Emerging Trends in Cybersecurity by Amar Prusty
- 1. Emerging Security Trends Name of the Speaker : Amar Prusty Company Name : DXC Technology Place: Bangalore Confidential – For Training Purposes Only
- 2. Speaker Experience ◆ Cloud & Data Center Architect ◆ Worked for Global Clients across Industry Verticals ◆ Been in IT 17+ years ◆ TOGAF, ITIL, CCNA, Cloud, Storage, Virtualization, EUC ◆ Interests - Security, DevOps, AI, IOT, Blockchain, Analytics ◆ Hobbies– Cooking, Cycling, Reading, Travelling ◆ https://www.linkedin.com/in/amar-prusty-07913028/ Confidential – For Training Purposes Only
- 3. Education – Partnership – Solutions Information Security Office of Budget and Finance
- 4. Education – Partnership – Solutions Information Security Office of Budget and Finance
- 6. Education – Partnership – Solutions Information Security Office of Budget and Finance
- 7. Smart Appliances Healthcare Education – Partnership – Solutions Information Security Office of Budget and Finance Wearable Tech
- 8. Education – Partnership – Solutions Information Security Office of Budget and Finance
- 9. Education – Partnership – Solutions Information Security Office of Budget and Finance
- 10. Education – Partnership – Solutions Information Security Office of Budget and Finance
- 11. Education – Partnership – Solutions Information Security Office of Budget and Finance
- 13. Education – Partnership – Solutions Information Security Office of Budget and Finance
- 14. Education – Partnership – Solutions Information Security Office of Budget and Finance
- 15. Education – Partnership – Solutions Information Security Office of Budget and Finance
- 16. Education – Partnership – Solutions Information Security Office of Budget and Finance
- 17. Education – Partnership – Solutions Information Security Office of Budget and Finance
- 18. Education – Partnership – Solutions Information Security Office of Budget and Finance
- 19. Education – Partnership – Solutions Information Security Office of Budget and Finance
- 20. Education – Partnership – Solutions Information Security Office of Budget and Finance
- 21. Education – Partnership – Solutions Information Security Office of Budget and Finance
- 22. Education – Partnership – Solutions Information Security Office of Budget and Finance
- 23. Education – Partnership – Solutions Information Security Office of Budget and Finance
- 24. Education – Partnership – Solutions Information Security Office of Budget and Finance
- 25. Education – Partnership – Solutions Information Security Office of Budget and Finance
- 26. Education – Partnership – Solutions Information Security Office of Budget and Finance
- 27. Education – Partnership – Solutions Information Security Office of Budget and Finance
- 29. Education – Partnership – Solutions Information Security Office of Budget and Finance
- 30. Education – Partnership – Solutions Information Security Office of Budget and Finance
- 31. Education – Partnership – Solutions Information Security Office of Budget and Finance
- 32. Education – Partnership – Solutions Information Security Office of Budget and Finance
- 33. Education – Partnership – Solutions Information Security Office of Budget and Finance
- 34. Education – Partnership – Solutions Information Security Office of Budget and Finance
- 35. Education – Partnership – Solutions Information Security Office of Budget and Finance
- 36. Education – Partnership – Solutions Information Security Office of Budget and Finance
- 39. Education – Partnership – Solutions Information Security Office of Budget and Finance
- 40. Why it Looks so Bad • Breakers have a long history and robust tools – Automated network attack tools – Exploits for most segments of IoT stack – Physical access and hardware hacking • Builders are still searching for – Secure toolkits – Proven methodologies – Successful models • Result: – Builders cobble together components – Build very fragile full stack solutions – No visibility into security or attack surface – Attackers have a field day
- 41. Education – Partnership – Solutions Information Security Office of Budget and Finance
- 42. OWASP IoT Project • An overall IoT security effort – Attack surfaces (present) – Vulnerability lists (working) – Reference solutions (coming) • Aggregates community resources • Guidance for developers • IoT specific security principles • IoT framework assessment
