SlideShare a Scribd company logo
FIXING THE LAST MISSING PIECE IN SECURING IOT
Ng Kok Leong
Senior Lecturer & Consultant, ISS, NUS
© Copyright National University of Singapore. All Rights Reserved 1
OVER
GRADUATE
ALUMNI5,900
OFFERING OVER
130
ENTERPRISE IT, INNOVATION
& LEADERSHIP PROGRAMMES
TRAINING OVER
130,000
DIGITAL LEADERS
& PROFESSIONALS
Agenda
© Copyright National University of Singapore. All Rights Reserved 2
Security Controls
Security Risks
Security Requirements
(1) Cloud(3) IoT
(2) Data in transit
© Copyright National University of Singapore. All Rights Reserved 3
(1) Securing Data in the Cloud
TDE: Transparent Database Encryption
© Copyright National University of Singapore. All Rights Reserved 4
Image source: https://docs.microsoft.com/en-
us/azure/security/azure-security-encryption-atrest
Cloud HSM (Hardware Security Module)
© Copyright National University of Singapore. All Rights Reserved 5Image source: https://aws.amazon.com/cloudhsm/
HSM: Hardware Security Module
© Copyright National University of Singapore. All Rights Reserved 6
Image source:
https://hackernoon.com/the-thing-about-hardware-security-modules-6f2cc38b5319
https://www.secureidnews.com/news-item/hardware-security-modules-the-gold-standard-for-
encryption-key-security/
“Bring Your Own Key”
© Copyright National University of Singapore. All Rights Reserved 7Image source: https://www.ncipher.com/blog/category/data-security?page=9
What are the Security Controls?
For securing IoT data in the cloud
© Copyright National University of Singapore. All Rights Reserved 8
TDE Transparent Database Encryption
HSM Hardware Security Module
and others …
What is Security Requirement?
© Copyright National University of Singapore. All Rights Reserved 9
Data Confidentiality
What we don’t want to lose?
© Copyright National University of Singapore. All Rights Reserved 10
(2) Securing Data in Transit
End-to-End Encryption
© Copyright National University of Singapore. All Rights Reserved 11
Image source: https://www.intrinsic-id.com/markets/connectivity-ics/
TLS (or SSL, which is still commonly known as)
© Copyright National University of Singapore. All Rights Reserved 12
Image source:
https://www.cloudflare.com/learning/ssl/what-is-ssl/
https://yourshop.com/security-b19.html
TLS: Transport Layer Security
SSL: Secure Sockets Layer
TLS utilized by IoT
© Copyright National University of Singapore. All Rights Reserved 13Image source: https://www.digi.com/videos/connecting-digi-xbee3-cellular-to-aws-with-mqtt
MQTT: Message Queuing Telemetry Transport
© Copyright National University of Singapore. All Rights Reserved 14Image source: https://aws.amazon.com/iot-core/
MQTT protocol recommends use of TLS for more sensitive MQTT implementations
MQTT: a publish / subscribe protocol
© Copyright National University of Singapore. All Rights Reserved 15Image source: https://www.hivemq.com/blog/how-to-get-started-with-mqtt
MQTT protocol was invented by IBM back in 1999 for satellite communications with oil-field equipment.
© Copyright National University of Singapore. All Rights Reserved 16
Problem: TLS is not lightweight
• TLS adds additional two round trips to the start of every session
• TLS certificates are large files, and device memory is limited in IoT
TLS v1.3 - improved version
© Copyright National University of Singapore. All Rights Reserved 17Image source: https://blog.cloudflare.com/why-iot-is-insecure/
TLS 1.3 eliminates a complete round trip in the TLS
handshake, which makes TLS much lighter and faster
If the same IoT device talks to the same server again,
there is no round trip at all, as the parameters chosen in
the initial handshake are sent alongside application data.
CoAP: Constrained Application Protocol
© Copyright National University of Singapore. All Rights Reserved 18Image source: https://www.rfwireless-world.com/Terminology/COAP-vs-MQTT.html
CoAP was created by IETF.
It was designed for use by constrained devices on constrained network (low-power, lossy networks).
CoAP utilizes DTLS
© Copyright National University of Singapore. All Rights Reserved 19
Image source:
https://www.semanticscholar.org/paper/Lightweight-DTLS-
Implementation-in-CoAP-based-IoT-Lakkundi-Singh
UDP is more lightweight than TCP
© Copyright National University of Singapore. All Rights Reserved 20
Image source: https://www.pubnub.com/blog/why-you-should-run-
your-game-servers-separate-from-your-chat/
No ordering of messages
No tracking connections
DTLS: session initialization not any lighter (to IoT)
© Copyright National University of Singapore. All Rights Reserved 21Image source: https://blog.cloudflare.com/why-iot-is-insecure/
Another Problem:
IoT Gateway breaks end-to-end encryption
© Copyright National University of Singapore. All Rights Reserved 22Image source: https://cloud.google.com/iot/docs/how-tos/gateways/
Object Security for Constrained RESTful
Environments (OSCORE)
© Copyright National University of Singapore. All Rights Reserved 23
• A method for application-layer protection of the
Constrained Application Protocol, using object
signing and encryption. (under Internet draft)
• OSCORE provides end-to-end protection
between endpoints communicating using CoAP.
• Designed for constrained nodes.
Image source: https://tools.ietf.org/id/draft-ietf-core-object-security-15.html
Deployment Example
What are the Security Controls?
For securing IoT data in transit
© Copyright National University of Singapore. All Rights Reserved 24
DTLS Datagram Transport Layer Security
TLS Transport Layer Security
OSCORE
Object Security for Constrained
RESTful Environments
What are Security Requirements?
© Copyright National University of Singapore. All Rights Reserved 25
Data Confidentiality
What we don’t want to lose?
Data Integrity
Confidentiality throughout end-to-end
© Copyright National University of Singapore. All Rights Reserved 26
(3) Securing Data in IoT
What is constrained IoT device?
© Copyright National University of Singapore. All Rights Reserved 27Image source: https://www.cisoplatform.com/profiles/blogs/classification-of-iot-devices
Classes of Constrained Devices (1)
© Copyright National University of Singapore. All Rights Reserved 28
Image source:
https://www.cisoplatform.com/profiles/blogs/classification-of-iot-devices
https://tools.ietf.org/html/rfc7228
Examples of constraints:-
• Processing power
• Size of memory
• Availability of power source
IETF’s RFC 7228 classifies the constrained devices into 3 categories
Classes of Constrained Devices (2)
© Copyright National University of Singapore. All Rights Reserved 29
Class 2 – not so constrained
• Less constrained and can perform at par with
mobiles phones / notebooks, supporting most
protocol stacks.
Class 1 – quite constrained
• Quite constrained in code space and
processing capabilities to employ full protocol
stack such as HTTP, TLS. Hence, use IoT
stack like UDP, CoAP, DTLS
• Interact with other devices without the need of
gateway.
Class 0 – too small to securely run on Internet
• Constrains in memory and processing
capabilities.
• Use Gateway for basic communication need.
Image source: https://www.rfwireless-world.com/Terminology/COAP-vs-MQTT.html
Constrained Device Class 0 – medical device
© Copyright National University of Singapore. All Rights Reserved 30
Image source:
https://pdfs.semanticscholar.org/6a25/e93587dde53966
b3f0830ed9b78023c2cadd.pdf
Constrained Device Class 0 – pacemaker
© Copyright National University of Singapore. All Rights Reserved 31
Image source:
https://www.aboutkidshealth.ca/Article?contentid=980&language=English
http://caifl.com/cardiac-devices/pacemakers/
https://www.sciencedirect.com/topics/nursing-and-health-professions/pacemaker-battery
© Copyright National University of Singapore. All Rights Reserved 32
Is “remote attack” feasible with
class 0 constrained device?
© Copyright National University of Singapore. All Rights Reserved 33
Is “remote attack” feasible with the
IoT Gateway?
© Copyright National University of Singapore. All Rights Reserved 34
Is “physical attack” feasible with
class 0 constrained device?
What is the risk?
© Copyright National University of Singapore. All Rights Reserved 35Image source: https://medium.com
© Copyright National University of Singapore. All Rights Reserved 36
Is “remote attack” feasible with the
IoT Gateway?
For this to happen,
We have to assume there is a “vulnerability” in the IoT gateway.
What is the probability of the threat exploiting the vulnerability?
What is the impact if the risk materialized?
Returning to this question and
assume risk is high, for discussion
Risk Treatment
© Copyright National University of Singapore. All Rights Reserved 37
Accept
Avoid
Transfer
Mitigate
Sharing For the cloud computing
Prescribe Security Controls
Problem?
© Copyright National University of Singapore. All Rights Reserved 38
Outdated software
Solution? Software/firmware Patching (plus other usual IT stuffs …)
Source: https://www.zdnet.com/article/how-iot-hackers-
turned-a-universitys-network-against-itself/
© Copyright National University of Singapore. All Rights Reserved 39
Source: https://www.iottechnews.com/news/2017/jan/20/study-
reveals-80-percent-iot-apps-left-unsecured/
What are the Security Controls?
For securing IoT data in IoT device
© Copyright National University of Singapore. All Rights Reserved 40
Software Patching
and others …
Over the Air update
In IoT, patching is known as
Over the Air Update
© Copyright National University of Singapore. All Rights Reserved 41Image source: https://blog.particle.io/2019/05/09/ota-firmware-updates/
Over the Air Update
© Copyright National University of Singapore. All Rights Reserved 42
Image source:
http://www.iphonehacks.com/install-ios-7-0-4-update-iphone-ipad
https://searchmobilecomputing.techtarget.com/definition/OTA-update-over-the-air-update
Previously, user needed to connect iphone to computer
using USB cable to update OS through iTunes.
With OTA, Apple can deliver updates remotely
What are Security Requirements?
© Copyright National University of Singapore. All Rights Reserved 43
Data privacy
What we don’t want to lose?
Safety
© Copyright National University of Singapore. All Rights Reserved 44
Assume “physical proximity” attack
is feasible, what are the security
controls?
The attacker bypass “remote attack” and get close proximity to your target.
Pay using
Fitbit watch
© Copyright National University of Singapore. All Rights Reserved 45
Image source: https://www.todayonline.com/singapore/fitbit-
users-can-now-tap-their-wrists-pay-train-and-bus-rides
How to
evaluate the
security of
this IoT?
Evaluate the Microcontroller (among others…)
© Copyright National University of Singapore. All Rights Reserved 46Image source: https://hexus.net/static/techdrive/?sf32731391=1
Fitbit Flex
ARM Cortex M3 processor
Fitbit Ionic Watch
© Copyright National University of Singapore. All Rights Reserved 47
Image source:
https://electronics360.globalspec.com/articl
e/11796/teardown-fitbit-ionic-fb503
ARM Cortex
M4 processor
Who is ARM?
© Copyright National University of Singapore. All Rights Reserved 48
Image source:
https://www.fudzilla.com/news/processors/40000-
arm-cortex-r8-processor-design-is-out
1) ARM creates processor
designs but it does not
produce any physical
products.
2) The technology (IP) is
licensed to other companies
who design and build their
own processors based on
ARM’s design, e.g. Texas
Instruments, Samsung.
ARM Processors
© Copyright National University of Singapore. All Rights Reserved 49Image source: https://www.arm.com/products/silicon-ip-cpu
Cortex-M series for IoT
ARM IoT
SoC Solutions
© Copyright National University of Singapore. All Rights Reserved 50Image source: https://www.arm.com/products/silicon-ip-cpu
Cortex-M processor: Architecture
© Copyright National University of Singapore. All Rights Reserved 51
• ARMv6-M architecture
• Cortex-M0, Cortex-M0+, Cortex-M1
• ARMv7-M architecture
• Cortex-M3, Cortex-M4, Cortex-M7
• ARMv8-M architecture
• Cortex-M23, Cortex-M33, Cortex-M35P
ARMv8-M processor architecture differentiates from
security perspective because it has “trustzone” technology
Trustzone Technology
© Copyright National University of Singapore. All Rights Reserved 52Image source: https://www.arm.com/why-arm/technologies/trustzone-for-cortex-m
Trustzone Technology
© Copyright National University of Singapore. All Rights Reserved 53Source: K5_Addressing_IoT_and_Embedded_Security_at_the_Chip_Level_Roni.pdf
Creating isolation in
single processor,
resulting in one
trusted zone and one
non-trusted zone,
which previously
requires 2 processors
to achieve.
© Copyright National University of Singapore. All Rights Reserved 54Image source: https://www.kwtrain.com/blog/network-security-zones
Trusted zone Non-trusted zone
Isolation illustration:
trusted zone vs non-trusted zone
Root of Trust
© Copyright National University of Singapore. All Rights Reserved 55
Image source: https://www.slideshare.net/linaroorg/sfo17-
304-demystifying-ro-tfinallc-83555369
Root of Trust (RoT) is a source that can always be trusted within a cryptographic
system. It generally includes a hardened hardware module.
Secure Boot
© Copyright National University of Singapore. All Rights Reserved 56
Image source:
https://www.dignited.com/36748/what-is-secure-boot-on-windows/
https://docs.microsoft.com/en-us/windows-hardware/design/device-
experiences/oem-secure-boot
What are the Security Controls?
© Copyright National University of Singapore. All Rights Reserved 57
Trustzone technology
and others …
What are Security Requirements?
© Copyright National University of Singapore. All Rights Reserved 58
Secure Boot
Root of Trust
© Copyright National University of Singapore. All Rights Reserved 59
Assume “physical” attack is
feasible, what are the security
controls?
The attacker hacks the physical IoT device
ARM launches anti-tampering processor, M35P
© Copyright National University of Singapore. All Rights Reserved 60
Image source: https://venturebeat.com/2018/05/02/arm-designs-anti-
tampering-and-software-isolation-into-its-processors/
Look out for release of chip based on M35p
What are the Security Controls?
© Copyright National University of Singapore. All Rights Reserved 61
Anti-tampering IoT processor
What are Security Requirements?
© Copyright National University of Singapore. All Rights Reserved 62
Tamper-resistant IoT device
(at microcontroller level)
In summary
• If you are security professional (or role),
• Know the security controls available
• Securing data in the cloud
• Securing data in transit
• Securing data in IoT device
• Assess risk and prescribe the right level of security controls to meet
business need
• If you are IoT project business/owner/team,
• Determine the security requirements
• Understand the risk assessment and accept/approve/amend the
recommendation of security controls
© Copyright National University of Singapore. All Rights Reserved 63
© Copyright National University of Singapore. All Rights Reserved 64
Image source: https://www.slideshare.net/AmazonWebServices/managing-
security-with-aws-aws-public-sector-summit-2017
• The project can’t possibly
utilizes all security controls,
whether cloud or IoT.
• It’s the security
professional role to
prescribe the right level of
security controls to meet
business need.
Lastly, AWS cloud has 2600+ security controls
65© Copyright National University of Singapore. All Rights Reserved
www www.iss.nus.edu.sg
facebook.com/ISS.NUS
twitter.com/ISSNUS
@iss.nus
linkedin.com/company/iss.nus
youtube.com/user/TheISSNUS/

