Anyone who has suffered identity theft will tell you how difficult and drawn out it is to reset the clock, clear your name, recover credit ratings and get clear of all the impending financial liabilities and potential losses. Everything in this connected world turns out to be biased against you the victim, and all the advantages lie with the dark side of the force. This situation does not look set to improve anytime soon and could get a whole lot worse as we migrate into the Internet of Things (IoT). In a future world where everything is on-line and tagged: with histories of design, sourcing, production, delivery, purchase, ownership, use, reuse, repurposing and recycling; ownership theft becomes an even bigger threat for the most valuable of items. Cars, boats, trailers, TVs, hifi, computers, tablets, mobiles and more will become obvious targets and always at risk. And a change in ownership means a change of user, thereby giving an open door to ongoing data access and misuse of facilities. It is hard to imagine or estimate the depth of the implications for future societies if we advance into the IoT without due caution and effective security measures. For sure, continuing to treat security as an afterthought will see catastrophic failures and disruption to commerce and banking on a massive scale. The good news is: we have more resources and technology available for good that the forces of evil, but only if we share, consolidate and act in unison.

1. Scenarios for the age of everything on line
Mobile and Social Everything
Smart to Smart Everything
The Internet of Things
Clouds of Things
IntelligentThings
Repurposing
Recycling
ReusePeter Cochrane
cochrane.org.uk
ca-global.biz
From Identity to Ownership Theft

2. A looming threat
Everything of value is the next target
wnership theft

3. Ownership
Maintenance
Usage
Updates
Production
++++
LogsComing soon aN IoT/CoT Future
Everything produced tagged, tracked, on-line
• material sourcing
• manufacturing history
• distribution and supply chain
• purchase and ownership details
• application, usage, maintenance, repair
• repurposing, reuse, recycling sequence
• +++

4. Ownership
Maintenance
Usage
Updates
Production
++++
Logs
securing all logs vital
No solutions engineered so far !
• illegal access has to be prevented
• safety and sustainability at stake
• market damage a certainty
• value and validity in danger
• eForgery a real prospect
• ownership is at risk
• +++
Log Access Authority ?
• Producers
• Suppliers
• Repairer
• Maintainer
• Purchaser
• Government
• Agencies
• +++
Log Security ?
• Public Key
• Multi-Layer
• Governance
• +++

5. Ownership
Maintenance
Usage
Updates
Production
++++
Logs
log(s) Protection
Ye t t o b e e n g i n e e r e d !
• cached / distributed master logs ?
• uniform or speciated solution(s) ?
• embedded public key variants ?
• common or variable formats ?
• global standards authority ?
• multiple key authorities ?
• diverse OS and apps ?
• diverse hardware ?
• diverse protocols ?
• evolutionary ?
• +++
Primary Security ?
• Access mechanisms
• Malware protection
• Timely adaptation
• Embedded AI
• Networks
• Protocols
• Ports
• ISPs
• +++

6. networked Protection
New levels of proactive thinking
• design security into the IoT / CoT now
• adopt collaboration as a primary tool
• do not continue on the back foot
• anticipate/plan for worse cases
• embed security at every level
• create a global security plan
• consolidate resources
• share all experiences
• detect and react fast
• automate with AI
• +++
Exploit the new degrees of freedom offered by Clouds
Do not stumble blindly into the IoT / CoT future naked

7. there are no silver bullets
O n l y a g row i n g ra n ge o f t e c h n i q u e s
• staying ahead of developing threats is vital
• use all the old tried and tested solutions
• plus a growing range of new an novel
• this is an evolving space not static
• continual adaptation is key
• multiple solutions only
• concatenation/layered
• real time sharing
• +++

8. Security history
A retroactive patchwork
Growing commercial disruption
A patchwork of measures
Huge damage potential
No proactive thinking
Accelerating threat
Divided resources
Underinvested
Rogue states
Global Scale
Rising costs
MAD
Hackers
Criminals
Rogue states
N o s t r a t e g y

9. what we understand
Given our experiences to date
Attacking is more fun than defence
Malware protection is not enough
The threats are always adapting
More attackers than defenders
Networking increases the threat
The risks are always growing
More devices sees more risk
People are the weakest link
There is always a threat
Firewalls do not work
A
New
Strategy
Imperative

10. what we understand
Given our experiences to date
This is extremely weak & insufficient
Multi-factor variants only a temp fix
We need far more sophistication
We need something easier
Subliminal factors work well
Full integration required
Dongles are impractical
What we know is hidden
Who we are is implicit
What we do habitual
Broader
Thinking
Imperative

11. what we understand
Given our experiences to date
Device designers have to rethink
Service provides have to rethink
Everyone has to be proactive
Devices have to be proactive
Individuals need protecting
Devices need protecting
Adaptation is fundamental
Early detection a necessity
Sharing is fundamental
Proactivity is vital
M o r e
Resources
R e q u i r e d