- 43. OWASP IoT Top 10 Category IoT Security Consideration Recommendations I1: Insecure Web Interface •Ensure that any web interface coding is written to prevent the use of weak passwords … When building a web interface consider implementing lessons learned from web application security. Employ a framework that utilizes security … I2: Insufficient Authentication/Authorization •Ensure that applications are written to require strong passwords where authentication is needed … Refer to the OWASP Authentication Cheat Sheet I3: Insecure Network Services •Ensure applications that use network services don't respond poorly to buffer overflow, fuzzing … Try to utilize tested, proven, networking stacks and interfaces that handle exceptions gracefully... I4: Lack of Transport Encryption •Ensure all applications are written to make use of encrypted communication between devices… Utilize encrypted protocols wherever possible to protect all data in transit… I5: Privacy Concerns •Ensure only the minimal amount of personal information is collected from consumers … Data can present unintended privacy concerns when aggregated… I6: Insecure Cloud Interface •Ensure all cloud interfaces are reviewed for security vulnerabilities (e.g. API interfaces and cloud-based web interfaces) … Cloud security presents unique security considerations, as well as countermeasures. Be sure to consult your cloud provider about options for security mechanisms… I7: Insecure Mobile Interface •Ensure that any mobile application coding is written to disallows weak passwords … Mobile interfaces to IoT ecosystems require targeted security. Consult the OWASP Mobile … I8: Insufficient Security Configurability •Ensure applications are written to include password security options (e.g. Enabling 20 character passwords or enabling two-factor authentication)… Security can be a value proposition. Design should take into consideration a sliding scale of security requirements… I9: Insecure Software/Firmware •Ensure all applications are written to include update capability and can be updated quickly … Many IoT deployments are either brownfield and/or have an extremely long deployment cycle... I10: Poor Physical Security •Ensure applications are written to utilize a minimal number of physical external ports (e.g. USB ports) on the device… Plan on having IoT edge devices fall into malicious hands...
- 44. Principles of IoT Security • Assume a hostile edge • Test for scale • Internet of lies • Exploit autonomy • Expect isolation • Protect uniformly • Encryption is tricky • System hardening • Limit what you can • Lifecycle support • Data in aggregate is unpredictable • Plan for the worst • The long haul • Attackers target weakness • Transitive ownership • N:N Authentication
- 45. Framework assessment • Based on a prototypical IoT deployment model • Designed like a checklist or benchmark
- 46. Example Edge Considerations • Are communications encrypted? • Is storage encrypted? • How is logging performed? • Is there an updating mechanism? • Are there default passwords? • What are the offline security features? • Is transitive ownership addressed?
- 48. Education – Partnership – Solutions Information Security Office of Budget and Finance
- 50. Example Gateway Considerations • Is encryption interrupted? • Is there replay and denial of service defensive capabilities? • Is there local storage? Is it encrypted? • Is there anomaly detection capability? • Is there logging and alerting?
- 53. Example Cloud Considerations • Is there a secure web interface? • Is there data classification and segregation? • Is there security event reporting? • How are 3rd party components tracked/updated? • Is there an audit capability? • Is there interface segregation? • Is there complex, multifactor authentication allowed?
- 57. Example Mobile Considerations • What countermeasures are in place for theft or loss of device? • Does the mobile authentication degrade other component security? • Is local storage done securely? • Is there an audit trail of mobile interactions? • Can mobile be used to enhance authentication for other components?
