SlideShare a Scribd company logo

How to create a secure IoT device

•Download as PPTX, PDF•
•
Abhijeet Rane
Abhijeet Rane

Some core principles to guide developers towards creating secure IoT devices. Why. Because not having security is not an option anymore.

Devices & Hardware
1 of 21
IT’S ONLY SMART….. IF IT’S SECURE AKA HOW TO CREATE A SECURE IOT DEVICE MIKE HENDRICK VP ENGG. SEQUITUR LABS INC.
2 Kudos! Copyright Sequitur Labs Inc. 2017 If you are thinking about IoT security……… …………you are way ahead of the game
3 • Smart Home • Smart Building • Smart Car • Smart Medical Devices • Smart Cities • Smart Grid • Smart Wearables Opportunity: Smart Future……. Copyright Sequitur Labs Inc. 2017
4 Problem: The “Smart” Future …… Copyright Sequitur Labs Inc. 2017 …….it has it’s own - Viruses - Malware - Hacker community This lightbulb is so “smart”……….
5 Multiple connectivity options • WiFi • Bluetooth • BLE • Whatever……… “Smart” lightbulbs Copyright Sequitur Labs Inc. 2017 Connects to your • WiFi network • Phone • Other devices What does it do? • It stores your network credentials • Knows what devices it should connect to
6 Hmmmm……So What? HACKERS CAN USE THIS INFORMATION TO GET INTO YOUR NETWORK AND STEAL • Passwords • Financial information • Attack webcams (been there, done that) • Steal health related information • Control security systems Copyright Sequitur Labs Inc. 2017
7 Say it Ain’t So!! Copyright Sequitur Labs Inc. 2017 A connected lightbulb is a “portal” into - Your home - Your life - Your family - Your friends
8 Bottom-line: IoT without Security……. Copyright Sequitur Labs Inc. 2017 ….. is like handing over the keys to your kingdom
9 • Smart Home • Smart Building • Smart Car • Smart Medical Devices • Smart Cities • Smart Grid • Smart Wearables This Could Happen to ANY Connected Device in ANY Sector Copyright Sequitur Labs Inc. 2017
10 HELP!! Copyright Sequitur Labs Inc. 2017 Where do I start? • Define the threats • Design for Security • Select the right platforms
11 Defining the Threats Copyright Sequitur Labs Inc. 2017 • Firmware Theft • Malware • DDoS Attacks • Man-in-the-middle • Physical attacks • Corrupted firmware • Compromised peripherals Devices need protection throughout their life cycle • Create • Operate • Retire
12 Security Threats Faced by A Device Copyright Sequitur Labs Inc. 2017 • IP Theft • Unauthorized manufacture • Cloning Create Operate Retire • Compromised communications • Compromised upgrades • Data theft • Firmware corruption • Malware • DDoS • Data theft • Stolen network credentials • IP Theft • Cloning Threats
13 Design For Security - Through The Lifecycle Copyright Sequitur Labs Inc. 2017 • IP Theft • Unauthorized manufacture • Cloning At Manufacture • Establish hardware root of trust • Securely inject unique keys and certs at manufacturing • Immutable device ID Threats Security Measures
14 Design For Security - Through The Lifecycle Copyright Sequitur Labs Inc. 2017 • Compromised communications • Compromised upgrades • Data theft • Firmware corruption • Malware • DDoS During Operation • Trusted boot process • Hardware based isolation of critical material • Payload authentication • Authenticated communications • Tamper resistance • Trusted remediation Threats Security Measures
15 Isolation Technology Example: ARM TrustZone Copyright Sequitur Labs Inc. 2017 • Secure /Non-Secure States • Low impact context switch • Controlled access to resources • Crypto resources • Security applications • Keys • Peripherals
16 Design For Security - Through The Lifecycle Copyright Sequitur Labs Inc. 2017 • Data theft • Stolen network credentials • IP Theft • Cloning Retiring The Device • De-authorize devices • Wipe stored data • Secure command and control Threats Security Measures
17 Security Through The Device Lifecycle - Summary Copyright Sequitur Labs Inc. 2017 • IP Theft • Unauthorized manufacture • Cloning Create Operate Retire • Compromised communications • Compromised upgrades • Data theft • Firmware corruption • Malware • DDoS • Data theft • Stolen network credentials • IP Theft • Cloning • Hardware root of trust • Inject unique keys and certs at manufacturing • Immutable device ID • Trusted boot process • Hardware based isolation of critical material • Payload authentication • Authenticated communications • Tamper resistance • Trusted remediation • De-authorize devices • Wipe stored data Threats Security Measures
18 Selecting The Right Platform – From a Security Perspective Copyright Sequitur Labs Inc. 2017 • Hardware Platform Considerations • MCU v/s MPU • Hardware isolation technologies • Hardware crypto accelerators, TRNG • Tamper detection, resistance • Secure debug capabilities • Device/Application Use Considerations • Connectivity/data transmission (example – device pairing, cloud connectivity) • Peripherals that need security (example – biometric readers) • Application data that need securing (example – patient info in medical device) • Application processes that need securing (example – financial transactions)
19 Key Takeaway Copyright Sequitur Labs Inc. 2017 It’s only Smart if it’s Secure
20 More Stuff Here…. Copyright Sequitur Labs Inc. 2017 • CoreTEE: http://www.sequiturlabs.com/coretee/coretee-demo/ • CoreLockr-TZ: http://www.sequiturlabs.com/corelockrtz/corelockr-tz-demo-for-secure-iot/ • End-to-End Security Use Case: https://youtu.be/C0fCUgBvzDc • ARM and Sequitur Labs Demonstrate Secure IoT Systems: http://www.sequiturlabs.com/media_portfolio/arm-sequitur-labs-demonstrate-secure-iot-systems/ • Sequitur Labs Shows Real-World Use of New TrustZone for v8-M Platform: http://www.sequiturlabs.com/media_portfolio/sequitur-labs-shows-real-world-use-of-new-core-m-platform/
21 Talk To Us..... Copyright Sequitur Labs Inc. 2017 • We can help. • We like helping. • Really. • Try us out! www.sequiturlabs.com info@sequiturlabs.com