More Related Content

What's hot

Security challenges for IoT
Security challenges for IoTSecurity challenges for IoT
Security challenges for IoTWSO2
 
IoT security patterns
IoT security patterns IoT security patterns
IoT security patterns
Exosite
 
Iot(security)
Iot(security)Iot(security)
Iot(security)
Shreya Pohekar
 
Iot Security, Internet of Things
Iot Security, Internet of ThingsIot Security, Internet of Things
Iot Security, Internet of Things
Bryan Len
 
IoT security
IoT securityIoT security
IoT security
YashKesharwani2
 
IoT Security and Privacy Considerations
IoT Security and Privacy ConsiderationsIoT Security and Privacy Considerations
IoT Security and Privacy Considerations
Kenny Huang Ph.D.
 
Ryan Wilson - ryanwilson.com - IoT Security
Ryan Wilson - ryanwilson.com -  IoT SecurityRyan Wilson - ryanwilson.com -  IoT Security
Ryan Wilson - ryanwilson.com - IoT Security
Ryan Wilson
 
KazHackStan Doing The IoT Penetration Testing - Yogesh Ojha
KazHackStan Doing The IoT Penetration Testing - Yogesh OjhaKazHackStan Doing The IoT Penetration Testing - Yogesh Ojha
KazHackStan Doing The IoT Penetration Testing - Yogesh Ojha
Yogesh Ojha
 
IOT Security
IOT SecurityIOT Security
IOT Security
Sylvain Martinez
 
IoT Security: Cases and Methods
IoT Security: Cases and MethodsIoT Security: Cases and Methods
IoT Security: Cases and Methods
Leonardo De Moura Rocha Lima
 
Understanding IoT Security: How to Quantify Security Risk of IoT Technologies
Understanding IoT Security: How to Quantify Security Risk of IoT TechnologiesUnderstanding IoT Security: How to Quantify Security Risk of IoT Technologies
Understanding IoT Security: How to Quantify Security Risk of IoT Technologies
Denim Group
 
Practical IoT Security in the Enterprise
Practical IoT Security in the EnterprisePractical IoT Security in the Enterprise
Practical IoT Security in the Enterprise
Daniel Miessler
 
Mark Horowitz - Stanford Engineering - Securing the Internet of Things
Mark Horowitz - Stanford Engineering - Securing the Internet of ThingsMark Horowitz - Stanford Engineering - Securing the Internet of Things
Mark Horowitz - Stanford Engineering - Securing the Internet of Things
Stanford School of Engineering
 
Securing Internet of Things
Securing Internet of ThingsSecuring Internet of Things
Securing Internet of Things
Rishabh Sharma
 
IoT Security: Cases and Methods [CON5446]
IoT Security: Cases and Methods [CON5446]IoT Security: Cases and Methods [CON5446]
IoT Security: Cases and Methods [CON5446]
Leonardo De Moura Rocha Lima
 
IoT Security, Mirai Revisited
IoT Security, Mirai RevisitedIoT Security, Mirai Revisited
IoT Security, Mirai Revisited
Clare Nelson, CISSP, CIPP-E
 
Security and Privacy considerations in Internet of Things
Security and Privacy considerations in Internet of ThingsSecurity and Privacy considerations in Internet of Things
Security and Privacy considerations in Internet of Things
Somasundaram Jambunathan
 
Security Fundamental for IoT Devices; Creating the Internet of Secure Things
Security Fundamental for IoT Devices; Creating the Internet of Secure ThingsSecurity Fundamental for IoT Devices; Creating the Internet of Secure Things
Security Fundamental for IoT Devices; Creating the Internet of Secure Things
Design World
 
Internet of Things Security
Internet of Things SecurityInternet of Things Security
Internet of Things Security
Tutun Juhana
 
Security Aspects in IoT - A Review
Security Aspects in IoT - A Review Security Aspects in IoT - A Review
Security Aspects in IoT - A Review
Asiri Hewage
 

What's hot (20)

Security challenges for IoT
Security challenges for IoTSecurity challenges for IoT
Security challenges for IoT
 
IoT security patterns
IoT security patterns IoT security patterns
IoT security patterns
 
Iot(security)
Iot(security)Iot(security)
Iot(security)
 
Iot Security, Internet of Things
Iot Security, Internet of ThingsIot Security, Internet of Things
Iot Security, Internet of Things
 
IoT security
IoT securityIoT security
IoT security
 
IoT Security and Privacy Considerations
IoT Security and Privacy ConsiderationsIoT Security and Privacy Considerations
IoT Security and Privacy Considerations
 
Ryan Wilson - ryanwilson.com - IoT Security
Ryan Wilson - ryanwilson.com -  IoT SecurityRyan Wilson - ryanwilson.com -  IoT Security
Ryan Wilson - ryanwilson.com - IoT Security
 
KazHackStan Doing The IoT Penetration Testing - Yogesh Ojha
KazHackStan Doing The IoT Penetration Testing - Yogesh OjhaKazHackStan Doing The IoT Penetration Testing - Yogesh Ojha
KazHackStan Doing The IoT Penetration Testing - Yogesh Ojha
 
IOT Security
IOT SecurityIOT Security
IOT Security
 
IoT Security: Cases and Methods
IoT Security: Cases and MethodsIoT Security: Cases and Methods
IoT Security: Cases and Methods
 
Understanding IoT Security: How to Quantify Security Risk of IoT Technologies
Understanding IoT Security: How to Quantify Security Risk of IoT TechnologiesUnderstanding IoT Security: How to Quantify Security Risk of IoT Technologies
Understanding IoT Security: How to Quantify Security Risk of IoT Technologies
 
Practical IoT Security in the Enterprise
Practical IoT Security in the EnterprisePractical IoT Security in the Enterprise
Practical IoT Security in the Enterprise
 
Mark Horowitz - Stanford Engineering - Securing the Internet of Things
Mark Horowitz - Stanford Engineering - Securing the Internet of ThingsMark Horowitz - Stanford Engineering - Securing the Internet of Things
Mark Horowitz - Stanford Engineering - Securing the Internet of Things
 
Securing Internet of Things
Securing Internet of ThingsSecuring Internet of Things
Securing Internet of Things
 
IoT Security: Cases and Methods [CON5446]
IoT Security: Cases and Methods [CON5446]IoT Security: Cases and Methods [CON5446]
IoT Security: Cases and Methods [CON5446]
 
IoT Security, Mirai Revisited
IoT Security, Mirai RevisitedIoT Security, Mirai Revisited
IoT Security, Mirai Revisited
 
Security and Privacy considerations in Internet of Things
Security and Privacy considerations in Internet of ThingsSecurity and Privacy considerations in Internet of Things
Security and Privacy considerations in Internet of Things
 
Security Fundamental for IoT Devices; Creating the Internet of Secure Things
Security Fundamental for IoT Devices; Creating the Internet of Secure ThingsSecurity Fundamental for IoT Devices; Creating the Internet of Secure Things
Security Fundamental for IoT Devices; Creating the Internet of Secure Things
 
Internet of Things Security
Internet of Things SecurityInternet of Things Security
Internet of Things Security
 
Security Aspects in IoT - A Review
Security Aspects in IoT - A Review Security Aspects in IoT - A Review
Security Aspects in IoT - A Review
 

Similar to Fixing the Last Missing Piece in Securing IoT

Advance security in cloud computing for military weapons
Advance security in cloud computing for military weaponsAdvance security in cloud computing for military weapons
Advance security in cloud computing for military weapons
IRJET Journal
 
Fog and Internet of Things Network Security through Blowfish Cipher
Fog and Internet of Things Network Security through Blowfish CipherFog and Internet of Things Network Security through Blowfish Cipher
Fog and Internet of Things Network Security through Blowfish Cipher
BRNSSPublicationHubI
 
Eclipse kura
Eclipse kuraEclipse kura
Eclipse kura
Isham Mohamed Iqbal
 
Trends on Data Graphs & Security for the Internet of Things
Trends on Data Graphs & Security for the Internet of ThingsTrends on Data Graphs & Security for the Internet of Things
Trends on Data Graphs & Security for the Internet of Things
Ghislain Atemezing
 
SYSTEM SECURITY - Chapter 1 introduction
SYSTEM SECURITY - Chapter 1   introductionSYSTEM SECURITY - Chapter 1   introduction
SYSTEM SECURITY - Chapter 1 introductionAfna Crcs
 
Crypto Mechanism to Provide Secure to the IOT Data
Crypto Mechanism to Provide Secure to the IOT DataCrypto Mechanism to Provide Secure to the IOT Data
Crypto Mechanism to Provide Secure to the IOT Data
IRJET Journal
 
Internet Protocol Security as the Network Cryptography System
Internet Protocol Security as the Network Cryptography SystemInternet Protocol Security as the Network Cryptography System
Internet Protocol Security as the Network Cryptography System
Universitas Pembangunan Panca Budi
 
What is a secure enterprise architecture roadmap?
What is a secure enterprise architecture roadmap?What is a secure enterprise architecture roadmap?
What is a secure enterprise architecture roadmap?
Ulf Mattsson
 
IRJET- Multimedia Content Security with Random Key Generation Approach in...
IRJET-  	  Multimedia Content Security with Random Key Generation Approach in...IRJET-  	  Multimedia Content Security with Random Key Generation Approach in...
IRJET- Multimedia Content Security with Random Key Generation Approach in...
IRJET Journal
 
Keynote WFIoT2019 - Data Graph, Knowledge Graphs Ontologies, Internet of Thin...
Keynote WFIoT2019 - Data Graph, Knowledge Graphs Ontologies, Internet of Thin...Keynote WFIoT2019 - Data Graph, Knowledge Graphs Ontologies, Internet of Thin...
Keynote WFIoT2019 - Data Graph, Knowledge Graphs Ontologies, Internet of Thin...
Amélie Gyrard
 
1. How will the IoT help your business - cisco
1. How will the IoT help your business - cisco1. How will the IoT help your business - cisco
1. How will the IoT help your business - cisco
MITEF México
 
IRJET- Revisiting Security Aspects of Internet of Things for Self-Managed...
IRJET-  	  Revisiting Security Aspects of Internet of Things for Self-Managed...IRJET-  	  Revisiting Security Aspects of Internet of Things for Self-Managed...
IRJET- Revisiting Security Aspects of Internet of Things for Self-Managed...
IRJET Journal
 
Chapter 1 2
Chapter 1 2Chapter 1 2
Chapter 1 2
Baggam Sailusha
 
Cyber security
Cyber securityCyber security
Cyber security
Aman Pradhan
 
IRJET - Multimedia Security on Cloud Computing using Cryptography
IRJET - Multimedia Security on Cloud Computing using CryptographyIRJET - Multimedia Security on Cloud Computing using Cryptography
IRJET - Multimedia Security on Cloud Computing using Cryptography
IRJET Journal
 
