>> When we talk about the very top option,
passwords, it's funny because
that exists in our own network environments.
More traditional passwords are
always going to be the weakest link.
For one thing, our devices come with default passwords.
There is an attack where over a million devices
that were all from the Internet of Things
>> were used in a botnet
>> to create a denial of service attack.
Ultimately, what the attackers did,
was assume the default password of these devices.
If the device wasn't using the default,
they just moved on to the next one.
That shows you
>> these default passwords can be very difficult.
>> Ideally, we've made some changes there.
We have more randomized passwords,
but certainly a concern.
Insecure network services.
It's estimated over 600,000 devices suffer
>> from this particular vulnerability like open ports
>> and unneeded services that are
provided through these devices.
Typical security vulnerabilities arise
>> where they have additional services
>> that aren't required.
>> Not to mention the fact that
>> it's so easy to add additional devices,
>> which is why we see these insecure services
as being a real issue.
Insecure ecosystem.
When I bring this into my home environment,
I have lots of devices collaborating.
I've got maybe cameras from my Wyze,
>> where I monitor home activity through cameras.
>> Maybe I have of baby monitor,
an ECO Assistant,
a Google Nest thermostat, and a ring doorbell.
We all have these devices.
First of all, trying to get them
to collaborate could be an issue.
But what is this information
>> that is being collected from all of them
>> and where is it going on the back-end?
>> They have Internet access.
I have Internet access in my Wi-Fi network,
what's being reported through the Cloud
to back-end databases?
Lack of security updates.
When's the last time you updated your thermostat,
your lights, or your doorbell?
We don't think to update.
We don't think to monitor these devices
because they've just become a part of her house.
These have embedded computer systems in them.
Like everything, they're often
necessary updates to maintain
the security of these devices.
Then sometimes if the security updates
are rolled out automatically,
that causes functionality problems.
The question would then be,
am I able to roll back
>> if a security function doesn't work?
>> Insecure or outdated components.
Right in line with our last topic.
If you have an Alexa,
every few months a year,
they release an updated component,
then they stop supporting
>> some of the earlier components.
>> We have to think about
>> who we trust to allow into our home.
>> Knowing that businesses are in business to make money,
when we look at these systems
>> and interfaces what capability do the have from input?
>> Have we bought this from a trusted vendor?
Have we purchased these devices
>> from a trusted provider?
>> Probably the greatest concern in my mind
is insufficient privacy protection.
Once again, the law's lagging behind,
what can that information be used for?
Who owns the data that's recorded by my Google device?
We don't have a lot of laws in place now.
Certainly, we don't have
any capability of classifying information.
These devices were designed to assist you.
But that means they are always listening.
If you say, "Hey Siri" and your iPhone comes on,
that tells you your iPhone
>> is just sitting there waiting for that command.
>> It's listening.
>> We hear about these things
>> and then we get shocked
>> when the NSA is found to be listening
>> to be suspected criminals
>> or terrorists through their televisions.
Well, the television is waiting
so you record such and such show.
Of course, it's listening.
When it's listening, what's on the back-end?
What's also listening should be a tremendous concern.
Have you ever said something in
your house and then it shows up on your Amazon list?
That should tell you about the privacy we have.
Data transfer and storage.
What's being stored?
Where is it going?
>> How is it protected?
>> How is my communication protected by these devices?
How is the data that's going
>> from one network device to another,
>> how's any of it protected?
When we think about health care information,
and a lot of health care devices
are modified through networking,
they're part of the Internet of Things.
Well, those health care devices
contain sensitive information.
If it were stored in the traditional sense,
HIPAA guidelines would restrict
>> how that data is stored.
>> When we have these wearable devices that aren't being
communicated via Bluetooth or some other fashion,
the security isn't necessarily as clear.
You have to think about who has access to
these devices on our home or on the network.
Again, I'm really thinking
beyond just our home use when I think about
these IoT devices that are part of the network
and incorporate in maybe a facility management system.
How are the rules for access configured?
There are several different ways.
These rule-based access controls,
there is discretionary access control,
there is mandatory access control.
We'll talk about those three different
access control types,
we are going to find differing degrees of security.
I mentioned this earlier.
Just lack of device management.
Who is updating their thermostat?
Most people aren't.
Who's managing or monitoring?
How do we make sure that
>> when we decommission these devices,
>> that they're truly decommissioned in a safe way?
Can we destroy the device or what's stored locally?
We just don't have a lot of control
>> and a lot of management on these devices.
>> Default settings make these devices
easy to set up and get running.
But once again,
>> if I know your default configurations
>> and can I access your network?
>> Many people don't change those default settings.
Not to mention the fact that with
just a little bit of physical access,
I can usually and sometimes not even physical access,
but I can reset the devices to their factory settings,
which means we're going to come back
to all the defaults as well.
Then a lack of physical hardening.
With these devices, just like any other device,
you can't underestimate the need for physical security.
They need to be tamper-resistant.
We need modes for tamper detection.
Can we implement some device that listens
>> or acts as a man in the middle attack?
>> Do we trust our supply chain?
Do we trust who calls and comes in in our environment?
Just a lot of security considerations for IoT.
What I really believe is we get caught up
>> in the convenience that's offered,
>> that we really fail to think
about the security considerations.
Just some key takeaways.
We have a lot of use for the Internet of Things.
It really has become
just an explosion over the past few years.
We often think of these personal assistants,
these health care devices that we use,
but expands way beyond that.
We have monitoring tools and
configuration capabilities, inventory systems,
all elements that take advantage of these devices
that report maybe to a central management framework.
Ultimately, the capabilities are pretty much unlimited.
However, we have to consider security.
OWASP publishes the top 10 security vulnerabilities
with Internet of Things.
Even though that's not going to be testable per se,
I would certainly be aware of some of those.
Really, all of those vulnerabilities.
They're not going to ask you about it
>> in the context of OWASP.
>> I think being able to pick some of
the security vulnerabilities of IoT out of a list
>> and say, "That would absolutely be appropriate."
>> I think that may.