Recommended

Security in the Internet of Things
Security in the Internet of ThingsSecurity in the Internet of Things
Security in the Internet of Things
ForgeRock
 
Security Fundamental for IoT Devices; Creating the Internet of Secure Things
Security Fundamental for IoT Devices; Creating the Internet of Secure ThingsSecurity Fundamental for IoT Devices; Creating the Internet of Secure Things
Security Fundamental for IoT Devices; Creating the Internet of Secure Things
Design World
 
IoT Security – Executing an Effective Security Testing Process
IoT Security – Executing an Effective Security Testing Process IoT Security – Executing an Effective Security Testing Process
IoT Security – Executing an Effective Security Testing Process
EC-Council
 
Internet of Things Security
Internet of Things SecurityInternet of Things Security
Internet of Things Security
Tutun Juhana
 
IoT/M2M Security
IoT/M2M SecurityIoT/M2M Security
IoT/M2M Security
Yu-Hsin Hung
 
Security Testing for IoT Systems
Security Testing for IoT SystemsSecurity Testing for IoT Systems
Security Testing for IoT Systems
Security Innovation
 
Privacy and Security in the Internet of Things
Privacy and Security in the Internet of ThingsPrivacy and Security in the Internet of Things
Privacy and Security in the Internet of Things
Jeff Katz
 
Iot Security, Internet of Things
Iot Security, Internet of ThingsIot Security, Internet of Things
Iot Security, Internet of Things
Bryan Len
 

Recommended

Security in the Internet of Things
Security in the Internet of ThingsSecurity in the Internet of Things
Security in the Internet of Things
ForgeRock
 
Security Fundamental for IoT Devices; Creating the Internet of Secure Things
Security Fundamental for IoT Devices; Creating the Internet of Secure ThingsSecurity Fundamental for IoT Devices; Creating the Internet of Secure Things
Security Fundamental for IoT Devices; Creating the Internet of Secure Things
Design World
 
IoT Security – Executing an Effective Security Testing Process
IoT Security – Executing an Effective Security Testing Process IoT Security – Executing an Effective Security Testing Process
IoT Security – Executing an Effective Security Testing Process
EC-Council
 
Internet of Things Security
Internet of Things SecurityInternet of Things Security
Internet of Things Security
Tutun Juhana
 
IoT/M2M Security
IoT/M2M SecurityIoT/M2M Security
IoT/M2M Security
Yu-Hsin Hung
 
Security Testing for IoT Systems
Security Testing for IoT SystemsSecurity Testing for IoT Systems
Security Testing for IoT Systems
Security Innovation
 
Privacy and Security in the Internet of Things
Privacy and Security in the Internet of ThingsPrivacy and Security in the Internet of Things
Privacy and Security in the Internet of Things
Jeff Katz
 
Iot Security, Internet of Things
Iot Security, Internet of ThingsIot Security, Internet of Things
Iot Security, Internet of Things
Bryan Len
 
Internet of things security challenges
Internet of things security challengesInternet of things security challenges
Internet of things security challenges
Hadi Fadlallah
 
ON THE SECURITY AND PRIVACY OF INTERNET OF THINGS ARCHITECTURES
ON THE SECURITY AND PRIVACY OF INTERNET OF THINGS ARCHITECTURESON THE SECURITY AND PRIVACY OF INTERNET OF THINGS ARCHITECTURES
ON THE SECURITY AND PRIVACY OF INTERNET OF THINGS ARCHITECTURES
Manisha Luthra
 
IoT Security: Debunking the "We Aren't THAT Connected" Myth
IoT Security: Debunking the "We Aren't THAT Connected" MythIoT Security: Debunking the "We Aren't THAT Connected" Myth
IoT Security: Debunking the "We Aren't THAT Connected" Myth
Security Innovation
 
The Internet of Everything is Here
The Internet of Everything is HereThe Internet of Everything is Here
The Internet of Everything is Here
Lancope, Inc.
 
IoT security compliance checklist
IoT security compliance checklist IoT security compliance checklist
IoT security compliance checklist
PriyaNemade
 
IoT security
IoT securityIoT security
IoT security
YashKesharwani2
 
Security for iot and cloud aug 25b 2017
Security for iot and cloud aug 25b 2017Security for iot and cloud aug 25b 2017
Security for iot and cloud aug 25b 2017
Ulf Mattsson
 
IoT Security: Cases and Methods [CON5446]
IoT Security: Cases and Methods [CON5446]IoT Security: Cases and Methods [CON5446]
IoT Security: Cases and Methods [CON5446]
Leonardo De Moura Rocha Lima
 
IoT Security, Mirai Revisited
IoT Security, Mirai RevisitedIoT Security, Mirai Revisited
IoT Security, Mirai Revisited
Clare Nelson, CISSP, CIPP-E
 
Ryan Wilson - ryanwilson.com - IoT Security
Ryan Wilson - ryanwilson.com - IoT SecurityRyan Wilson - ryanwilson.com - IoT Security
Ryan Wilson - ryanwilson.com - IoT Security
Ryan Wilson
 