IRJET- Multifactor Authentication in IoT Devices for Ensuring Secure Cloud St...
IRJET- Multifactor Authentication in IoT Devices for Ensuring Secure Cloud St...IRJET- Multifactor Authentication in IoT Devices for Ensuring Secure Cloud St...
IRJET- Multifactor Authentication in IoT Devices for Ensuring Secure Cloud St...
IRJET Journal
 
5G and IoT Security
5G and IoT Security5G and IoT Security
5G and IoT Security
NUS-ISS
 
Internet of Things IoT Security Perspective
Internet of Things IoT Security PerspectiveInternet of Things IoT Security Perspective
Internet of Things IoT Security Perspective
ijtsrd
 
SAM-IoT: Securing low power device communication in critical infrastructure m...
SAM-IoT: Securing low power device communication in critical infrastructure m...SAM-IoT: Securing low power device communication in critical infrastructure m...
SAM-IoT: Securing low power device communication in critical infrastructure m...
Brain IoT Project
 
The Internet of Things: We've Got to Chat
The Internet of Things: We've Got to ChatThe Internet of Things: We've Got to Chat
The Internet of Things: We've Got to Chat
Duo Security
 

Similar to Fixing the Last Missing Piece in Securing IoT (20)

Advance security in cloud computing for military weapons
Advance security in cloud computing for military weaponsAdvance security in cloud computing for military weapons
Advance security in cloud computing for military weapons
 
Fog and Internet of Things Network Security through Blowfish Cipher
Fog and Internet of Things Network Security through Blowfish CipherFog and Internet of Things Network Security through Blowfish Cipher
Fog and Internet of Things Network Security through Blowfish Cipher
 
Eclipse kura
Eclipse kuraEclipse kura
Eclipse kura
 
Trends on Data Graphs & Security for the Internet of Things
Trends on Data Graphs & Security for the Internet of ThingsTrends on Data Graphs & Security for the Internet of Things
Trends on Data Graphs & Security for the Internet of Things
 
SYSTEM SECURITY - Chapter 1 introduction
SYSTEM SECURITY - Chapter 1   introductionSYSTEM SECURITY - Chapter 1   introduction
SYSTEM SECURITY - Chapter 1 introduction
 
Crypto Mechanism to Provide Secure to the IOT Data
Crypto Mechanism to Provide Secure to the IOT DataCrypto Mechanism to Provide Secure to the IOT Data
Crypto Mechanism to Provide Secure to the IOT Data
 
Internet Protocol Security as the Network Cryptography System
Internet Protocol Security as the Network Cryptography SystemInternet Protocol Security as the Network Cryptography System
Internet Protocol Security as the Network Cryptography System
 
What is a secure enterprise architecture roadmap?
What is a secure enterprise architecture roadmap?What is a secure enterprise architecture roadmap?
What is a secure enterprise architecture roadmap?
 
IRJET- Multimedia Content Security with Random Key Generation Approach in...
IRJET-  	  Multimedia Content Security with Random Key Generation Approach in...IRJET-  	  Multimedia Content Security with Random Key Generation Approach in...
IRJET- Multimedia Content Security with Random Key Generation Approach in...
 
Keynote WFIoT2019 - Data Graph, Knowledge Graphs Ontologies, Internet of Thin...
Keynote WFIoT2019 - Data Graph, Knowledge Graphs Ontologies, Internet of Thin...Keynote WFIoT2019 - Data Graph, Knowledge Graphs Ontologies, Internet of Thin...
Keynote WFIoT2019 - Data Graph, Knowledge Graphs Ontologies, Internet of Thin...
 
1. How will the IoT help your business - cisco
1. How will the IoT help your business - cisco1. How will the IoT help your business - cisco
1. How will the IoT help your business - cisco
 
IRJET- Revisiting Security Aspects of Internet of Things for Self-Managed...
IRJET-  	  Revisiting Security Aspects of Internet of Things for Self-Managed...IRJET-  	  Revisiting Security Aspects of Internet of Things for Self-Managed...
IRJET- Revisiting Security Aspects of Internet of Things for Self-Managed...
 
Chapter 1 2
Chapter 1 2Chapter 1 2
Chapter 1 2
 
Cyber security
Cyber securityCyber security
Cyber security
 
IRJET - Multimedia Security on Cloud Computing using Cryptography
IRJET - Multimedia Security on Cloud Computing using CryptographyIRJET - Multimedia Security on Cloud Computing using Cryptography
IRJET - Multimedia Security on Cloud Computing using Cryptography
 
IRJET- Multifactor Authentication in IoT Devices for Ensuring Secure Cloud St...
IRJET- Multifactor Authentication in IoT Devices for Ensuring Secure Cloud St...IRJET- Multifactor Authentication in IoT Devices for Ensuring Secure Cloud St...
IRJET- Multifactor Authentication in IoT Devices for Ensuring Secure Cloud St...
 
5G and IoT Security
5G and IoT Security5G and IoT Security
5G and IoT Security
 
Internet of Things IoT Security Perspective
Internet of Things IoT Security PerspectiveInternet of Things IoT Security Perspective
Internet of Things IoT Security Perspective
 
SAM-IoT: Securing low power device communication in critical infrastructure m...
SAM-IoT: Securing low power device communication in critical infrastructure m...SAM-IoT: Securing low power device communication in critical infrastructure m...
SAM-IoT: Securing low power device communication in critical infrastructure m...
 
The Internet of Things: We've Got to Chat
The Internet of Things: We've Got to ChatThe Internet of Things: We've Got to Chat
The Internet of Things: We've Got to Chat
 

More from NUS-ISS

Designing Impactful Services and User Experience - Lim Wee Khee
Designing Impactful Services and User Experience - Lim Wee KheeDesigning Impactful Services and User Experience - Lim Wee Khee
Designing Impactful Services and User Experience - Lim Wee Khee
NUS-ISS
 
Upskilling the Evolving Workforce with Digital Fluency for Tomorrow's Challen...
Upskilling the Evolving Workforce with Digital Fluency for Tomorrow's Challen...Upskilling the Evolving Workforce with Digital Fluency for Tomorrow's Challen...
Upskilling the Evolving Workforce with Digital Fluency for Tomorrow's Challen...
NUS-ISS
 
How the World's Leading Independent Automotive Distributor is Reinventing Its...
How the World's Leading Independent Automotive Distributor is Reinventing Its...How the World's Leading Independent Automotive Distributor is Reinventing Its...
How the World's Leading Independent Automotive Distributor is Reinventing Its...
NUS-ISS
 
The Importance of Cybersecurity for Digital Transformation
The Importance of Cybersecurity for Digital TransformationThe Importance of Cybersecurity for Digital Transformation
The Importance of Cybersecurity for Digital Transformation
NUS-ISS
 
Architecting CX Measurement Frameworks and Ensuring CX Metrics are fit for Pu...
Architecting CX Measurement Frameworks and Ensuring CX Metrics are fit for Pu...Architecting CX Measurement Frameworks and Ensuring CX Metrics are fit for Pu...
Architecting CX Measurement Frameworks and Ensuring CX Metrics are fit for Pu...
NUS-ISS
 
Understanding GenAI/LLM and What is Google Offering - Felix Goh
Understanding GenAI/LLM and What is Google Offering - Felix GohUnderstanding GenAI/LLM and What is Google Offering - Felix Goh
Understanding GenAI/LLM and What is Google Offering - Felix Goh
NUS-ISS
 
Digital Product-Centric Enterprise and Enterprise Architecture - Tan Eng Tsze
Digital Product-Centric Enterprise and Enterprise Architecture - Tan Eng TszeDigital Product-Centric Enterprise and Enterprise Architecture - Tan Eng Tsze
Digital Product-Centric Enterprise and Enterprise Architecture - Tan Eng Tsze
NUS-ISS
 
Emerging & Future Technology - How to Prepare for the Next 10 Years of Radica...
Emerging & Future Technology - How to Prepare for the Next 10 Years of Radica...Emerging & Future Technology - How to Prepare for the Next 10 Years of Radica...
Emerging & Future Technology - How to Prepare for the Next 10 Years of Radica...
NUS-ISS
 
Beyond the Hype: What Generative AI Means for the Future of Work - Damien Cum...
Beyond the Hype: What Generative AI Means for the Future of Work - Damien Cum...Beyond the Hype: What Generative AI Means for the Future of Work - Damien Cum...
Beyond the Hype: What Generative AI Means for the Future of Work - Damien Cum...
NUS-ISS
 