- 59. Education – Partnership – Solutions Information Security Office of Budget and Finance
- 64. Education – Partnership – Solutions Information Security Office of Budget and Finance
- 65. Education – Partnership – Solutions Information Security Office of Budget and Finance
- 66. Education – Partnership – Solutions Information Security Office of Budget and Finance
- 80. Potential Points of Vulnerability ● Coffee makers ● Crock pots ● Refrigerators ● Dishwashers ● Thermostats ● Garage door openers ● Webcams ● Baby monitors ● Smart TVs ● Adjustable beds ● Heart monitors ● Breathing ventilators
- 81. ...Additional Unique Risk Factors... This market is driven by consumers who DO NOT associate IT risk with their purchases Susceptible device vendors are led by executives focused on sales, profit margin, and market share – NOT IT Security This market sector has little or no experience with, knowledge of, or sensitivity to... IT Security
- 82. Potential Damage Theft and exploitation of banking and credit card account numbers and logins Theft and exploitation of business information, including information corruption Utilization of access and credentials to proliferate spam & DoS attacks via home appliance botnets Utilization of access to alter IoT device settings, including medical devices Violation of user privacy, including access to baby monitors
- 83. Add'l Threat Information Per “Massive Media” 10/31/16 – Other Mirai exploits have since been identified Universal Plug & Play (UPnP) poses a security risk: - NO form of user authentification is required - ANY app can ask the router to forward a port over UPnP – probably NOT secure... Firmware updates delivered through WeMo- paired devices commonly use non-encrypted channels
- 84. So, Where Do We Stand? NO federal laws, policies, or guidelines exist Vendor efforts are focused primarily on providing “legalese” disclaimers...protecting THEM Third-party components in products may constitute a significant – and HIDDEN – threat It may NOT BE POSSIBLE to change passwords in some products OR disable the IoT features IoT capable devices CAN BE SUSCEPTIBLE to tampering, return, re-sale, and exploitation by hackers
- 85. What Can We Do? VERIFY the IoT capabilities and associated risks with ALL existing ...and new...products Consider MOVING AWAY from devices which CANNOT be readily or practically secured MONITOR THE MEDIA for information about IoT exploits and risks Investigate products such as “Dojo” to block access and “Shodan” to monitor devices Be careful DISPOSING OF IoT appliances – Remember what we all learned about printers ???
- 86. ...Worst Case Scenario... ● Your “smart” bed folds up and traps you... ● The thermostat drives up the temperature... ● The IoT vacuum cleaner blocks the door... ● Your SmartPhone answers that you are “out”... ● Your webcam broadcasts the whole thing while the coffee pot, the crock pot, and the microwave bubble over and celebrate in the kitchen while the garage door happily opens and closes...
- 87. Recommendations Accommodate IoT with existing practices: – Policies, Procedures, & Standards – Awareness Training – Risk Management – Vulnerability Management – Forensics Education – Partnership – Solutions Information Security Office of Budget and Finance
- 88. Recommendations • Plan for IoT growth: – Additional types of logging, log storage: Can you find the needle in the haystack? – Increased network traffic: will your firewall / IDS / IPS be compatible and keep up? – Increased demand for IP addresses both IPv4 and IPv6 – Increased network complexity – should these devices be isolated or segmented? Education – Partnership – Solutions Information Security Office of Budget and Finance
- 89. Recommendations • Strengthen partnerships with researchers, vendors, and procurement department Education – Partnership – Solutions Information Security Office of Budget and Finance
- 90. Threat vs. Opportunity • If misunderstood and misconfigured, IoT poses risk to our data, privacy, and safety • If understood and secured, IoT will enhance communications, lifestyle, and delivery of services Education – Partnership – Solutions Information Security Office of Budget and Finance
- 91. Final Thoughts • Privacy in realms of big data is a problem – No real technical solution to this one • Regulation is probably coming – FTC set to release guidelines next year • Consumers may eschew security but business won’t • Security can be a differentiator
- 92. ...Other Options.. Buy a Dumb Car... Learn to cook over a campfire... Learn to love “dumb” devices - some of us can relate to them pretty easily... NEVER leave your IoT devices together in the dark where they can conspire against you!
- 93. Questions and Discussion Education – Partnership – Solutions Information Security Office of Budget and Finance
Editor's Notes
- #4: And is there concern about IoT, given the concepts of privacy and security in today’s digital age? We may look at how media presents technology in both positive and negative lights.
- #5: And is there concern about IoT, given the concepts of privacy and security in today’s digital age? We may look at how media presents technology in both positive and negative lights.
- #6: No of end devices that are connected to internet are expected to rise above 50+ billion by 2020. cloud computing architectures won’t be able to handle the demand of the Internet of things So only cloud is not the optimal solution to handle this massive explosion. Fog is needed in between to optimize – need for an interplay of cloud and fog.
- #7: Just what is this? Its components are: A Raspberry Pi, an external hard drive, a wireless router, a GSM device, a battery backup. What does it do, what is it for? An IoT mystery….