Securing the Internet of Things
Securing the Internet of ThingsSecuring the Internet of Things
Securing the Internet of Things
Christopher Frenz
 
WSO2Con EU 2015: Keynote - The Identity of Things: The Next Internet Challenge
WSO2Con EU 2015: Keynote - The Identity of Things: The Next Internet ChallengeWSO2Con EU 2015: Keynote - The Identity of Things: The Next Internet Challenge
WSO2Con EU 2015: Keynote - The Identity of Things: The Next Internet Challenge
WSO2
 
IoT Security, Threats and Challenges By V.P.Prabhakaran
IoT Security, Threats and Challenges By V.P.PrabhakaranIoT Security, Threats and Challenges By V.P.Prabhakaran
IoT Security, Threats and Challenges By V.P.Prabhakaran
Koenig Solutions Ltd.
 
BSidesHSV 2020 - Keynote - 2030: The Next Decade
BSidesHSV 2020 - Keynote - 2030: The Next DecadeBSidesHSV 2020 - Keynote - 2030: The Next Decade
BSidesHSV 2020 - Keynote - 2030: The Next Decade
Chris Sistrunk
 
Understanding IoT Security: How to Quantify Security Risk of IoT Technologies
Understanding IoT Security: How to Quantify Security Risk of IoT TechnologiesUnderstanding IoT Security: How to Quantify Security Risk of IoT Technologies
Understanding IoT Security: How to Quantify Security Risk of IoT Technologies
Denim Group
 
Internet & iot security
Internet & iot securityInternet & iot security
Internet & iot security
Usman Anjum
 
Security challenges for IoT
Security challenges for IoTSecurity challenges for IoT
Security challenges for IoTWSO2
 
2012 12-04 --ncc_group_-_mobile_threat_war_room
2012 12-04 --ncc_group_-_mobile_threat_war_room2012 12-04 --ncc_group_-_mobile_threat_war_room
2012 12-04 --ncc_group_-_mobile_threat_war_roomNCC Group
 
The Insecurity of Industrial Things
The Insecurity of Industrial ThingsThe Insecurity of Industrial Things
The Insecurity of Industrial Things
Senrio
 
IoT Security by Sanjay Kumar
IoT Security by Sanjay KumarIoT Security by Sanjay Kumar
IoT Security by Sanjay Kumar
OWASP Delhi
 
Track 5 session 1 - st dev con 2016 - need for security for iot
Track 5 session 1 - st dev con 2016 - need for security for iotTrack 5 session 1 - st dev con 2016 - need for security for iot
Track 5 session 1 - st dev con 2016 - need for security for iot
ST_World
 
Hack one iot device, break them all!
Hack one iot device, break them all!Hack one iot device, break them all!
Hack one iot device, break them all!
Justin Black
 

More Related Content

What's hot

Internet of things security challenges
Internet of things security challengesInternet of things security challenges
Internet of things security challenges
Hadi Fadlallah
 
ON THE SECURITY AND PRIVACY OF INTERNET OF THINGS ARCHITECTURES
ON THE SECURITY AND PRIVACY OF INTERNET OF THINGS ARCHITECTURESON THE SECURITY AND PRIVACY OF INTERNET OF THINGS ARCHITECTURES
ON THE SECURITY AND PRIVACY OF INTERNET OF THINGS ARCHITECTURES
Manisha Luthra
 
IoT Security: Debunking the "We Aren't THAT Connected" Myth
IoT Security: Debunking the "We Aren't THAT Connected" MythIoT Security: Debunking the "We Aren't THAT Connected" Myth
IoT Security: Debunking the "We Aren't THAT Connected" Myth
Security Innovation
 
The Internet of Everything is Here
The Internet of Everything is HereThe Internet of Everything is Here
The Internet of Everything is Here
Lancope, Inc.
 
IoT security compliance checklist
IoT security compliance checklist IoT security compliance checklist
IoT security compliance checklist
PriyaNemade
 
IoT security
IoT securityIoT security
IoT security
YashKesharwani2
 
Security for iot and cloud aug 25b 2017
Security for iot and cloud aug 25b 2017Security for iot and cloud aug 25b 2017
Security for iot and cloud aug 25b 2017
Ulf Mattsson
 
IoT Security: Cases and Methods [CON5446]
IoT Security: Cases and Methods [CON5446]IoT Security: Cases and Methods [CON5446]
IoT Security: Cases and Methods [CON5446]
Leonardo De Moura Rocha Lima
 
IoT Security, Mirai Revisited
IoT Security, Mirai RevisitedIoT Security, Mirai Revisited
IoT Security, Mirai Revisited
Clare Nelson, CISSP, CIPP-E
 
Ryan Wilson - ryanwilson.com - IoT Security
Ryan Wilson - ryanwilson.com - IoT SecurityRyan Wilson - ryanwilson.com - IoT Security
Ryan Wilson - ryanwilson.com - IoT Security
Ryan Wilson
 
Securing the Internet of Things
Securing the Internet of ThingsSecuring the Internet of Things
Securing the Internet of Things
Christopher Frenz
 
WSO2Con EU 2015: Keynote - The Identity of Things: The Next Internet Challenge
WSO2Con EU 2015: Keynote - The Identity of Things: The Next Internet ChallengeWSO2Con EU 2015: Keynote - The Identity of Things: The Next Internet Challenge
WSO2Con EU 2015: Keynote - The Identity of Things: The Next Internet Challenge
WSO2
 
IoT Security, Threats and Challenges By V.P.Prabhakaran
IoT Security, Threats and Challenges By V.P.PrabhakaranIoT Security, Threats and Challenges By V.P.Prabhakaran
IoT Security, Threats and Challenges By V.P.Prabhakaran
Koenig Solutions Ltd.
 