Supply Chain Security for Containerised Workloads - Lee Chuk Munn
Supply Chain Security for Containerised Workloads - Lee Chuk MunnSupply Chain Security for Containerised Workloads - Lee Chuk Munn
Supply Chain Security for Containerised Workloads - Lee Chuk Munn
NUS-ISS
 
Future of Learning - Yap Aye Wee.pdf
Future of Learning - Yap Aye Wee.pdfFuture of Learning - Yap Aye Wee.pdf
Future of Learning - Yap Aye Wee.pdf
NUS-ISS
 
Future of Learning - Khoong Chan Meng
Future of Learning - Khoong Chan MengFuture of Learning - Khoong Chan Meng
Future of Learning - Khoong Chan Meng
NUS-ISS
 
Site Reliability Engineer (SRE), We Keep The Lights On 24/7
Site Reliability Engineer (SRE), We Keep The Lights On 24/7Site Reliability Engineer (SRE), We Keep The Lights On 24/7
Site Reliability Engineer (SRE), We Keep The Lights On 24/7
NUS-ISS
 
Product Management in The Trenches for a Cloud Service
Product Management in The Trenches for a Cloud ServiceProduct Management in The Trenches for a Cloud Service
Product Management in The Trenches for a Cloud Service
NUS-ISS
 
Overview of Data and Analytics Essentials and Foundations
Overview of Data and Analytics Essentials and FoundationsOverview of Data and Analytics Essentials and Foundations
Overview of Data and Analytics Essentials and Foundations
NUS-ISS
 
Predictive Analytics
Predictive AnalyticsPredictive Analytics
Predictive Analytics
NUS-ISS
 
Feature Engineering for IoT
Feature Engineering for IoTFeature Engineering for IoT
Feature Engineering for IoT
NUS-ISS
 
Master of Technology in Software Engineering
Master of Technology in Software EngineeringMaster of Technology in Software Engineering
Master of Technology in Software Engineering
NUS-ISS
 
Master of Technology in Enterprise Business Analytics
Master of Technology in Enterprise Business AnalyticsMaster of Technology in Enterprise Business Analytics
Master of Technology in Enterprise Business Analytics
NUS-ISS
 
Diagnosing Complex Problems Using System Archetypes
Diagnosing Complex Problems Using System ArchetypesDiagnosing Complex Problems Using System Archetypes
Diagnosing Complex Problems Using System Archetypes
NUS-ISS
 

More from NUS-ISS (20)

Designing Impactful Services and User Experience - Lim Wee Khee
Designing Impactful Services and User Experience - Lim Wee KheeDesigning Impactful Services and User Experience - Lim Wee Khee
Designing Impactful Services and User Experience - Lim Wee Khee
 
Upskilling the Evolving Workforce with Digital Fluency for Tomorrow's Challen...
Upskilling the Evolving Workforce with Digital Fluency for Tomorrow's Challen...Upskilling the Evolving Workforce with Digital Fluency for Tomorrow's Challen...
Upskilling the Evolving Workforce with Digital Fluency for Tomorrow's Challen...
 
How the World's Leading Independent Automotive Distributor is Reinventing Its...
How the World's Leading Independent Automotive Distributor is Reinventing Its...How the World's Leading Independent Automotive Distributor is Reinventing Its...
How the World's Leading Independent Automotive Distributor is Reinventing Its...
 
The Importance of Cybersecurity for Digital Transformation
The Importance of Cybersecurity for Digital TransformationThe Importance of Cybersecurity for Digital Transformation
The Importance of Cybersecurity for Digital Transformation
 
Architecting CX Measurement Frameworks and Ensuring CX Metrics are fit for Pu...
Architecting CX Measurement Frameworks and Ensuring CX Metrics are fit for Pu...Architecting CX Measurement Frameworks and Ensuring CX Metrics are fit for Pu...
Architecting CX Measurement Frameworks and Ensuring CX Metrics are fit for Pu...
 
Understanding GenAI/LLM and What is Google Offering - Felix Goh
Understanding GenAI/LLM and What is Google Offering - Felix GohUnderstanding GenAI/LLM and What is Google Offering - Felix Goh
Understanding GenAI/LLM and What is Google Offering - Felix Goh
 
Digital Product-Centric Enterprise and Enterprise Architecture - Tan Eng Tsze
Digital Product-Centric Enterprise and Enterprise Architecture - Tan Eng TszeDigital Product-Centric Enterprise and Enterprise Architecture - Tan Eng Tsze
Digital Product-Centric Enterprise and Enterprise Architecture - Tan Eng Tsze
 
Emerging & Future Technology - How to Prepare for the Next 10 Years of Radica...
Emerging & Future Technology - How to Prepare for the Next 10 Years of Radica...Emerging & Future Technology - How to Prepare for the Next 10 Years of Radica...
Emerging & Future Technology - How to Prepare for the Next 10 Years of Radica...
 
Beyond the Hype: What Generative AI Means for the Future of Work - Damien Cum...
Beyond the Hype: What Generative AI Means for the Future of Work - Damien Cum...Beyond the Hype: What Generative AI Means for the Future of Work - Damien Cum...
Beyond the Hype: What Generative AI Means for the Future of Work - Damien Cum...
 
Supply Chain Security for Containerised Workloads - Lee Chuk Munn
Supply Chain Security for Containerised Workloads - Lee Chuk MunnSupply Chain Security for Containerised Workloads - Lee Chuk Munn
Supply Chain Security for Containerised Workloads - Lee Chuk Munn
 
Future of Learning - Yap Aye Wee.pdf
Future of Learning - Yap Aye Wee.pdfFuture of Learning - Yap Aye Wee.pdf
Future of Learning - Yap Aye Wee.pdf
 
Future of Learning - Khoong Chan Meng
Future of Learning - Khoong Chan MengFuture of Learning - Khoong Chan Meng
Future of Learning - Khoong Chan Meng
 
Site Reliability Engineer (SRE), We Keep The Lights On 24/7
Site Reliability Engineer (SRE), We Keep The Lights On 24/7Site Reliability Engineer (SRE), We Keep The Lights On 24/7
Site Reliability Engineer (SRE), We Keep The Lights On 24/7
 
Product Management in The Trenches for a Cloud Service
Product Management in The Trenches for a Cloud ServiceProduct Management in The Trenches for a Cloud Service
Product Management in The Trenches for a Cloud Service
 
Overview of Data and Analytics Essentials and Foundations
Overview of Data and Analytics Essentials and FoundationsOverview of Data and Analytics Essentials and Foundations
Overview of Data and Analytics Essentials and Foundations
 
Predictive Analytics
Predictive AnalyticsPredictive Analytics
Predictive Analytics
 
Feature Engineering for IoT
Feature Engineering for IoTFeature Engineering for IoT
Feature Engineering for IoT
 
Master of Technology in Software Engineering
Master of Technology in Software EngineeringMaster of Technology in Software Engineering
Master of Technology in Software Engineering
 
Master of Technology in Enterprise Business Analytics
Master of Technology in Enterprise Business AnalyticsMaster of Technology in Enterprise Business Analytics
Master of Technology in Enterprise Business Analytics
 
Diagnosing Complex Problems Using System Archetypes
Diagnosing Complex Problems Using System ArchetypesDiagnosing Complex Problems Using System Archetypes
Diagnosing Complex Problems Using System Archetypes
 

Recently uploaded

Smart TV Buyer Insights Survey 2024 by 91mobiles.pdf
Smart TV Buyer Insights Survey 2024 by 91mobiles.pdfSmart TV Buyer Insights Survey 2024 by 91mobiles.pdf
Smart TV Buyer Insights Survey 2024 by 91mobiles.pdf
91mobiles
 
Dev Dives: Train smarter, not harder – active learning and UiPath LLMs for do...
Dev Dives: Train smarter, not harder – active learning and UiPath LLMs for do...Dev Dives: Train smarter, not harder – active learning and UiPath LLMs for do...
Dev Dives: Train smarter, not harder – active learning and UiPath LLMs for do...
UiPathCommunity
 
To Graph or Not to Graph Knowledge Graph Architectures and LLMs
To Graph or Not to Graph Knowledge Graph Architectures and LLMsTo Graph or Not to Graph Knowledge Graph Architectures and LLMs
To Graph or Not to Graph Knowledge Graph Architectures and LLMs
Paul Groth
 
Transcript: Selling digital books in 2024: Insights from industry leaders - T...
Transcript: Selling digital books in 2024: Insights from industry leaders - T...Transcript: Selling digital books in 2024: Insights from industry leaders - T...
Transcript: Selling digital books in 2024: Insights from industry leaders - T...
BookNet Canada
 