- #8: In our daily lives, we have become more reliant on IoT with our wearable tech, appliances, our cars, how we receive health care.
- #9: And is there concern about IoT, given the concepts of privacy and security in today’s digital age? We may look at how media presents technology in both positive and negative lights.
- #10: And is there concern about IoT, given the concepts of privacy and security in today’s digital age? We may look at how media presents technology in both positive and negative lights.
- #11: And is there concern about IoT, given the concepts of privacy and security in today’s digital age? We may look at how media presents technology in both positive and negative lights.
- #12: M2M/IoT Sector Map :: Beecham Research http://www.beechamresearch.com/article.aspx?id=4 The following graphic from Beecham Research depicts how the Internet of Things may interact with various service sectors within the public/private sectors and ordinary consumers. Public sector entities (such as universities) may have some level of involvement and interaction within all service sectors depicted; ranging from the operation and industry elements of buildings, to levels of research, retail entities, transportation, and IT/Networks. **Place emphasis on service sectors, that it is likely that at least one example of devices may be found within university networks.
- #13: No of end devices that are connected to internet are expected to rise above 50+ billion by 2020. cloud computing architectures won’t be able to handle the demand of the Internet of things So only cloud is not the optimal solution to handle this massive explosion. Fog is needed in between to optimize – need for an interplay of cloud and fog.
- #14: And is there concern about IoT, given the concepts of privacy and security in today’s digital age? We may look at how media presents technology in both positive and negative lights.
- #15: And is there concern about IoT, given the concepts of privacy and security in today’s digital age? We may look at how media presents technology in both positive and negative lights.
- #16: And is there concern about IoT, given the concepts of privacy and security in today’s digital age? We may look at how media presents technology in both positive and negative lights.
- #17: And is there concern about IoT, given the concepts of privacy and security in today’s digital age? We may look at how media presents technology in both positive and negative lights.
- #18: And is there concern about IoT, given the concepts of privacy and security in today’s digital age? We may look at how media presents technology in both positive and negative lights.
- #19: And is there concern about IoT, given the concepts of privacy and security in today’s digital age? We may look at how media presents technology in both positive and negative lights.
- #20: And is there concern about IoT, given the concepts of privacy and security in today’s digital age? We may look at how media presents technology in both positive and negative lights.
- #21: And is there concern about IoT, given the concepts of privacy and security in today’s digital age? We may look at how media presents technology in both positive and negative lights.
- #22: And is there concern about IoT, given the concepts of privacy and security in today’s digital age? We may look at how media presents technology in both positive and negative lights.
- #23: And is there concern about IoT, given the concepts of privacy and security in today’s digital age? We may look at how media presents technology in both positive and negative lights.
- #24: And is there concern about IoT, given the concepts of privacy and security in today’s digital age? We may look at how media presents technology in both positive and negative lights.
- #25: And is there concern about IoT, given the concepts of privacy and security in today’s digital age? We may look at how media presents technology in both positive and negative lights.
- #26: And is there concern about IoT, given the concepts of privacy and security in today’s digital age? We may look at how media presents technology in both positive and negative lights.
- #27: And is there concern about IoT, given the concepts of privacy and security in today’s digital age? We may look at how media presents technology in both positive and negative lights.
- #28: And is there concern about IoT, given the concepts of privacy and security in today’s digital age? We may look at how media presents technology in both positive and negative lights.
- #29: No of end devices that are connected to internet are expected to rise above 50+ billion by 2020. cloud computing architectures won’t be able to handle the demand of the Internet of things So only cloud is not the optimal solution to handle this massive explosion. Fog is needed in between to optimize – need for an interplay of cloud and fog.
- #30: And is there concern about IoT, given the concepts of privacy and security in today’s digital age? We may look at how media presents technology in both positive and negative lights.
- #31: And is there concern about IoT, given the concepts of privacy and security in today’s digital age? We may look at how media presents technology in both positive and negative lights.
- #32: And is there concern about IoT, given the concepts of privacy and security in today’s digital age? We may look at how media presents technology in both positive and negative lights.
