Internet of Things security is at its infancy but so was internet security not so long ago. We will overcome this challenge. Learn more about security requirements of an IOT System.

1. Enterprise IoT: Security
Turning a prototype into a viable solution
© 2017. All Rights Reserved

2. What is Security?
How does it apply to the Internet of Things?
© 2017. All Rights Reserved

3. © 2017. All Rights Reserved
Security Fact
100% Secure
from 100% of Threats
is 100% Impossible

4. © 2017. All Rights Reserved
Therefore, security is …

5. © 2017. All Rights Reserved
In the beginning … (Before 1990)
People had personal computers (PC) …
Security concern was physical theft of the PC

6. © 2017. All Rights Reserved
By 1990
Security evolved to a warning ...
May contain viruses

7. © 2017. All Rights Reserved
In the Early 1990’s
We then connected computers in a local network …
Physical theft still remained the primary concern …

8. © 2017. All Rights Reserved
Early 1990’s
… and yes, unscrupulous floppy disks still contained viruses!
May contain viruses

9. © 2017. All Rights Reserved
In the Late 1990’s
AOL introduced people to the internet …
But CxO’s feared the internet and refused employee access.

10. © 2017. All Rights Reserved
In the Mid 2000’s
Thanks to AOL and software sales reps,
CxO’s began seeing value in what the internet offered …

11. © 2017. All Rights Reserved
In the late 2000’s
IT Security profession evolved to create …
Guidelines and Standards
• SSAE16
• ISO 27001
• NIST
• FEDRAMP
• DFAR

12. © 2017. All Rights Reserved
Today
We now have an entire industry providing IT security as a service …
• IDS/IPS – Intrusion Detection System,
Intrusion Prevention System
• DDOS – Distributed Denial of Service
• SOC/NOC – Security Operations Center,
Network Operations Center
• SIEM – Security Information and Event
Management

13. © 2017. All Rights Reserved
What does this have to do with IoT?

14. © 2017. All Rights Reserved
Smart Devices are Everywhere
In our homes
In our offices In our factories
In our vehicles

15. © 2017. All Rights Reserved
Smart Devices are Everywhere
In our homes
In our offices In our factories
In our vehicles
Like PC’s in the 1990’s,
security is to prevent theft and physical harm

16. © 2017. All Rights Reserved
Now we want smart devices connected

17. © 2017. All Rights Reserved
Connecting devices introduces new risks

18. © 2017. All Rights Reserved
Connecting devices introduces new risks
We need new standards, tools, and services

19. © 2017. All Rights Reserved
Challenges
Is the device physically
secure?
Can the device encrypt
data?
Can the device password
be remotely changed?
Can the device firmware be
updated?
Can the device be
controlled remotely?

20. © 2017. All Rights Reserved
When people demanded internet access…
we figured it out.
We will figure out how to secure IoT devices.
Until then …

21. Don’t make it easy for bad things to happen
© 2017. All Rights Reserved
SoftwareInternetThings

22. © 2017. All Rights Reserved
What Bad Could Happen?
Unwanted access / use Unwanted change
Inability to access
Availability

23. For each potential threat:
1. Weigh Impact
• Safety of people
• Protection of physical assets
• Protection of data
• Compliance with regulations
• Cost of a breach
2. Assess Probability
3. Prioritize what to mitigate
4. Put appropriate controls in place
• Include risk mitigation into the design specification
© 2017. All Rights Reserved
Establish Priority

24. © 2017. All Rights Reserved
Thing Development: Hardware/Device
ENGINEERING CONSTRAINTS: COST | POWER | SIZE

25. © 2017. All Rights Reserved
Thing Development: Hardware/Device
ENGINEERING CONSTRAINTS: COST | POWER | SIZE

26. © 2017. All Rights Reserved
Internet: Communication Channel
DRIVEN BY DEVICE CONSTRAINTS: COST | POWER | SIZE + DISTANCE
LTE
3G LoRaWiFi
Sigfox TCP
CoAP MQTT
REST
Network
Mode of transporting data
Internet Protocol
Packaging data for transport
over a network

27. © 2017. All Rights Reserved
Internet: Communication Channel
DRIVEN BY DEVICE CONSTRAINTS: COST | POWER | SIZE + DISTANCE
LTE
3G LoRaWiFi
Sigfox TCP
CoAP MQTT
REST
Network
Mode of transporting data
Internet Protocol
Packaging data for transport
over a network

28. © 2017. All Rights Reserved
Software: Cloud Capabilities
Connect
Devices
Enable
Applications
Process
Data
ENGINEERING CONSTRAINTS: DATA FLOW (3V’S) | RELIABILITY | PROCESSING

29. © 2017. All Rights Reserved
Software: Cloud Capabilities
Connect
Devices
Enable
Applications
Process
Data
ENGINEERING CONSTRAINTS: DATA FLOW (3V’S) | RELIABILITY | PROCESSING

30. © 2017. All Rights Reserved
IoT System Security Controls (examples)
Device Level Application LevelConnectivity Level
• SSL certificates
• Unique device passwords
• Whitelisted IP addresses
• Whitelist phone number (SMS)
• Checksum algorithms
(delivery reliability)
• OTA firmware Updates
• SSL/TLS between platform and device
• VPN to securely send SMS text
messages using SMPP gateways
• Manage and frequently change device
passwords
• Manage firmware updates
• Standard cloud security
(DDOS, IPS/IDS, …)
• Authentication, authorization to access
the platform and applications
• Database encryption
• VPC (Virtual Private Cloud) zone
protected by a firewall (or an equivalent
concept)

31. © 2017. All Rights Reserved
Security – What can you do today?
Identify potential threats early and continuously
Assess Impact and Probability
Put appropriate controls in place
Apply best practices where they exist
100% secure from 100% of threats is 100% impossible, but …
Don’t make it easy for bad things to happen.

32. Questions?
Learn more at Bridgera.com/IOT
© 2017. All Rights Reserved
Ron Pascuzzi
Ron.Pascuzzi@bridgera.com
919-757-1941

33. © 2017. All Rights Reserved
Bridgera IoT
One Platform to Accelerate Your Enterprise IoT Solution
Connect
Devices
Enable
Applications
Process
Data