Slack (or Teams) Automation for Bonterra Impact Management (fka Social Soluti...
Slack (or Teams) Automation for Bonterra Impact Management (fka Social Soluti...Slack (or Teams) Automation for Bonterra Impact Management (fka Social Soluti...
Slack (or Teams) Automation for Bonterra Impact Management (fka Social Soluti...
Jeffrey Haguewood
 
Elevating Tactical DDD Patterns Through Object Calisthenics
Elevating Tactical DDD Patterns Through Object CalisthenicsElevating Tactical DDD Patterns Through Object Calisthenics
Elevating Tactical DDD Patterns Through Object Calisthenics
Dorra BARTAGUIZ
 
Key Trends Shaping the Future of Infrastructure.pdf
Key Trends Shaping the Future of Infrastructure.pdfKey Trends Shaping the Future of Infrastructure.pdf
Key Trends Shaping the Future of Infrastructure.pdf
Cheryl Hung
 
Software Delivery At the Speed of AI: Inflectra Invests In AI-Powered Quality
Software Delivery At the Speed of AI: Inflectra Invests In AI-Powered QualitySoftware Delivery At the Speed of AI: Inflectra Invests In AI-Powered Quality
Software Delivery At the Speed of AI: Inflectra Invests In AI-Powered Quality
Inflectra
 
From Siloed Products to Connected Ecosystem: Building a Sustainable and Scala...
From Siloed Products to Connected Ecosystem: Building a Sustainable and Scala...From Siloed Products to Connected Ecosystem: Building a Sustainable and Scala...
From Siloed Products to Connected Ecosystem: Building a Sustainable and Scala...
Product School
 
Accelerate your Kubernetes clusters with Varnish Caching
Accelerate your Kubernetes clusters with Varnish CachingAccelerate your Kubernetes clusters with Varnish Caching
Accelerate your Kubernetes clusters with Varnish Caching
Thijs Feryn
 
Neuro-symbolic is not enough, we need neuro-*semantic*
Neuro-symbolic is not enough, we need neuro-*semantic*Neuro-symbolic is not enough, we need neuro-*semantic*
Neuro-symbolic is not enough, we need neuro-*semantic*
Frank van Harmelen
 
Assuring Contact Center Experiences for Your Customers With ThousandEyes
Assuring Contact Center Experiences for Your Customers With ThousandEyesAssuring Contact Center Experiences for Your Customers With ThousandEyes
Assuring Contact Center Experiences for Your Customers With ThousandEyes
ThousandEyes
 
FIDO Alliance Osaka Seminar: Passkeys at Amazon.pdf
FIDO Alliance Osaka Seminar: Passkeys at Amazon.pdfFIDO Alliance Osaka Seminar: Passkeys at Amazon.pdf
FIDO Alliance Osaka Seminar: Passkeys at Amazon.pdf
FIDO Alliance
 
Mission to Decommission: Importance of Decommissioning Products to Increase E...
Mission to Decommission: Importance of Decommissioning Products to Increase E...Mission to Decommission: Importance of Decommissioning Products to Increase E...
Mission to Decommission: Importance of Decommissioning Products to Increase E...
Product School
 
Connector Corner: Automate dynamic content and events by pushing a button
Connector Corner: Automate dynamic content and events by pushing a buttonConnector Corner: Automate dynamic content and events by pushing a button
Connector Corner: Automate dynamic content and events by pushing a button
DianaGray10
 
LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...
LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...
LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...
DanBrown980551
 
FIDO Alliance Osaka Seminar: Passkeys and the Road Ahead.pdf
FIDO Alliance Osaka Seminar: Passkeys and the Road Ahead.pdfFIDO Alliance Osaka Seminar: Passkeys and the Road Ahead.pdf
FIDO Alliance Osaka Seminar: Passkeys and the Road Ahead.pdf
FIDO Alliance
 
How world-class product teams are winning in the AI era by CEO and Founder, P...
How world-class product teams are winning in the AI era by CEO and Founder, P...How world-class product teams are winning in the AI era by CEO and Founder, P...
How world-class product teams are winning in the AI era by CEO and Founder, P...
Product School
 
FIDO Alliance Osaka Seminar: FIDO Security Aspects.pdf
FIDO Alliance Osaka Seminar: FIDO Security Aspects.pdfFIDO Alliance Osaka Seminar: FIDO Security Aspects.pdf
FIDO Alliance Osaka Seminar: FIDO Security Aspects.pdf
FIDO Alliance
 
Designing Great Products: The Power of Design and Leadership by Chief Designe...
Designing Great Products: The Power of Design and Leadership by Chief Designe...Designing Great Products: The Power of Design and Leadership by Chief Designe...
Designing Great Products: The Power of Design and Leadership by Chief Designe...
Product School
 

Recently uploaded (20)

Smart TV Buyer Insights Survey 2024 by 91mobiles.pdf
Smart TV Buyer Insights Survey 2024 by 91mobiles.pdfSmart TV Buyer Insights Survey 2024 by 91mobiles.pdf
Smart TV Buyer Insights Survey 2024 by 91mobiles.pdf
 
Dev Dives: Train smarter, not harder – active learning and UiPath LLMs for do...
Dev Dives: Train smarter, not harder – active learning and UiPath LLMs for do...Dev Dives: Train smarter, not harder – active learning and UiPath LLMs for do...
Dev Dives: Train smarter, not harder – active learning and UiPath LLMs for do...
 
To Graph or Not to Graph Knowledge Graph Architectures and LLMs
To Graph or Not to Graph Knowledge Graph Architectures and LLMsTo Graph or Not to Graph Knowledge Graph Architectures and LLMs
To Graph or Not to Graph Knowledge Graph Architectures and LLMs
 
Transcript: Selling digital books in 2024: Insights from industry leaders - T...
Transcript: Selling digital books in 2024: Insights from industry leaders - T...Transcript: Selling digital books in 2024: Insights from industry leaders - T...
Transcript: Selling digital books in 2024: Insights from industry leaders - T...
 
Slack (or Teams) Automation for Bonterra Impact Management (fka Social Soluti...
Slack (or Teams) Automation for Bonterra Impact Management (fka Social Soluti...Slack (or Teams) Automation for Bonterra Impact Management (fka Social Soluti...
Slack (or Teams) Automation for Bonterra Impact Management (fka Social Soluti...
 
Elevating Tactical DDD Patterns Through Object Calisthenics
Elevating Tactical DDD Patterns Through Object CalisthenicsElevating Tactical DDD Patterns Through Object Calisthenics
Elevating Tactical DDD Patterns Through Object Calisthenics
 
Key Trends Shaping the Future of Infrastructure.pdf
Key Trends Shaping the Future of Infrastructure.pdfKey Trends Shaping the Future of Infrastructure.pdf
Key Trends Shaping the Future of Infrastructure.pdf
 
Software Delivery At the Speed of AI: Inflectra Invests In AI-Powered Quality
Software Delivery At the Speed of AI: Inflectra Invests In AI-Powered QualitySoftware Delivery At the Speed of AI: Inflectra Invests In AI-Powered Quality
Software Delivery At the Speed of AI: Inflectra Invests In AI-Powered Quality
 
From Siloed Products to Connected Ecosystem: Building a Sustainable and Scala...
From Siloed Products to Connected Ecosystem: Building a Sustainable and Scala...From Siloed Products to Connected Ecosystem: Building a Sustainable and Scala...
From Siloed Products to Connected Ecosystem: Building a Sustainable and Scala...
 
Accelerate your Kubernetes clusters with Varnish Caching
Accelerate your Kubernetes clusters with Varnish CachingAccelerate your Kubernetes clusters with Varnish Caching
Accelerate your Kubernetes clusters with Varnish Caching
 
Neuro-symbolic is not enough, we need neuro-*semantic*
Neuro-symbolic is not enough, we need neuro-*semantic*Neuro-symbolic is not enough, we need neuro-*semantic*
Neuro-symbolic is not enough, we need neuro-*semantic*
 
Assuring Contact Center Experiences for Your Customers With ThousandEyes
Assuring Contact Center Experiences for Your Customers With ThousandEyesAssuring Contact Center Experiences for Your Customers With ThousandEyes
Assuring Contact Center Experiences for Your Customers With ThousandEyes
 
FIDO Alliance Osaka Seminar: Passkeys at Amazon.pdf
FIDO Alliance Osaka Seminar: Passkeys at Amazon.pdfFIDO Alliance Osaka Seminar: Passkeys at Amazon.pdf
FIDO Alliance Osaka Seminar: Passkeys at Amazon.pdf
 
Mission to Decommission: Importance of Decommissioning Products to Increase E...
Mission to Decommission: Importance of Decommissioning Products to Increase E...Mission to Decommission: Importance of Decommissioning Products to Increase E...
Mission to Decommission: Importance of Decommissioning Products to Increase E...
 