- #33: And is there concern about IoT, given the concepts of privacy and security in today’s digital age? We may look at how media presents technology in both positive and negative lights.
- #34: And is there concern about IoT, given the concepts of privacy and security in today’s digital age? We may look at how media presents technology in both positive and negative lights.
- #35: And is there concern about IoT, given the concepts of privacy and security in today’s digital age? We may look at how media presents technology in both positive and negative lights.
- #36: And is there concern about IoT, given the concepts of privacy and security in today’s digital age? We may look at how media presents technology in both positive and negative lights.
- #37: And is there concern about IoT, given the concepts of privacy and security in today’s digital age? We may look at how media presents technology in both positive and negative lights.
- #38: No of end devices that are connected to internet are expected to rise above 50+ billion by 2020. cloud computing architectures won’t be able to handle the demand of the Internet of things So only cloud is not the optimal solution to handle this massive explosion. Fog is needed in between to optimize – need for an interplay of cloud and fog.
- #39: No of end devices that are connected to internet are expected to rise above 50+ billion by 2020. cloud computing architectures won’t be able to handle the demand of the Internet of things So only cloud is not the optimal solution to handle this massive explosion. Fog is needed in between to optimize – need for an interplay of cloud and fog.
- #40: And is there concern about IoT, given the concepts of privacy and security in today’s digital age? We may look at how media presents technology in both positive and negative lights.
- #42: And is there concern about IoT, given the concepts of privacy and security in today’s digital age? We may look at how media presents technology in both positive and negative lights.
- #48: No of end devices that are connected to internet are expected to rise above 50+ billion by 2020. cloud computing architectures won’t be able to handle the demand of the Internet of things So only cloud is not the optimal solution to handle this massive explosion. Fog is needed in between to optimize – need for an interplay of cloud and fog.
- #49: And is there concern about IoT, given the concepts of privacy and security in today’s digital age? We may look at how media presents technology in both positive and negative lights.
- #50: No of end devices that are connected to internet are expected to rise above 50+ billion by 2020. cloud computing architectures won’t be able to handle the demand of the Internet of things So only cloud is not the optimal solution to handle this massive explosion. Fog is needed in between to optimize – need for an interplay of cloud and fog.
- #52: No of end devices that are connected to internet are expected to rise above 50+ billion by 2020. cloud computing architectures won’t be able to handle the demand of the Internet of things So only cloud is not the optimal solution to handle this massive explosion. Fog is needed in between to optimize – need for an interplay of cloud and fog.
- #53: No of end devices that are connected to internet are expected to rise above 50+ billion by 2020. cloud computing architectures won’t be able to handle the demand of the Internet of things So only cloud is not the optimal solution to handle this massive explosion. Fog is needed in between to optimize – need for an interplay of cloud and fog.
- #55: No of end devices that are connected to internet are expected to rise above 50+ billion by 2020. cloud computing architectures won’t be able to handle the demand of the Internet of things So only cloud is not the optimal solution to handle this massive explosion. Fog is needed in between to optimize – need for an interplay of cloud and fog.
- #56: No of end devices that are connected to internet are expected to rise above 50+ billion by 2020. cloud computing architectures won’t be able to handle the demand of the Internet of things So only cloud is not the optimal solution to handle this massive explosion. Fog is needed in between to optimize – need for an interplay of cloud and fog.
- #57: No of end devices that are connected to internet are expected to rise above 50+ billion by 2020. cloud computing architectures won’t be able to handle the demand of the Internet of things So only cloud is not the optimal solution to handle this massive explosion. Fog is needed in between to optimize – need for an interplay of cloud and fog.
- #59: No of end devices that are connected to internet are expected to rise above 50+ billion by 2020. cloud computing architectures won’t be able to handle the demand of the Internet of things So only cloud is not the optimal solution to handle this massive explosion. Fog is needed in between to optimize – need for an interplay of cloud and fog.
- #60: And is there concern about IoT, given the concepts of privacy and security in today’s digital age? We may look at how media presents technology in both positive and negative lights.
