One of the coolest things about being in today's Internet is that our universe is filled with all of
these amazing devices that I'm going to call static hoes.
Now you might also when you use the term Internet of things but it basically boils down to those zillions
of devices out there that have some form of embedded operating system.
And they also have some type of network awareness so gosh I could go from a Google Home box to a Nest
thermostat to a home router to a game controller.
There are so many things out there that fit underneath that criteria.
Now a lot of people would argue that mobile devices are static homes.
They certainly have a specific operating system and it's also stored on firmware and they're very much
internet aware.
However these are kind of general purpose devices so when we're talking about a static host usually
the best idea is to think about a device that's designed to do a specific things so.
So there are arguments for mobile devices being static.
However I'm going to save all that for their own episode and we can go into the security of mobile devices
in great detail but there's lots of static hosts all around us.
I mean look what I got right in front of me here.
I've got a wireless access point.
I've got a nice switch here.
Got an old but good router right in front of me.
I've got a network aware printer right here.
All of these are single purpose devices whose job is to do whatever they are supposed to do.
They are network aware very much network aware and they have some form of operating system stored on
some kind of firmware so these are all static.
Now I'm not done yet.
Let's keep going here.
Let's take it up to more of an industrial level and talk about some of the stuff that we see for example.
Industrial control systems everything we do when it comes to industrial anything these days usually
means you've got some kind of machines some kind of something with a computer that is network aware
that is single purpose.
Who is going to control that thing to make it do whatever it wants to do.
So I don't care if you're baking bread or making motherboards there's invariably going to be some type
of industrial control system.
Now probably one of the more famous industrial control systems is heating ventilation and air conditioning
systems or HD AC.
Pretty much any office building any industrial building today has an HD AC system and all of that is
powered by some type of specialized computer whose only job is to keep us warm or to keep us cool.
Now we can even take it one step further than that.
What I want to do is take the idea of industrial control and take it out over long distance.
We have a lot of situations.
Railroads oil pipelines electrical distribution systems that require industrial controls.
But because of their physical distances involved they actually go into a whole new class of devices
that we call supervisory control and data acquisition systems or skater.
So Scates systems are pretty much icy Yes but the only big differences is they usually have to have
some kind of like a cellular connection or something like that they have a lot of autonomy to make sure
that they can do whatever they have to do.
So there is a lot of stuff out there that we have to deal with when it comes to static hoes.
So the big question is is how do we secure them.
The biggest challenge to securing static hosts is understanding that in many ways they are like any
other type of host and in many ways they're not.
So first of all they act a lot like any regular host in that just like Rieger Windows system for example.
I will have user accounts with passwords.
This has a user account with passwords and invariably it's going to have some default user account password.
You know what you probably want to change that.
Also like a regular host you want to turn off unnecessary services.
This particular router right here has a built in telnet server which I don't like to have turned on.
It has an s S-sh server which is fine with me.
So I make sure to turn off that telnet server.
So the first thing you're going to do when you're dealing with a static host is think about that static
host as a regular host.
There's a lot of things that you can take care of.
However the other problem with static most is that it doesn't act like a regular host in many ways.
I don't have any windows update that comes with this that automatically updates the built in operating
system.
I don't have any anti-malware on this guy that allows me to make sure I'm not being corrupted by something.
So when you have static hosts in your life you're going to spend a lot of time monitoring your network
monitoring what's going on out there and making firmware updates.
Hopefully a lot will depends on the device you run into a lot of interesting problems like for example
a very popular brand of home routers.
People discovered fairly recently you could just type something into a screen and it would automatically
allow you to take full control of them.
A wonderful injection attack but it's because I watch the news and I discovered something like that.
Also this is a Cisco device.
I tend to live on the Cisco sites always watching for particular problems for any piece of firmware
that needs an update.
And then I'll go ahead and do those updates.
And in 99 percent of the cases it's a manual thing that you have to watch manually.
Now that's great but there's a lot of aspects about this device that you're not going to be able to
do anything about.
For example there is no anti-malware built into the Cisco router.
There are things I'm going to have to do to protect this and I can't do it on the device itself.
So I start to create layers of protection around it.
Or what we call defense in depth.
And the best way to do defense in depth is through network segmentation.
Let me show you what I mean.
So here's Mike's bread baking company and I've got a big industrial control system where I make lots
of delicious bread.
Now what I need to do is perform network segmentation here to give my self defense in depth.
For example here I have all these bread baking machines.
What I'm going to do is separate these bread making machines from the rest of my network using the lands
in that way making sure that I get some good control and I can even put a firewall between the separate
villans to make sure the traffic that I don't want to have going between these two will take care of
it.
Now if I want to scale this up a little bit let's just say I've got Mike's pipeline here.
So instead of an icy Yes now I've got to scale the system so here's my pipeline with a few different
terminals along a thousand mile pipeline.
What I can do in this situation is that if any of these systems need to phone home or if I need to talk
to them I can go ahead and use a VPN network to allow me to talk to these guys with a high degree of
security.
You're going to see questions on the exam about static hosts.
Remember a few things though and you shouldn't have any trouble.
Number one treat a static host like any other regular host at first but then secondly if there are unique
aspects to that host Don't be afraid to throw in some really good network segmentation to protect your
static hosts from the mean outside world.