Connector Corner: Automate dynamic content and events by pushing a button
Connector Corner: Automate dynamic content and events by pushing a buttonConnector Corner: Automate dynamic content and events by pushing a button
Connector Corner: Automate dynamic content and events by pushing a button
 
LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...
LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...
LF Energy Webinar: Electrical Grid Modelling and Simulation Through PowSyBl -...
 
FIDO Alliance Osaka Seminar: Passkeys and the Road Ahead.pdf
FIDO Alliance Osaka Seminar: Passkeys and the Road Ahead.pdfFIDO Alliance Osaka Seminar: Passkeys and the Road Ahead.pdf
FIDO Alliance Osaka Seminar: Passkeys and the Road Ahead.pdf
 
How world-class product teams are winning in the AI era by CEO and Founder, P...
How world-class product teams are winning in the AI era by CEO and Founder, P...How world-class product teams are winning in the AI era by CEO and Founder, P...
How world-class product teams are winning in the AI era by CEO and Founder, P...
 
FIDO Alliance Osaka Seminar: FIDO Security Aspects.pdf
FIDO Alliance Osaka Seminar: FIDO Security Aspects.pdfFIDO Alliance Osaka Seminar: FIDO Security Aspects.pdf
FIDO Alliance Osaka Seminar: FIDO Security Aspects.pdf
 
Designing Great Products: The Power of Design and Leadership by Chief Designe...
Designing Great Products: The Power of Design and Leadership by Chief Designe...Designing Great Products: The Power of Design and Leadership by Chief Designe...
Designing Great Products: The Power of Design and Leadership by Chief Designe...
 