- #61: No of end devices that are connected to internet are expected to rise above 50+ billion by 2020. cloud computing architectures won’t be able to handle the demand of the Internet of things So only cloud is not the optimal solution to handle this massive explosion. Fog is needed in between to optimize – need for an interplay of cloud and fog.
- #62: No of end devices that are connected to internet are expected to rise above 50+ billion by 2020. cloud computing architectures won’t be able to handle the demand of the Internet of things So only cloud is not the optimal solution to handle this massive explosion. Fog is needed in between to optimize – need for an interplay of cloud and fog.
- #63: No of end devices that are connected to internet are expected to rise above 50+ billion by 2020. cloud computing architectures won’t be able to handle the demand of the Internet of things So only cloud is not the optimal solution to handle this massive explosion. Fog is needed in between to optimize – need for an interplay of cloud and fog.
- #64: No of end devices that are connected to internet are expected to rise above 50+ billion by 2020. cloud computing architectures won’t be able to handle the demand of the Internet of things So only cloud is not the optimal solution to handle this massive explosion. Fog is needed in between to optimize – need for an interplay of cloud and fog.
- #65: And is there concern about IoT, given the concepts of privacy and security in today’s digital age? We may look at how media presents technology in both positive and negative lights.
- #66: And is there concern about IoT, given the concepts of privacy and security in today’s digital age? We may look at how media presents technology in both positive and negative lights.
- #67: And is there concern about IoT, given the concepts of privacy and security in today’s digital age? We may look at how media presents technology in both positive and negative lights.
- #68: No of end devices that are connected to internet are expected to rise above 50+ billion by 2020. cloud computing architectures won’t be able to handle the demand of the Internet of things So only cloud is not the optimal solution to handle this massive explosion. Fog is needed in between to optimize – need for an interplay of cloud and fog.
- #69: No of end devices that are connected to internet are expected to rise above 50+ billion by 2020. cloud computing architectures won’t be able to handle the demand of the Internet of things So only cloud is not the optimal solution to handle this massive explosion. Fog is needed in between to optimize – need for an interplay of cloud and fog.
- #70: No of end devices that are connected to internet are expected to rise above 50+ billion by 2020. cloud computing architectures won’t be able to handle the demand of the Internet of things So only cloud is not the optimal solution to handle this massive explosion. Fog is needed in between to optimize – need for an interplay of cloud and fog.
- #71: No of end devices that are connected to internet are expected to rise above 50+ billion by 2020. cloud computing architectures won’t be able to handle the demand of the Internet of things So only cloud is not the optimal solution to handle this massive explosion. Fog is needed in between to optimize – need for an interplay of cloud and fog.
- #72: No of end devices that are connected to internet are expected to rise above 50+ billion by 2020. cloud computing architectures won’t be able to handle the demand of the Internet of things So only cloud is not the optimal solution to handle this massive explosion. Fog is needed in between to optimize – need for an interplay of cloud and fog.
- #73: No of end devices that are connected to internet are expected to rise above 50+ billion by 2020. cloud computing architectures won’t be able to handle the demand of the Internet of things So only cloud is not the optimal solution to handle this massive explosion. Fog is needed in between to optimize – need for an interplay of cloud and fog.
- #74: No of end devices that are connected to internet are expected to rise above 50+ billion by 2020. cloud computing architectures won’t be able to handle the demand of the Internet of things So only cloud is not the optimal solution to handle this massive explosion. Fog is needed in between to optimize – need for an interplay of cloud and fog.
- #75: No of end devices that are connected to internet are expected to rise above 50+ billion by 2020. cloud computing architectures won’t be able to handle the demand of the Internet of things So only cloud is not the optimal solution to handle this massive explosion. Fog is needed in between to optimize – need for an interplay of cloud and fog.
- #76: No of end devices that are connected to internet are expected to rise above 50+ billion by 2020. cloud computing architectures won’t be able to handle the demand of the Internet of things So only cloud is not the optimal solution to handle this massive explosion. Fog is needed in between to optimize – need for an interplay of cloud and fog.
- #77: No of end devices that are connected to internet are expected to rise above 50+ billion by 2020. cloud computing architectures won’t be able to handle the demand of the Internet of things So only cloud is not the optimal solution to handle this massive explosion. Fog is needed in between to optimize – need for an interplay of cloud and fog.