12. what we understand
Given our experiences to date
A good attacker makes a good defender
Habituality is a shared weakness
Thinking like the enemy is vital
Cross platform attacks the new norm
Cross app exposure now common
Early detection and action are key
War gaming is necessary
Dedicated teams needed
AI engagement needed
More
Investment
E s s e n t i a l

13. THE ATTACK SURFACE
I s a b o u t t o b e w a r p e d
Thousands of Cloud Species
More connectivity modes
More mobile than fixed
New working practices
More on-line than off
The internet of things
Clouds of things
Distributed storage
WiFi domination
Apps on line Greater
Variability
in Everything

14. Identity theft
I t i s s o v e r y e a s y !
Lax security protocols and procedures
Spoof bank calls and paperwork
Big Data, Meta Data analysis
Bogus call centres/services
Spoof eMails, TXT, IMs
Government records
Institutional records
Face to face surveys
Social networking
Company pages
On-line surveys
Home pages
Data mining
Broader
Protection
N e c e s s a r y

15. ownership theft
C o u l d b e e v e n e a s i e r !
Lax security protocols and procedures
Old technologies mixed with the new
Crack one item gives access to all ?
Crack one item to acces the network
Change/control all ownerships
Use ownership as collateral
Ownership affords validity
Viral step and repeat
Creates new crimes
Things as hostages
eBlackmail
+++
Broader
Protection
N e c e s s a r y

16. Axiomatic for sure
I t i s t i m e t o t h i n k a g a i n !
If we do nothing new things will get worse
Non stop learning & adaptation required
Acting in isolation guarantees failure
Continual monitoring necessary
Machines action trumps humans
Networking and sharing are key
Early detection and action vital
Integrated security is a must
Localised quarantene vital
Every level to be protected
Every device proactive
All networks proactive
A New
Era For
Security

17. an obvious analogy
T h e e x i s t e n c e t h e o r e m !
A ubiquitous/universal auto-immune system
Initially engineered to meet known threats
Augmented by ‘timely code inoculation'
Continually learning & adapting
Deployed at every network level
Globally applied and adopted
Many variants/contributions
Industry wide adoption
Full integration a must
Device cooperation A New
Form of
Securit y

18. the practicality
B e y o n d a c o n c e p t !
Hard malware traps on every chip and card
And on every device, card, shelf, suit, floor
Also all network elements/components
Soft malware traps in all code everywhere
Automatic experience/solution sharing
Fully automated response/reporting
Resource sharing and adaptation
Many variants & contributions
Evolution dominates design
Industry wide adoption
Full integration
Behaviour
Emmeregent
& Unpredictable

19. complexity status
A mix of clean and infected
Broadcasting
Malware
Responding
with updated
protection Wider
Network
Updated
Latest
Solution
Update
Dynamic isolation of infected
devices and components
leading to repair

20. a multiplicity of channels
Attack exposure/thwarting via access diversity
BlueTooth
Short Range
Device to Device
Device to Cloud
Attacks seldom isolated or indeed single sourced
Attacks not restricted to a single channel
Defence opportunities in channel diversity
A plurality of channel protection
Real time channel collaboration
Diverse support access
Distributed info sharing
Dynamic access hopping
Secure attack isolation
WiFi/WiMax
Medium Range
WLAN/Cloud
3, 4, 5, 6 G
Long Range
Device to Net
Device to Cloud
SatCom
Broadcast
Integrated and intelligent
security systems embedded
into product and all components

21. protocols, techniques, AI
Being considered but still in the making
Interfaces ?
Encryption ?
Strategies ?
Collaborations ?
Hardware ?
Protocols?
Standards?
Software ?
Systems ?
Players ?
Groups?
Nets ?
Clouds? ?
?
?
?
?
A lot to be done in
a very short time !

22. Lone Hacker
$1Bn
$100M
$10M
$1M
$100k
$10k
Organised Crime
Hacker Groups
Companies
Relative
Spending/
Resources
Rogue States
Gov Agencies
Institutions
Distribution of resources
The misguided, good, bad, and the rogues !

23. Lone Hacker
$1Bn
$100M
$10M
$1M
$100k
$10k
Organised Crime
Hacker Groups
Companies
Relative
Spending/
Resources
Rogue States
Gov Agencies
Institutions
Relative weight of resources
How many, how capable, aggregated capabilities
~1000s
~100s
~10,000s
~1000s
~1000s
~10s
~100s

24. Good
Relative resources
The ratio of aggregated good to bad
Bad
> 3:1
Sufficient for good to prevail over bad !
But ‘bad’ shares resources and knowledge
Whilst ‘good’ operates by ‘need to know’
Sharing knowledge and resources is vital
to assure success !
Best estimate assuming equally
good people and technical
resources on both side of the line:

25. we have to get this right
Fa i l u r e c o u l d b e c a t a s t r o p h i c !
Getting it all right on the night is impossible
Rapid evolution is the obvious answer
Fast response and adaptation wins
Keeping ahead of the enemy
Integration of all resources
Investing appropriately
Thinking well ahead
Acting well in time
No relaxation

26. Thank You
cochrane.org.uk
ca-global.biz
????