Fixing the Last Missing Piece in Securing IoT

  • 1. FIXING THE LAST MISSING PIECE IN SECURING IOT Ng Kok Leong Senior Lecturer & Consultant, ISS, NUS © Copyright National University of Singapore. All Rights Reserved 1 OVER GRADUATE ALUMNI5,900 OFFERING OVER 130 ENTERPRISE IT, INNOVATION & LEADERSHIP PROGRAMMES TRAINING OVER 130,000 DIGITAL LEADERS & PROFESSIONALS
  • 2. Agenda © Copyright National University of Singapore. All Rights Reserved 2 Security Controls Security Risks Security Requirements (1) Cloud(3) IoT (2) Data in transit
  • 3. © Copyright National University of Singapore. All Rights Reserved 3 (1) Securing Data in the Cloud
  • 4. TDE: Transparent Database Encryption © Copyright National University of Singapore. All Rights Reserved 4 Image source: https://docs.microsoft.com/en- us/azure/security/azure-security-encryption-atrest
  • 5. Cloud HSM (Hardware Security Module) © Copyright National University of Singapore. All Rights Reserved 5Image source: https://aws.amazon.com/cloudhsm/
  • 6. HSM: Hardware Security Module © Copyright National University of Singapore. All Rights Reserved 6 Image source: https://hackernoon.com/the-thing-about-hardware-security-modules-6f2cc38b5319 https://www.secureidnews.com/news-item/hardware-security-modules-the-gold-standard-for- encryption-key-security/
  • 7. “Bring Your Own Key” © Copyright National University of Singapore. All Rights Reserved 7Image source: https://www.ncipher.com/blog/category/data-security?page=9
  • 8. What are the Security Controls? For securing IoT data in the cloud © Copyright National University of Singapore. All Rights Reserved 8 TDE Transparent Database Encryption HSM Hardware Security Module and others …
  • 9. What is Security Requirement? © Copyright National University of Singapore. All Rights Reserved 9 Data Confidentiality What we don’t want to lose?
  • 10. © Copyright National University of Singapore. All Rights Reserved 10 (2) Securing Data in Transit
  • 11. End-to-End Encryption © Copyright National University of Singapore. All Rights Reserved 11 Image source: https://www.intrinsic-id.com/markets/connectivity-ics/
  • 12. TLS (or SSL, which is still commonly known as) © Copyright National University of Singapore. All Rights Reserved 12 Image source: https://www.cloudflare.com/learning/ssl/what-is-ssl/ https://yourshop.com/security-b19.html TLS: Transport Layer Security SSL: Secure Sockets Layer
  • 13. TLS utilized by IoT © Copyright National University of Singapore. All Rights Reserved 13Image source: https://www.digi.com/videos/connecting-digi-xbee3-cellular-to-aws-with-mqtt
  • 14. MQTT: Message Queuing Telemetry Transport © Copyright National University of Singapore. All Rights Reserved 14Image source: https://aws.amazon.com/iot-core/ MQTT protocol recommends use of TLS for more sensitive MQTT implementations
  • 15. MQTT: a publish / subscribe protocol © Copyright National University of Singapore. All Rights Reserved 15Image source: https://www.hivemq.com/blog/how-to-get-started-with-mqtt MQTT protocol was invented by IBM back in 1999 for satellite communications with oil-field equipment.
  • 16. © Copyright National University of Singapore. All Rights Reserved 16 Problem: TLS is not lightweight • TLS adds additional two round trips to the start of every session • TLS certificates are large files, and device memory is limited in IoT
  • 17. TLS v1.3 - improved version © Copyright National University of Singapore. All Rights Reserved 17Image source: https://blog.cloudflare.com/why-iot-is-insecure/ TLS 1.3 eliminates a complete round trip in the TLS handshake, which makes TLS much lighter and faster If the same IoT device talks to the same server again, there is no round trip at all, as the parameters chosen in the initial handshake are sent alongside application data.
  • 18. CoAP: Constrained Application Protocol © Copyright National University of Singapore. All Rights Reserved 18Image source: https://www.rfwireless-world.com/Terminology/COAP-vs-MQTT.html CoAP was created by IETF. It was designed for use by constrained devices on constrained network (low-power, lossy networks).
  • 19. CoAP utilizes DTLS © Copyright National University of Singapore. All Rights Reserved 19 Image source: https://www.semanticscholar.org/paper/Lightweight-DTLS- Implementation-in-CoAP-based-IoT-Lakkundi-Singh
  • 20. UDP is more lightweight than TCP © Copyright National University of Singapore. All Rights Reserved 20 Image source: https://www.pubnub.com/blog/why-you-should-run- your-game-servers-separate-from-your-chat/ No ordering of messages No tracking connections
  • 21. DTLS: session initialization not any lighter (to IoT) © Copyright National University of Singapore. All Rights Reserved 21Image source: https://blog.cloudflare.com/why-iot-is-insecure/
  • 22. Another Problem: IoT Gateway breaks end-to-end encryption © Copyright National University of Singapore. All Rights Reserved 22Image source: https://cloud.google.com/iot/docs/how-tos/gateways/
  • 23. Object Security for Constrained RESTful Environments (OSCORE) © Copyright National University of Singapore. All Rights Reserved 23 • A method for application-layer protection of the Constrained Application Protocol, using object signing and encryption. (under Internet draft) • OSCORE provides end-to-end protection between endpoints communicating using CoAP. • Designed for constrained nodes. Image source: https://tools.ietf.org/id/draft-ietf-core-object-security-15.html Deployment Example
  • 24. What are the Security Controls? For securing IoT data in transit © Copyright National University of Singapore. All Rights Reserved 24 DTLS Datagram Transport Layer Security TLS Transport Layer Security OSCORE Object Security for Constrained RESTful Environments
  • 25. What are Security Requirements? © Copyright National University of Singapore. All Rights Reserved 25 Data Confidentiality What we don’t want to lose? Data Integrity Confidentiality throughout end-to-end
  • 26. © Copyright National University of Singapore. All Rights Reserved 26 (3) Securing Data in IoT
  • 27. What is constrained IoT device? © Copyright National University of Singapore. All Rights Reserved 27Image source: https://www.cisoplatform.com/profiles/blogs/classification-of-iot-devices
  • 28. Classes of Constrained Devices (1) © Copyright National University of Singapore. All Rights Reserved 28 Image source: https://www.cisoplatform.com/profiles/blogs/classification-of-iot-devices https://tools.ietf.org/html/rfc7228 Examples of constraints:- • Processing power • Size of memory • Availability of power source IETF’s RFC 7228 classifies the constrained devices into 3 categories
  • 29. Classes of Constrained Devices (2) © Copyright National University of Singapore. All Rights Reserved 29 Class 2 – not so constrained • Less constrained and can perform at par with mobiles phones / notebooks, supporting most protocol stacks. Class 1 – quite constrained • Quite constrained in code space and processing capabilities to employ full protocol stack such as HTTP, TLS. Hence, use IoT stack like UDP, CoAP, DTLS • Interact with other devices without the need of gateway. Class 0 – too small to securely run on Internet • Constrains in memory and processing capabilities. • Use Gateway for basic communication need. Image source: https://www.rfwireless-world.com/Terminology/COAP-vs-MQTT.html
  • 30. Constrained Device Class 0 – medical device © Copyright National University of Singapore. All Rights Reserved 30 Image source: https://pdfs.semanticscholar.org/6a25/e93587dde53966 b3f0830ed9b78023c2cadd.pdf
  • 31. Constrained Device Class 0 – pacemaker © Copyright National University of Singapore. All Rights Reserved 31 Image source: https://www.aboutkidshealth.ca/Article?contentid=980&language=English http://caifl.com/cardiac-devices/pacemakers/ https://www.sciencedirect.com/topics/nursing-and-health-professions/pacemaker-battery
  • 32. © Copyright National University of Singapore. All Rights Reserved 32 Is “remote attack” feasible with class 0 constrained device?