BSidesHSV 2020 - Keynote - 2030: The Next Decade
BSidesHSV 2020 - Keynote - 2030: The Next DecadeBSidesHSV 2020 - Keynote - 2030: The Next Decade
BSidesHSV 2020 - Keynote - 2030: The Next Decade
Chris Sistrunk
 
Understanding IoT Security: How to Quantify Security Risk of IoT Technologies
Understanding IoT Security: How to Quantify Security Risk of IoT TechnologiesUnderstanding IoT Security: How to Quantify Security Risk of IoT Technologies
Understanding IoT Security: How to Quantify Security Risk of IoT Technologies
Denim Group
 
Internet & iot security
Internet & iot securityInternet & iot security
Internet & iot security
Usman Anjum
 
Security challenges for IoT
Security challenges for IoTSecurity challenges for IoT
Security challenges for IoTWSO2
 
2012 12-04 --ncc_group_-_mobile_threat_war_room
2012 12-04 --ncc_group_-_mobile_threat_war_room2012 12-04 --ncc_group_-_mobile_threat_war_room
2012 12-04 --ncc_group_-_mobile_threat_war_roomNCC Group
 
The Insecurity of Industrial Things
The Insecurity of Industrial ThingsThe Insecurity of Industrial Things
The Insecurity of Industrial Things
Senrio
 
IoT Security by Sanjay Kumar
IoT Security by Sanjay KumarIoT Security by Sanjay Kumar
IoT Security by Sanjay Kumar
OWASP Delhi
 

What's hot (20)

Internet of things security challenges
Internet of things security challengesInternet of things security challenges
Internet of things security challenges
 
ON THE SECURITY AND PRIVACY OF INTERNET OF THINGS ARCHITECTURES
ON THE SECURITY AND PRIVACY OF INTERNET OF THINGS ARCHITECTURESON THE SECURITY AND PRIVACY OF INTERNET OF THINGS ARCHITECTURES
ON THE SECURITY AND PRIVACY OF INTERNET OF THINGS ARCHITECTURES
 
IoT Security: Debunking the "We Aren't THAT Connected" Myth
IoT Security: Debunking the "We Aren't THAT Connected" MythIoT Security: Debunking the "We Aren't THAT Connected" Myth
IoT Security: Debunking the "We Aren't THAT Connected" Myth
 
The Internet of Everything is Here
The Internet of Everything is HereThe Internet of Everything is Here
The Internet of Everything is Here
 
IoT security compliance checklist
IoT security compliance checklist IoT security compliance checklist
IoT security compliance checklist
 
IoT security
IoT securityIoT security
IoT security
 
Security for iot and cloud aug 25b 2017
Security for iot and cloud aug 25b 2017Security for iot and cloud aug 25b 2017
Security for iot and cloud aug 25b 2017
 
IoT Security: Cases and Methods [CON5446]
IoT Security: Cases and Methods [CON5446]IoT Security: Cases and Methods [CON5446]
IoT Security: Cases and Methods [CON5446]
 
IoT Security, Mirai Revisited
IoT Security, Mirai RevisitedIoT Security, Mirai Revisited
IoT Security, Mirai Revisited
 
Ryan Wilson - ryanwilson.com - IoT Security
Ryan Wilson - ryanwilson.com - IoT SecurityRyan Wilson - ryanwilson.com - IoT Security
Ryan Wilson - ryanwilson.com - IoT Security
 
Securing the Internet of Things
Securing the Internet of ThingsSecuring the Internet of Things
Securing the Internet of Things
 
WSO2Con EU 2015: Keynote - The Identity of Things: The Next Internet Challenge
WSO2Con EU 2015: Keynote - The Identity of Things: The Next Internet ChallengeWSO2Con EU 2015: Keynote - The Identity of Things: The Next Internet Challenge
WSO2Con EU 2015: Keynote - The Identity of Things: The Next Internet Challenge
 
IoT Security, Threats and Challenges By V.P.Prabhakaran
IoT Security, Threats and Challenges By V.P.PrabhakaranIoT Security, Threats and Challenges By V.P.Prabhakaran
IoT Security, Threats and Challenges By V.P.Prabhakaran
 
BSidesHSV 2020 - Keynote - 2030: The Next Decade
BSidesHSV 2020 - Keynote - 2030: The Next DecadeBSidesHSV 2020 - Keynote - 2030: The Next Decade
BSidesHSV 2020 - Keynote - 2030: The Next Decade
 
Understanding IoT Security: How to Quantify Security Risk of IoT Technologies
Understanding IoT Security: How to Quantify Security Risk of IoT TechnologiesUnderstanding IoT Security: How to Quantify Security Risk of IoT Technologies
Understanding IoT Security: How to Quantify Security Risk of IoT Technologies
 
Internet & iot security
Internet & iot securityInternet & iot security
Internet & iot security
 
Security challenges for IoT
Security challenges for IoTSecurity challenges for IoT
Security challenges for IoT
 
2012 12-04 --ncc_group_-_mobile_threat_war_room
2012 12-04 --ncc_group_-_mobile_threat_war_room2012 12-04 --ncc_group_-_mobile_threat_war_room
2012 12-04 --ncc_group_-_mobile_threat_war_room
 
The Insecurity of Industrial Things
The Insecurity of Industrial ThingsThe Insecurity of Industrial Things
The Insecurity of Industrial Things
 
