Slides from a CIS2015 talk covering some of the challenges the industry faces in industrial IoT relating to security and identity.

1. Practical Identity
in the
IoT Era
Morteza Ansari

6. • Trustworthiness
Integrity
Tamperproof
Anti-cloning
• Device identity & identity context
• Provisioning & associated life cycle
• Authorization and access
• Bridging modern & legacy
• …

9. System
Integrator
Owner Operator

10. OEM
OEM
System
Integrator
Owner
Operator
App
…

11. App
App
Operator
System
Integrator
OEM
OEM
System
Integrator
Owner
Operator
…

12. App
App
Operator
System
Integrator
OEM
OEM
System
Integrator
Owner
Operator
…

13. ✓ Read diagnostic data
✓ Run diagnostic routines
✗ Read movement
✗ Write movement
? Update firmware

14. ✓ Read diagnosticdata
✓ Run diagnostic routines
✗ Read movement
✗ Write movement
✗ Read program
? Update firmware
✓ Read diagnosticdata
✓ Run diagnostic routines
✗ Read movement
✗ Write movement
✗ Read program
? Update firmware
✓ Read diagnosticdata
✓ Run diagnostic routines
✗ Read movement
✗ Write movement
✗ Read program
? Update firmware
✓ Read diagnosticdata
✓ Run diagnostic routines
✗ Read movement
✗ Write movement
✗ Read program
? Update firmware
✓ Read diagnosticdata
✓ Run diagnostic routines
✗ Read movement
✗ Write movement
✗ Read program
? Update firmware
✓ Read diagnosticdata
✓ Run diagnostic routines
✗ Read movement
✗ Write movement
✗ Read program
? Update firmware
✓ Read diagnosticdata
✓ Run diagnostic routines
✗ Read movement
✗ Write movement
✗ Read program
? Update firmware

15. Location
Network
Trustworthiness
Calibration
Health
…

16. • Bridging legacy & modern
• Not all devices are created equal
• Life expectancy of industrial devices
• IT vs. OT
• Access:
Remote locations
Unreliable connectivity
Low bandwidth
Very complex failure scenarios
• Privacy!

17. • Too static, too fragile, too vulnerable
• Device identity context
• Risk based policies
• Dynamic & continuous identity
• Standardization
• Identity life cycle
• Identity  security