- #78: No of end devices that are connected to internet are expected to rise above 50+ billion by 2020. cloud computing architectures won’t be able to handle the demand of the Internet of things So only cloud is not the optimal solution to handle this massive explosion. Fog is needed in between to optimize – need for an interplay of cloud and fog.
- #79: No of end devices that are connected to internet are expected to rise above 50+ billion by 2020. cloud computing architectures won’t be able to handle the demand of the Internet of things So only cloud is not the optimal solution to handle this massive explosion. Fog is needed in between to optimize – need for an interplay of cloud and fog.
- #80: No of end devices that are connected to internet are expected to rise above 50+ billion by 2020. cloud computing architectures won’t be able to handle the demand of the Internet of things So only cloud is not the optimal solution to handle this massive explosion. Fog is needed in between to optimize – need for an interplay of cloud and fog.
- #88: How do current UT165 and institutional policies, standards, and procedures take into account IoT? Are they sufficient to address areas of confidentiality of data? Does current BYOD policies address wearable tech items? Concerning the present might these policies also BYOx? bring your own device (BYOD) bring your own apps (BYOA) bring your own encryption (BYOE) bring your own identity (BYOI) bring your own technology (BYOT) bring your own network (BYON) bring your own wearables (BYOW) Awareness building for IoT will involve similar approaches currently developed in University training. Relationship building with those departments, vendors and academia/research entities will perpetuate dialogue concerning the subject of IoT; whether within the marketing/sales/procurement of IoT devices and services and/or when internal development occurs, as in the case of research. Building relationships also assists in the awareness in the areas of privacy (both of data and individuals), what is logged when it comes to data and other transactional information, the reasons why items need to be logged (local, State, Federal laws and acts, industry-specified compliance requirements.) Training initiatives may need to be rethought in the areas of IoT; do University partners as well as Information Technology/Information Security How we assess for risk may change in certain retrospect. We may need to go “dig deeper” on our current risk assessments of networks, data centers, departments; to include how we assess in the areas of legal and regulatory requirements (e.g. HIPPA, PCI-DSS, FERPA). Considerations must be taken into account when system owners assume or transfer risk in relation to IoT. Different measurements may need to be considered when considering both risk formulation as well as risk acceptance when considering IoT; for system owners and data owners risk acceptance may involve additional measures IT and Security staffs must take to protect information/data. Security controls must be in place to leverage such risk acceptance in the overall network. There is the need to consider how we scan for vulnerabilities; while certain IoT Devices may show up on scans, others types of IoT devices may not. Forensic approach to IoT may require some retooling in the areas as to whether local Security staffs are equipped and trained to deal with incidents when they occur, as well forensics capabilities in the situations with forensics may be outsourced/required of by third party entities.
- #89: With the incorporation of IoT in today’s networks, there will be an increase in the need for logging and monitoring capabilities Increasing need for log storage “Needle in a bigger haystack” will make incident response and forensics more challenging, are current capabilities sufficient? Logging in regards to compliance may involve a number of factors; to include storage of logs, relevance of logs, privacy concerns when dealing with University partners of logging. Considerations for the redesign of networks may come as more demand for traditional IPv4 addresses, with the contingency on planning for further IPv6 implementations in regards to IoT. Planning of network design may also require changes on how bandwidth as consumed, quality of service, and prioritizing network traffic through new designs. And further, the redesign of networks may also take into account of how firewalls and IDS/IPS may handle IoT traffic when considering IPv6
- #90: What is the level of relationship with research departments on campus? What improvements can we make with researchers who may already be working with IoT and develop dialogue and partnership concerning security awareness and initiatives, while at the same time letting those same researchers build upon the opportunity that IoT offers? Consider how we might be doing business with vendors and reviewing items prior to implementations on campus. Build the relationships with Procurement departments, let them work with you when items may be purchased that spur a security review/assessment/questions/dialogue.
- #91: In closing, while, how we as security professionals work, support, and provide the security expertise for Higher Education business initiatives is crucial to success in the scope of IoT.
- #94: Questions and Answers section