IoT Security by Sanjay Kumar
IoT Security by Sanjay KumarIoT Security by Sanjay Kumar
IoT Security by Sanjay Kumar
 

Similar to How to create a secure IoT device

Track 5 session 1 - st dev con 2016 - need for security for iot
Track 5 session 1 - st dev con 2016 - need for security for iotTrack 5 session 1 - st dev con 2016 - need for security for iot
Track 5 session 1 - st dev con 2016 - need for security for iot
ST_World
 
Hack one iot device, break them all!
Hack one iot device, break them all!Hack one iot device, break them all!
Hack one iot device, break them all!
Justin Black
 
逃避可恥還沒有用- 你不可不知的物聯網安全問題與挑戰（Ashley Shen & Belinda Lai）
逃避可恥還沒有用- 你不可不知的物聯網安全問題與挑戰（Ashley Shen & Belinda Lai）逃避可恥還沒有用- 你不可不知的物聯網安全問題與挑戰（Ashley Shen & Belinda Lai）
逃避可恥還沒有用- 你不可不知的物聯網安全問題與挑戰（Ashley Shen & Belinda Lai）
HITCON GIRLS
 
Security Issues in Internet of Things
Security Issues in Internet of ThingsSecurity Issues in Internet of Things
Security Issues in Internet of Things
Lohith Haravu Chandrashekar
 
Why defensive research is sexy too.. … and a real sign of skill
Why defensive research is sexy too.. … and a real sign of skillWhy defensive research is sexy too.. … and a real sign of skill
Why defensive research is sexy too.. … and a real sign of skill
Ollie Whitehouse
 
Creating secure apps using the salesforce mobile sdk
Creating secure apps using the salesforce mobile sdkCreating secure apps using the salesforce mobile sdk
Creating secure apps using the salesforce mobile sdk
Martin Vigo
 
Ten security product categories you've (probably) never heard of
Ten security product categories you've (probably) never heard ofTen security product categories you've (probably) never heard of
Ten security product categories you've (probably) never heard of
Adrian Sanabria
 
Securing Your Digital Files from Legal Threats
Securing Your Digital Files from Legal ThreatsSecuring Your Digital Files from Legal Threats
Securing Your Digital Files from Legal Threats
Abbie Hosta
 
Understanding Zero Trust Security for IBM i
Understanding Zero Trust Security for IBM iUnderstanding Zero Trust Security for IBM i
Understanding Zero Trust Security for IBM i
Precisely
 
Better to Ask Permission? Best Practices for Privacy and Security
Better to Ask Permission? Best Practices for Privacy and SecurityBetter to Ask Permission? Best Practices for Privacy and Security
Better to Ask Permission? Best Practices for Privacy and Security
Eric Kavanagh
 
Thought Leadership Webinar - Internet of things (IoT): The Next Cyber Securit...
Thought Leadership Webinar - Internet of things (IoT): The Next Cyber Securit...Thought Leadership Webinar - Internet of things (IoT): The Next Cyber Securit...
Thought Leadership Webinar - Internet of things (IoT): The Next Cyber Securit...
ClicTest
 
CertainSafe MicroTokenization Technology Detailed Overview
CertainSafe MicroTokenization Technology Detailed OverviewCertainSafe MicroTokenization Technology Detailed Overview
CertainSafe MicroTokenization Technology Detailed Overview
Steven Russo
 
Avoid embarrassing press by designing secure IoT products with Misha Seltzer
Avoid embarrassing press by designing secure IoT products with Misha SeltzerAvoid embarrassing press by designing secure IoT products with Misha Seltzer
Avoid embarrassing press by designing secure IoT products with Misha Seltzer
Product of Things
 
What Does a Full Featured Security Strategy Look Like?
What Does a Full Featured Security Strategy Look Like?What Does a Full Featured Security Strategy Look Like?
What Does a Full Featured Security Strategy Look Like?
Precisely
 
Fundamental Best Practices in Secure IoT Product Development
Fundamental Best Practices in Secure IoT Product DevelopmentFundamental Best Practices in Secure IoT Product Development
Fundamental Best Practices in Secure IoT Product Development
Mark Szewczul, CISSP
 
Application Security within Agile
Application Security within AgileApplication Security within Agile
Application Security within Agile
Netlight Consulting
 
Refugees on Rails Berlin - #2 Tech Talk on Security
Refugees on Rails Berlin - #2 Tech Talk on SecurityRefugees on Rails Berlin - #2 Tech Talk on Security
Refugees on Rails Berlin - #2 Tech Talk on Security
Gianluca Varisco
 
The 5 Crazy Mistakes IoT Administrators Make with System Credentials
The 5 Crazy Mistakes IoT Administrators Make with System CredentialsThe 5 Crazy Mistakes IoT Administrators Make with System Credentials
The 5 Crazy Mistakes IoT Administrators Make with System Credentials
BeyondTrust
 
Securing your Cloud Environment v2
Securing your Cloud Environment v2Securing your Cloud Environment v2
Securing your Cloud Environment v2
ShapeBlue
 
[Webinar] Building a Product Security Incident Response Team: Learnings from ...
[Webinar] Building a Product Security Incident Response Team: Learnings from ...[Webinar] Building a Product Security Incident Response Team: Learnings from ...
[Webinar] Building a Product Security Incident Response Team: Learnings from ...
bugcrowd
 

Similar to How to create a secure IoT device (20)

Track 5 session 1 - st dev con 2016 - need for security for iot
Track 5 session 1 - st dev con 2016 - need for security for iotTrack 5 session 1 - st dev con 2016 - need for security for iot
Track 5 session 1 - st dev con 2016 - need for security for iot
 
Hack one iot device, break them all!
Hack one iot device, break them all!Hack one iot device, break them all!
Hack one iot device, break them all!
 
