to remember all of these systems
that may be fielded across your office buildings
to ensure they aren't having any interference issues
with other wireless devices you may be operating,
as well as those devices
making sure they're properly security enabled
and that the power is being provided to those devices
using power over ethernet or a battery power supply.
While these systems can sometimes be placed
on our business network to increase the manageability
of that system, it is not considered a good idea
and it goes against the best practices.
Instead, devices like this should be placed
on their own network and segmented off
from the business network.
If you need an example to prove to your CIO
why you need a separate network for these devices,
just look back to 2014 and the breach at Target.
This is where hackers broke into the business network
by exploiting a flaw in the HVAC controller system,
and then they used that to gain access
to the point of sale network
and steal credit card information.
Trust me, segregation of IoT devices is critically important
for the security of your business network.
Now, internet protocol or IP video systems
are another type of IoT device you may come across.
These IP video systems provide businesses
with an excellent method of remote collaboration
using systems like video teleconference suites and Skype.
The capability has saved organizations
a ton of money for travel
because employees can now conduct meetings virtually
over a synchronous IP-based video stream
from their conference room
instead of having to fly across the country
to have an in-person meeting.
Now, when you're implementing an IP video system,
you need to consider the level of quality of service
you want or QoS that's going to be required
for that system to operate smoothly.
Also, these video streaming suites
do require a lot of bandwidth,
so that has to be factored into your network architecture
as you're designing them.
Plus, these systems can actually cost
a lot of money upfront.
For example, one conference room-based IP video solution
I installed at one of my previous organizations
cost us nearly $25,000 for the equipment and installation.
These systems also require security patches,
and they must be considered
as part of your organization's security posture.
Your organization's audio video systems
can also be connected by using IP networks as well.
For example, the high definition serial digital interface
is used to stream live video productions
across the globe or across the building.
In many security operation centers,
there's going to be displays all around the room,
and they're all being centrally controlled and routed
through a digital video switching system
that runs over an IP network.
Again, this network for this video system
should be physically separated or logically separated
from your production network.
Now, physical access control systems,
such as proximity readers, access control systems,
security cameras, and biometric readers
can also all communicate over the IP networks.
These devices are used to determine if somebody
should be granted access into a secure room
by communicating back to the authentication server
over that IP network.
Due to the high security these devices need to provide,
they should be placed on a separate network
that has additional protections
beyond the standard organization's business network.
Scientific and industrial equipment devices
are going to be found in hospitals,
factories, and laboratories.
These devices used to be unconnected, but over the years,
they began the migration onto our IP networks too,
allowing for centralized monitoring
and management of all these devices.
These devices, though, can pose significant risk
to our network because they cannot easily be upgraded
or patched when there's bugs that are discovered.
Therefore, it is crucial to provide them
their own physical or logical network
so they can remain isolated
from the rest of our business network.
Now, when you're looking at different IoT devices,
you can generally break them down
into one of four categories of components.
This is either the hub and control system,
the smart devices, the wearables, or the sensors.
Now, a hub and control system is going to be used
as a central point of communication
for many automation and controlling of those IoT devices
because many of them rely on different protocols,
like Z-Wave and Zigbee for networking,
instead of relying on things like Wi-Fi and Bluetooth.
To make this work, your IoT devices need a control system
or a smart hub for the different devices and sensors
that are going to be connected to them.
For example, if you have an Amazon Echo in your home,
this is a perfect example of a hub and control system
that can be used to control
all of your other smart devices and sensors.
Next, we have smart devices,
and these are the IoT endpoints that are going to connect
back to that central hub or control system to provide you
with some kind of automation or function.
For example, if you have a smart light bulb,
a video doorbell, or a Nest thermostat,
these are all examples of smart devices.
In my studio, for example, I use a wide variety
of smart devices to control my environment,
including a smart thermostat to control the temperature,
smart light bulbs that allow me to control
the color and tone of the lighting,
and smart outlets that allow me to turn on
or turn off various devices around my studio
using simply my voice.
For example, if I tell my smart system
to get ready for filming,
it's going to turn on my camera, my lights,
my air conditioner, and all the other equipment I need
to begin recording.
If instead, I tell it to get ready for podcasts,
it's going to power down everything that I don't need
to record an audio podcast
and instead set me up for audio recording only.
This is a convenient way for me to save time
instead of having to turn on 10 or 15 different devices
located all around my studio.
Third, we have wearables.
Wearables are a category of IoT devices
that are designed as accessories that can be worn.
This includes smart watches, bracelets,
fitness trackers, smart glasses, and headsets.
Basically, a wearable is just a smart device
that is designed to be worn.
Otherwise it's just considered another smart device
in a different form factor.
Now, the fourth category we have is known as a sensor.
Now, an IoT sensor can be used to measure
lots of different things, including temperature,
sounds, light, humidity,
pressure, proximity,
motion, smoke, fire,
heart rates, and many other things.
Again, your smart devices, wearables, and sensors
can all connect back to that central hub and control system
using a variety of communication methods to send their data.
Now, this includes things like Z-Wave, Zigbee,
Wi-Fi and Bluetooth depending on the capabilities
of your specific hub and control system.
When it comes to IoT, I believe there are many things
you should be doing within your organization
to best protect yourself.
First, you need to understand your endpoints.
Each new IoT device brings with it new vulnerabilities,
so you need to understand your endpoints
and what their security posture is.
If you're adding a new wireless camera
or a new smart thermostat, each one of those
brings different vulnerabilities that you need to consider
before connecting those devices to your network.
Second, track and manage your IoT devices.
You need to be careful and don't just let anyone
connect any new IoT device to your network.
Instead, you need to ensure you have
a good configuration management for your network
and follow the proper processes to test, install,
and operate these IoT devices when you connect them.
Third, patch vulnerabilities.
IoT devices can be extremely insecure.
If you're deploying a device, you need to understand
the vulnerabilities and patch them the best you can.
After that, you're still going to be left
with some residual risk here, but there may not be a bug fix
or a security patch available for that IoT device.
If that's the case, you need to conduct some risk management
and determine if you're willing to accept the risk,
or if you need to put additional mitigations in place,
like putting them on a separate VLAN.
Fourth, conduct test and evaluation.
Before you connect any IoT device to your network,
you should fully test it and evaluate it
using penetration testing techniques.
It is not enough to trust your manufacturer
when they say their devices are secure,
because many of these devices are not.
Therefore, always conduct your own assessments
of their security by conducting it on a test network
or lab before you attach it to your production network.
Fifth, change default credentials.
Just like network devices,
each IoT device has a default username and password
that allows you to connect to it and configure it.
These default credentials present a huge vulnerability,
so they have to be changed before you allow the IoT device
to go into production on your network.
Six, use encryption protocols.
IoT devices are inherently insecure,
so it's important that you utilize encryption protocols
to the maximum extent possible to better secure the data
being sent and received by these IoT devices.
Seven, segment IoT devices.
The Internet of Things devices should be placed
in their own VLAN and their own subnet
to ensure they don't interfere
with the rest of your production network.
If you can afford it, you may even want to have
a separate IoT-only network
to provide physical isolation as well.
As you can see, there are lots of different considerations
that you need to think about when it comes to connecting
Internet of Things devices to your network.