Bridgera enterprise IoT security
- 1. Enterprise IoT: Security Turning a prototype into a viable solution © 2017. All Rights Reserved
- 2. What is Security? How does it apply to the Internet of Things? © 2017. All Rights Reserved
- 3. © 2017. All Rights Reserved Security Fact 100% Secure from 100% of Threats is 100% Impossible
- 4. © 2017. All Rights Reserved Therefore, security is …
- 5. © 2017. All Rights Reserved In the beginning … (Before 1990) People had personal computers (PC) … Security concern was physical theft of the PC
- 6. © 2017. All Rights Reserved By 1990 Security evolved to a warning ... May contain viruses
- 7. © 2017. All Rights Reserved In the Early 1990’s We then connected computers in a local network … Physical theft still remained the primary concern …
- 8. © 2017. All Rights Reserved Early 1990’s … and yes, unscrupulous floppy disks still contained viruses! May contain viruses
- 9. © 2017. All Rights Reserved In the Late 1990’s AOL introduced people to the internet … But CxO’s feared the internet and refused employee access.
- 10. © 2017. All Rights Reserved In the Mid 2000’s Thanks to AOL and software sales reps, CxO’s began seeing value in what the internet offered …
- 11. © 2017. All Rights Reserved In the late 2000’s IT Security profession evolved to create … Guidelines and Standards • SSAE16 • ISO 27001 • NIST • FEDRAMP • DFAR
- 12. © 2017. All Rights Reserved Today We now have an entire industry providing IT security as a service … • IDS/IPS – Intrusion Detection System, Intrusion Prevention System • DDOS – Distributed Denial of Service • SOC/NOC – Security Operations Center, Network Operations Center • SIEM – Security Information and Event Management
- 13. © 2017. All Rights Reserved What does this have to do with IoT?
- 14. © 2017. All Rights Reserved Smart Devices are Everywhere In our homes In our offices In our factories In our vehicles
- 15. © 2017. All Rights Reserved Smart Devices are Everywhere In our homes In our offices In our factories In our vehicles Like PC’s in the 1990’s, security is to prevent theft and physical harm
- 16. © 2017. All Rights Reserved Now we want smart devices connected
- 17. © 2017. All Rights Reserved Connecting devices introduces new risks
- 18. © 2017. All Rights Reserved Connecting devices introduces new risks We need new standards, tools, and services
- 19. © 2017. All Rights Reserved Challenges Is the device physically secure? Can the device encrypt data? Can the device password be remotely changed? Can the device firmware be updated? Can the device be controlled remotely?
- 20. © 2017. All Rights Reserved When people demanded internet access… we figured it out. We will figure out how to secure IoT devices. Until then …
- 21. Don’t make it easy for bad things to happen © 2017. All Rights Reserved SoftwareInternetThings
- 22. © 2017. All Rights Reserved What Bad Could Happen? Unwanted access / use Unwanted change Inability to access Availability
- 23. For each potential threat: 1. Weigh Impact • Safety of people • Protection of physical assets • Protection of data • Compliance with regulations • Cost of a breach 2. Assess Probability 3. Prioritize what to mitigate 4. Put appropriate controls in place • Include risk mitigation into the design specification © 2017. All Rights Reserved Establish Priority
- 24. © 2017. All Rights Reserved Thing Development: Hardware/Device ENGINEERING CONSTRAINTS: COST | POWER | SIZE
- 25. © 2017. All Rights Reserved Thing Development: Hardware/Device ENGINEERING CONSTRAINTS: COST | POWER | SIZE
- 26. © 2017. All Rights Reserved Internet: Communication Channel DRIVEN BY DEVICE CONSTRAINTS: COST | POWER | SIZE + DISTANCE LTE 3G LoRaWiFi Sigfox TCP CoAP MQTT REST Network Mode of transporting data Internet Protocol Packaging data for transport over a network
- 27. © 2017. All Rights Reserved Internet: Communication Channel DRIVEN BY DEVICE CONSTRAINTS: COST | POWER | SIZE + DISTANCE LTE 3G LoRaWiFi Sigfox TCP CoAP MQTT REST Network Mode of transporting data Internet Protocol Packaging data for transport over a network
- 28. © 2017. All Rights Reserved Software: Cloud Capabilities Connect Devices Enable Applications Process Data ENGINEERING CONSTRAINTS: DATA FLOW (3V’S) | RELIABILITY | PROCESSING
- 29. © 2017. All Rights Reserved Software: Cloud Capabilities Connect Devices Enable Applications Process Data ENGINEERING CONSTRAINTS: DATA FLOW (3V’S) | RELIABILITY | PROCESSING
- 30. © 2017. All Rights Reserved IoT System Security Controls (examples) Device Level Application LevelConnectivity Level • SSL certificates • Unique device passwords • Whitelisted IP addresses • Whitelist phone number (SMS) • Checksum algorithms (delivery reliability) • OTA firmware Updates • SSL/TLS between platform and device • VPN to securely send SMS text messages using SMPP gateways • Manage and frequently change device passwords • Manage firmware updates • Standard cloud security (DDOS, IPS/IDS, …) • Authentication, authorization to access the platform and applications • Database encryption • VPC (Virtual Private Cloud) zone protected by a firewall (or an equivalent concept)
- 31. © 2017. All Rights Reserved Security – What can you do today? Identify potential threats early and continuously Assess Impact and Probability Put appropriate controls in place Apply best practices where they exist 100% secure from 100% of threats is 100% impossible, but … Don’t make it easy for bad things to happen.
- 32. Questions? Learn more at Bridgera.com/IOT © 2017. All Rights Reserved Ron Pascuzzi Ron.Pascuzzi@bridgera.com 919-757-1941
- 33. © 2017. All Rights Reserved Bridgera IoT One Platform to Accelerate Your Enterprise IoT Solution Connect Devices Enable Applications Process Data