逃避可恥還沒有用- 你不可不知的物聯網安全問題與挑戰（Ashley Shen & Belinda Lai）
逃避可恥還沒有用- 你不可不知的物聯網安全問題與挑戰（Ashley Shen & Belinda Lai）逃避可恥還沒有用- 你不可不知的物聯網安全問題與挑戰（Ashley Shen & Belinda Lai）
逃避可恥還沒有用- 你不可不知的物聯網安全問題與挑戰（Ashley Shen & Belinda Lai）
 
Security Issues in Internet of Things
Security Issues in Internet of ThingsSecurity Issues in Internet of Things
Security Issues in Internet of Things
 
Why defensive research is sexy too.. … and a real sign of skill
Why defensive research is sexy too.. … and a real sign of skillWhy defensive research is sexy too.. … and a real sign of skill
Why defensive research is sexy too.. … and a real sign of skill
 
Creating secure apps using the salesforce mobile sdk
Creating secure apps using the salesforce mobile sdkCreating secure apps using the salesforce mobile sdk
Creating secure apps using the salesforce mobile sdk
 
Ten security product categories you've (probably) never heard of
Ten security product categories you've (probably) never heard ofTen security product categories you've (probably) never heard of
Ten security product categories you've (probably) never heard of
 
Securing Your Digital Files from Legal Threats
Securing Your Digital Files from Legal ThreatsSecuring Your Digital Files from Legal Threats
Securing Your Digital Files from Legal Threats
 
Understanding Zero Trust Security for IBM i
Understanding Zero Trust Security for IBM iUnderstanding Zero Trust Security for IBM i
Understanding Zero Trust Security for IBM i
 
Better to Ask Permission? Best Practices for Privacy and Security
Better to Ask Permission? Best Practices for Privacy and SecurityBetter to Ask Permission? Best Practices for Privacy and Security
Better to Ask Permission? Best Practices for Privacy and Security
 
Thought Leadership Webinar - Internet of things (IoT): The Next Cyber Securit...
Thought Leadership Webinar - Internet of things (IoT): The Next Cyber Securit...Thought Leadership Webinar - Internet of things (IoT): The Next Cyber Securit...
Thought Leadership Webinar - Internet of things (IoT): The Next Cyber Securit...
 
CertainSafe MicroTokenization Technology Detailed Overview
CertainSafe MicroTokenization Technology Detailed OverviewCertainSafe MicroTokenization Technology Detailed Overview
CertainSafe MicroTokenization Technology Detailed Overview
 
Avoid embarrassing press by designing secure IoT products with Misha Seltzer
Avoid embarrassing press by designing secure IoT products with Misha SeltzerAvoid embarrassing press by designing secure IoT products with Misha Seltzer
Avoid embarrassing press by designing secure IoT products with Misha Seltzer
 
What Does a Full Featured Security Strategy Look Like?
What Does a Full Featured Security Strategy Look Like?What Does a Full Featured Security Strategy Look Like?
What Does a Full Featured Security Strategy Look Like?
 
Fundamental Best Practices in Secure IoT Product Development
Fundamental Best Practices in Secure IoT Product DevelopmentFundamental Best Practices in Secure IoT Product Development
Fundamental Best Practices in Secure IoT Product Development
 
Application Security within Agile
Application Security within AgileApplication Security within Agile
Application Security within Agile
 
Refugees on Rails Berlin - #2 Tech Talk on Security
Refugees on Rails Berlin - #2 Tech Talk on SecurityRefugees on Rails Berlin - #2 Tech Talk on Security
Refugees on Rails Berlin - #2 Tech Talk on Security
 
The 5 Crazy Mistakes IoT Administrators Make with System Credentials
The 5 Crazy Mistakes IoT Administrators Make with System CredentialsThe 5 Crazy Mistakes IoT Administrators Make with System Credentials
The 5 Crazy Mistakes IoT Administrators Make with System Credentials
 
Securing your Cloud Environment v2
Securing your Cloud Environment v2Securing your Cloud Environment v2
Securing your Cloud Environment v2
 
[Webinar] Building a Product Security Incident Response Team: Learnings from ...
[Webinar] Building a Product Security Incident Response Team: Learnings from ...[Webinar] Building a Product Security Incident Response Team: Learnings from ...
[Webinar] Building a Product Security Incident Response Team: Learnings from ...
 

Recently uploaded

一比一原版(IIT毕业证)伊利诺伊理工大学毕业证如何办理
一比一原版(IIT毕业证)伊利诺伊理工大学毕业证如何办理一比一原版(IIT毕业证)伊利诺伊理工大学毕业证如何办理
一比一原版(IIT毕业证)伊利诺伊理工大学毕业证如何办理
aozcue
 
Building a Raspberry Pi Robot with Dot NET 8, Blazor and SignalR - Slides Onl...
Building a Raspberry Pi Robot with Dot NET 8, Blazor and SignalR - Slides Onl...Building a Raspberry Pi Robot with Dot NET 8, Blazor and SignalR - Slides Onl...
Building a Raspberry Pi Robot with Dot NET 8, Blazor and SignalR - Slides Onl...
Peter Gallagher
 
