The world has awakened to the need for tighter security and privacy in consumer-grade IoT offerings. This panel will present a trust framework for IoT, and wearable and smart home experts will discuss top attack vectors, typical vulnerabilities in devices, apps and systems, common reasons for design compromise, the evolution of security and privacy in IoT and where it needs to go Learning Objectives: 1: Understand security and privacy best practices for IoT product designs. 2: Explore specific examples of common design pitfalls and how to avoid them. 3: Obtain a risk assessment checklist for use in evaluating/procuring IoT solutions. (Source: RSA Conference USA 2018)

1. SESSION ID:
MODERATOR:
#RSAC
PANELISTS:
MBS-T10
Marc Bown
Senior Director, Security
Fitbit
@marcbown
Jeff Wilbur
Director, Online Trust Alliance initiative, Internet Society
@jeffwilbur01
IOT TRUST BY DESIGN -
LESSONS LEARNED IN WEARABLES
AND SMART HOME PRODUCTS
John Cook
Sr Director, Product Management
Symantec
@disruptprodsguy

2. #RSAC
Poll the Audience
2
Session MBS-T10
Are you an IoT manufacturer, do you manage IoT in the enterprise or
neither?
A – IoT manufacturer
B – Manage enterprise IoT
C – Neither
https://rsa1-live.eventbase.com/polls?event=rsa2018&polls=3802

3. #RSAC
Why Are We Here?
3

4. #RSAC
What’s at Risk?
4
Smartwatches
& wearables
74 F
Connected
thermostats
Home alarm
systems
Wireless
doorbells
Real-time
video
monitoring
Smart
televisions
with built in
apps
Streaming
boxes for
”regular” TVs
Gaming
consoles
Plugs to make
other things
“smart”
Smart
lights
Connected
appliances
Source: Symantec

5. #RSAC
Are Attacks Really Happening?
5
Threats Blocked
Per Home, Per Day
22 Malware Blocked
~8.3/day
Phishing Blocked
~1.2/day
Botnets Blocked
~5.4/day
Scams Blocked
~0.4/day
Spam Blocked
~1/day
PUP Blocked
~1/day
Source: Symantec

6. #RSAC
Poll the Audience
6
Session MBS-T10
Which part of the system requires the most "trust by design"
discipline to ensure proper security and privacy?
A – Devices and sensors
B – Mobile apps
C – Back-end services
https://rsa1-live.eventbase.com/polls?event=rsa2018&polls=3803

7. #RSAC
Where Do Vulnerabilities Lie?
7
Key device sub-systems
Processor/memory/platform
Radios
Battery
Software stacks
Apps and Platforms Cloud & Web Services
Devices & Sensors

8. #RSAC
Assessing Attack “Reach”
8
Number of Devices Reached
Proximity
of Attack
Home WiFi attack
IoT worm
Low High
Near
Far

9. #RSAC
Poll the Audience
9
Session MBS-T10
What is the biggest reason security and privacy capability get
compromised when developing consumer-grade IoT products?
A – Cost
B – Time
C – Not a priority
https://rsa1-live.eventbase.com/polls?event=rsa2018&polls=3804

10. #RSAC
Addressing IoT Security and Privacy
10
The Online Trust Alliance’s IoT Trust Framework principles address
Security, privacy and lifecycle issues
Cover devices/sensors, apps and backend services
Authentication
CommunicationsControlDisclosuresPrivacy
UpdatesSecurityEncryption

11. #RSAC
Using Consumer-Grade IoT in the Enterprise
11
Newly released checklist for handling
consumer-grade IoT in the enterprise
Organized “chronologically”, from
purchase and installation through
maintenance and end of life

12. #RSAC
Lessons Learned
12
Top 2-3 lessons
to deliver on IoT
“trust by design”

13. #RSAC
Resources
13
OTA IoT Trust Framework –
https://otalliance.org/system/files/files/initiative/documents/iot_trust_framework6-22.pdf
Consumer-Grade IoT in the Enterprise – A Security Checklist
https://otalliance.org/system/files/files/initiative/documents/enterprise_iot_checklist.pdf