  • 33. © Copyright National University of Singapore. All Rights Reserved 33 Is “remote attack” feasible with the IoT Gateway?
  • 34. © Copyright National University of Singapore. All Rights Reserved 34 Is “physical attack” feasible with class 0 constrained device?
  • 35. What is the risk? © Copyright National University of Singapore. All Rights Reserved 35Image source: https://medium.com
  • 36. © Copyright National University of Singapore. All Rights Reserved 36 Is “remote attack” feasible with the IoT Gateway? For this to happen, We have to assume there is a “vulnerability” in the IoT gateway. What is the probability of the threat exploiting the vulnerability? What is the impact if the risk materialized? Returning to this question and assume risk is high, for discussion
  • 37. Risk Treatment © Copyright National University of Singapore. All Rights Reserved 37 Accept Avoid Transfer Mitigate Sharing For the cloud computing Prescribe Security Controls
  • 38. Problem? © Copyright National University of Singapore. All Rights Reserved 38 Outdated software Solution? Software/firmware Patching (plus other usual IT stuffs …) Source: https://www.zdnet.com/article/how-iot-hackers- turned-a-universitys-network-against-itself/
  • 39. © Copyright National University of Singapore. All Rights Reserved 39 Source: https://www.iottechnews.com/news/2017/jan/20/study- reveals-80-percent-iot-apps-left-unsecured/
  • 40. What are the Security Controls? For securing IoT data in IoT device © Copyright National University of Singapore. All Rights Reserved 40 Software Patching and others … Over the Air update In IoT, patching is known as
  • 41. Over the Air Update © Copyright National University of Singapore. All Rights Reserved 41Image source: https://blog.particle.io/2019/05/09/ota-firmware-updates/
  • 42. Over the Air Update © Copyright National University of Singapore. All Rights Reserved 42 Image source: http://www.iphonehacks.com/install-ios-7-0-4-update-iphone-ipad https://searchmobilecomputing.techtarget.com/definition/OTA-update-over-the-air-update Previously, user needed to connect iphone to computer using USB cable to update OS through iTunes. With OTA, Apple can deliver updates remotely
  • 43. What are Security Requirements? © Copyright National University of Singapore. All Rights Reserved 43 Data privacy What we don’t want to lose? Safety
  • 44. © Copyright National University of Singapore. All Rights Reserved 44 Assume “physical proximity” attack is feasible, what are the security controls? The attacker bypass “remote attack” and get close proximity to your target.
  • 45. Pay using Fitbit watch © Copyright National University of Singapore. All Rights Reserved 45 Image source: https://www.todayonline.com/singapore/fitbit- users-can-now-tap-their-wrists-pay-train-and-bus-rides How to evaluate the security of this IoT?
  • 46. Evaluate the Microcontroller (among others…) © Copyright National University of Singapore. All Rights Reserved 46Image source: https://hexus.net/static/techdrive/?sf32731391=1 Fitbit Flex ARM Cortex M3 processor
  • 47. Fitbit Ionic Watch © Copyright National University of Singapore. All Rights Reserved 47 Image source: https://electronics360.globalspec.com/articl e/11796/teardown-fitbit-ionic-fb503 ARM Cortex M4 processor
  • 48. Who is ARM? © Copyright National University of Singapore. All Rights Reserved 48 Image source: https://www.fudzilla.com/news/processors/40000- arm-cortex-r8-processor-design-is-out 1) ARM creates processor designs but it does not produce any physical products. 2) The technology (IP) is licensed to other companies who design and build their own processors based on ARM’s design, e.g. Texas Instruments, Samsung.
  • 49. ARM Processors © Copyright National University of Singapore. All Rights Reserved 49Image source: https://www.arm.com/products/silicon-ip-cpu Cortex-M series for IoT
  • 50. ARM IoT SoC Solutions © Copyright National University of Singapore. All Rights Reserved 50Image source: https://www.arm.com/products/silicon-ip-cpu
  • 51. Cortex-M processor: Architecture © Copyright National University of Singapore. All Rights Reserved 51 • ARMv6-M architecture • Cortex-M0, Cortex-M0+, Cortex-M1 • ARMv7-M architecture • Cortex-M3, Cortex-M4, Cortex-M7 • ARMv8-M architecture • Cortex-M23, Cortex-M33, Cortex-M35P ARMv8-M processor architecture differentiates from security perspective because it has “trustzone” technology
  • 52. Trustzone Technology © Copyright National University of Singapore. All Rights Reserved 52Image source: https://www.arm.com/why-arm/technologies/trustzone-for-cortex-m
  • 53. Trustzone Technology © Copyright National University of Singapore. All Rights Reserved 53Source: K5_Addressing_IoT_and_Embedded_Security_at_the_Chip_Level_Roni.pdf Creating isolation in single processor, resulting in one trusted zone and one non-trusted zone, which previously requires 2 processors to achieve.
  • 54. © Copyright National University of Singapore. All Rights Reserved 54Image source: https://www.kwtrain.com/blog/network-security-zones Trusted zone Non-trusted zone Isolation illustration: trusted zone vs non-trusted zone
  • 55. Root of Trust © Copyright National University of Singapore. All Rights Reserved 55 Image source: https://www.slideshare.net/linaroorg/sfo17- 304-demystifying-ro-tfinallc-83555369 Root of Trust (RoT) is a source that can always be trusted within a cryptographic system. It generally includes a hardened hardware module.
  • 56. Secure Boot © Copyright National University of Singapore. All Rights Reserved 56 Image source: https://www.dignited.com/36748/what-is-secure-boot-on-windows/ https://docs.microsoft.com/en-us/windows-hardware/design/device- experiences/oem-secure-boot
  • 57. What are the Security Controls? © Copyright National University of Singapore. All Rights Reserved 57 Trustzone technology and others …
  • 58. What are Security Requirements? © Copyright National University of Singapore. All Rights Reserved 58 Secure Boot Root of Trust
  • 59. © Copyright National University of Singapore. All Rights Reserved 59 Assume “physical” attack is feasible, what are the security controls? The attacker hacks the physical IoT device
  • 60. ARM launches anti-tampering processor, M35P © Copyright National University of Singapore. All Rights Reserved 60 Image source: https://venturebeat.com/2018/05/02/arm-designs-anti- tampering-and-software-isolation-into-its-processors/ Look out for release of chip based on M35p
  • 61. What are the Security Controls? © Copyright National University of Singapore. All Rights Reserved 61 Anti-tampering IoT processor
  • 62. What are Security Requirements? © Copyright National University of Singapore. All Rights Reserved 62 Tamper-resistant IoT device (at microcontroller level)
  • 63. In summary • If you are security professional (or role), • Know the security controls available • Securing data in the cloud • Securing data in transit • Securing data in IoT device • Assess risk and prescribe the right level of security controls to meet business need • If you are IoT project business/owner/team, • Determine the security requirements • Understand the risk assessment and accept/approve/amend the recommendation of security controls © Copyright National University of Singapore. All Rights Reserved 63
  • 64. © Copyright National University of Singapore. All Rights Reserved 64 Image source: https://www.slideshare.net/AmazonWebServices/managing- security-with-aws-aws-public-sector-summit-2017 • The project can’t possibly utilizes all security controls, whether cloud or IoT. • It’s the security professional role to prescribe the right level of security controls to meet business need. Lastly, AWS cloud has 2600+ security controls
  • 65. 65© Copyright National University of Singapore. All Rights Reserved www www.iss.nus.edu.sg facebook.com/ISS.NUS twitter.com/ISSNUS @iss.nus linkedin.com/company/iss.nus youtube.com/user/TheISSNUS/