欧洲杯冠军-欧洲杯冠军网站-欧洲杯冠军|【​网址​🎉ac123.net🎉​】领先全球的买球投注平台
欧洲杯冠军-欧洲杯冠军网站-欧洲杯冠军|【​网址​🎉ac123.net🎉​】领先全球的买球投注平台欧洲杯冠军-欧洲杯冠军网站-欧洲杯冠军|【​网址​🎉ac123.net🎉​】领先全球的买球投注平台
欧洲杯冠军-欧洲杯冠军网站-欧洲杯冠军|【​网址​🎉ac123.net🎉​】领先全球的买球投注平台
andreassenrolf537
 
一比一原版(UMich毕业证)密歇根大学|安娜堡分校毕业证如何办理
一比一原版(UMich毕业证)密歇根大学|安娜堡分校毕业证如何办理一比一原版(UMich毕业证)密歇根大学|安娜堡分校毕业证如何办理
一比一原版(UMich毕业证)密歇根大学|安娜堡分校毕业证如何办理
peuce
 
一比一原版(UCSB毕业证)圣塔芭芭拉社区大学毕业证如何办理
一比一原版(UCSB毕业证)圣塔芭芭拉社区大学毕业证如何办理一比一原版(UCSB毕业证)圣塔芭芭拉社区大学毕业证如何办理
一比一原版(UCSB毕业证)圣塔芭芭拉社区大学毕业证如何办理
aozcue
 
web-tech-lab-manual-final-abhas.pdf. Jer
web-tech-lab-manual-final-abhas.pdf. Jerweb-tech-lab-manual-final-abhas.pdf. Jer
web-tech-lab-manual-final-abhas.pdf. Jer
freshgammer09
 
MATHEMATICS BRIDGE COURSE (TEN DAYS PLANNER) (FOR CLASS XI STUDENTS GOING TO ...
MATHEMATICS BRIDGE COURSE (TEN DAYS PLANNER) (FOR CLASS XI STUDENTS GOING TO ...MATHEMATICS BRIDGE COURSE (TEN DAYS PLANNER) (FOR CLASS XI STUDENTS GOING TO ...
MATHEMATICS BRIDGE COURSE (TEN DAYS PLANNER) (FOR CLASS XI STUDENTS GOING TO ...
PinkySharma900491
 

Recently uploaded (7)

一比一原版(IIT毕业证)伊利诺伊理工大学毕业证如何办理
一比一原版(IIT毕业证)伊利诺伊理工大学毕业证如何办理一比一原版(IIT毕业证)伊利诺伊理工大学毕业证如何办理
一比一原版(IIT毕业证)伊利诺伊理工大学毕业证如何办理
 
Building a Raspberry Pi Robot with Dot NET 8, Blazor and SignalR - Slides Onl...
Building a Raspberry Pi Robot with Dot NET 8, Blazor and SignalR - Slides Onl...Building a Raspberry Pi Robot with Dot NET 8, Blazor and SignalR - Slides Onl...
Building a Raspberry Pi Robot with Dot NET 8, Blazor and SignalR - Slides Onl...
 
欧洲杯冠军-欧洲杯冠军网站-欧洲杯冠军|【​网址​🎉ac123.net🎉​】领先全球的买球投注平台
欧洲杯冠军-欧洲杯冠军网站-欧洲杯冠军|【​网址​🎉ac123.net🎉​】领先全球的买球投注平台欧洲杯冠军-欧洲杯冠军网站-欧洲杯冠军|【​网址​🎉ac123.net🎉​】领先全球的买球投注平台
欧洲杯冠军-欧洲杯冠军网站-欧洲杯冠军|【​网址​🎉ac123.net🎉​】领先全球的买球投注平台
 
一比一原版(UMich毕业证)密歇根大学|安娜堡分校毕业证如何办理
一比一原版(UMich毕业证)密歇根大学|安娜堡分校毕业证如何办理一比一原版(UMich毕业证)密歇根大学|安娜堡分校毕业证如何办理
一比一原版(UMich毕业证)密歇根大学|安娜堡分校毕业证如何办理
 
一比一原版(UCSB毕业证)圣塔芭芭拉社区大学毕业证如何办理
一比一原版(UCSB毕业证)圣塔芭芭拉社区大学毕业证如何办理一比一原版(UCSB毕业证)圣塔芭芭拉社区大学毕业证如何办理
一比一原版(UCSB毕业证)圣塔芭芭拉社区大学毕业证如何办理
 
web-tech-lab-manual-final-abhas.pdf. Jer
web-tech-lab-manual-final-abhas.pdf. Jerweb-tech-lab-manual-final-abhas.pdf. Jer
web-tech-lab-manual-final-abhas.pdf. Jer
 
MATHEMATICS BRIDGE COURSE (TEN DAYS PLANNER) (FOR CLASS XI STUDENTS GOING TO ...
MATHEMATICS BRIDGE COURSE (TEN DAYS PLANNER) (FOR CLASS XI STUDENTS GOING TO ...MATHEMATICS BRIDGE COURSE (TEN DAYS PLANNER) (FOR CLASS XI STUDENTS GOING TO ...
MATHEMATICS BRIDGE COURSE (TEN DAYS PLANNER) (FOR CLASS XI STUDENTS GOING TO ...
 

How to create a secure IoT device

  • 1. IT’S ONLY SMART….. IF IT’S SECURE AKA HOW TO CREATE A SECURE IOT DEVICE MIKE HENDRICK VP ENGG. SEQUITUR LABS INC.
  • 2. 2 Kudos! Copyright Sequitur Labs Inc. 2017 If you are thinking about IoT security……… …………you are way ahead of the game
  • 3. 3 • Smart Home • Smart Building • Smart Car • Smart Medical Devices • Smart Cities • Smart Grid • Smart Wearables Opportunity: Smart Future……. Copyright Sequitur Labs Inc. 2017
  • 4. 4 Problem: The “Smart” Future …… Copyright Sequitur Labs Inc. 2017 …….it has it’s own - Viruses - Malware - Hacker community This lightbulb is so “smart”……….
  • 5. 5 Multiple connectivity options • WiFi • Bluetooth • BLE • Whatever……… “Smart” lightbulbs Copyright Sequitur Labs Inc. 2017 Connects to your • WiFi network • Phone • Other devices What does it do? • It stores your network credentials • Knows what devices it should connect to
  • 6. 6 Hmmmm……So What? HACKERS CAN USE THIS INFORMATION TO GET INTO YOUR NETWORK AND STEAL • Passwords • Financial information • Attack webcams (been there, done that) • Steal health related information • Control security systems Copyright Sequitur Labs Inc. 2017
  • 7. 7 Say it Ain’t So!! Copyright Sequitur Labs Inc. 2017 A connected lightbulb is a “portal” into - Your home - Your life - Your family - Your friends
  • 8. 8 Bottom-line: IoT without Security……. Copyright Sequitur Labs Inc. 2017 ….. is like handing over the keys to your kingdom
  • 9. 9 • Smart Home • Smart Building • Smart Car • Smart Medical Devices • Smart Cities • Smart Grid • Smart Wearables This Could Happen to ANY Connected Device in ANY Sector Copyright Sequitur Labs Inc. 2017
  • 10. 10 HELP!! Copyright Sequitur Labs Inc. 2017 Where do I start? • Define the threats • Design for Security • Select the right platforms
  • 11. 11 Defining the Threats Copyright Sequitur Labs Inc. 2017 • Firmware Theft • Malware • DDoS Attacks • Man-in-the-middle • Physical attacks • Corrupted firmware • Compromised peripherals Devices need protection throughout their life cycle • Create • Operate • Retire
  • 12. 12 Security Threats Faced by A Device Copyright Sequitur Labs Inc. 2017 • IP Theft • Unauthorized manufacture • Cloning Create Operate Retire • Compromised communications • Compromised upgrades • Data theft • Firmware corruption • Malware • DDoS • Data theft • Stolen network credentials • IP Theft • Cloning Threats
  • 13. 13 Design For Security - Through The Lifecycle Copyright Sequitur Labs Inc. 2017 • IP Theft • Unauthorized manufacture • Cloning At Manufacture • Establish hardware root of trust • Securely inject unique keys and certs at manufacturing • Immutable device ID Threats Security Measures
  • 14. 14 Design For Security - Through The Lifecycle Copyright Sequitur Labs Inc. 2017 • Compromised communications • Compromised upgrades • Data theft • Firmware corruption • Malware • DDoS During Operation • Trusted boot process • Hardware based isolation of critical material • Payload authentication • Authenticated communications • Tamper resistance • Trusted remediation Threats Security Measures
  • 15. 15 Isolation Technology Example: ARM TrustZone Copyright Sequitur Labs Inc. 2017 • Secure /Non-Secure States • Low impact context switch • Controlled access to resources • Crypto resources • Security applications • Keys • Peripherals
  • 16. 16 Design For Security - Through The Lifecycle Copyright Sequitur Labs Inc. 2017 • Data theft • Stolen network credentials • IP Theft • Cloning Retiring The Device • De-authorize devices • Wipe stored data • Secure command and control Threats Security Measures
  • 17. 17 Security Through The Device Lifecycle - Summary Copyright Sequitur Labs Inc. 2017 • IP Theft • Unauthorized manufacture • Cloning Create Operate Retire • Compromised communications • Compromised upgrades • Data theft • Firmware corruption • Malware • DDoS • Data theft • Stolen network credentials • IP Theft • Cloning • Hardware root of trust • Inject unique keys and certs at manufacturing • Immutable device ID • Trusted boot process • Hardware based isolation of critical material • Payload authentication • Authenticated communications • Tamper resistance • Trusted remediation • De-authorize devices • Wipe stored data Threats Security Measures
  • 18. 18 Selecting The Right Platform – From a Security Perspective Copyright Sequitur Labs Inc. 2017 • Hardware Platform Considerations • MCU v/s MPU • Hardware isolation technologies • Hardware crypto accelerators, TRNG • Tamper detection, resistance • Secure debug capabilities • Device/Application Use Considerations • Connectivity/data transmission (example – device pairing, cloud connectivity) • Peripherals that need security (example – biometric readers) • Application data that need securing (example – patient info in medical device) • Application processes that need securing (example – financial transactions)
  • 19. 19 Key Takeaway Copyright Sequitur Labs Inc. 2017 It’s only Smart if it’s Secure
  • 20. 20 More Stuff Here…. Copyright Sequitur Labs Inc. 2017 • CoreTEE: http://www.sequiturlabs.com/coretee/coretee-demo/ • CoreLockr-TZ: http://www.sequiturlabs.com/corelockrtz/corelockr-tz-demo-for-secure-iot/ • End-to-End Security Use Case: https://youtu.be/C0fCUgBvzDc • ARM and Sequitur Labs Demonstrate Secure IoT Systems: http://www.sequiturlabs.com/media_portfolio/arm-sequitur-labs-demonstrate-secure-iot-systems/ • Sequitur Labs Shows Real-World Use of New TrustZone for v8-M Platform: http://www.sequiturlabs.com/media_portfolio/sequitur-labs-shows-real-world-use-of-new-core-m-platform/
  • 21. 21 Talk To Us..... Copyright Sequitur Labs Inc. 2017 • We can help. • We like helping. • Really. • Try us out! www.sequiturlabs.com info@sequiturlabs.com