1. Restricting
Authenticating
Tracking
User Access?
Time Is Not
On Our Side!
1- IoT Medical Device Threats: http://resources.infosecinstitute.com/hcking-implantable-medical-devices/
2- IoT Car Threats: http://www.welivesecurity.com/2015/02/10/senator-car-hacking/ and http://www.wired.com/2015/07/hackers-remotely-kill-jeep-highway/
3 -Cyber Attack on a Steel Mill in Germany: https://securityintelligence.com/german-steel-mill-meltdown-rising-stakes-in-the-internet-of-things/
4 -2014 HP Fortify Internet of Things Research Report: http://www8.hp.com/h20195/V2/GetPDF.aspx/4AA5-4759ENW.pd
12100 Sunrise Valley Dr. Suite 290-1 Reston, VA 20191
The Internet of Things (IoT) is pretty scary. We’re not talking identity theft or
criminals making money from hacking kind of scary - we’re talking about
life-threatening scary.
IoT devices are everywhere, quietly performing critical functions in the medi-
cal, engineering, and industrial fields (to name a few). For example, insulin
pumps disperse life-saving insulin for people suffering from diabetes. Howev-
er, if a criminal breaches one of these devices, it is possible to trigger the
pump to disperse a major dose of insulin, killing the patient(1). Or, criminals
could gain access to your car’s IoT and take control(2) of it while you drive!
A major IoT attack occurred in a German steel mill(3) just last year. According
to reports, the criminals began with social engineering and spear-phishing
tactics, leading to the compromise of industrial control components, which
prevented the industrial blast furnace from shutting down normally. It is
suspected that the attack was conducted by insiders that knew the mill’s
systems quite well, and it caused major damage to the mill’s systems. Fortu-
nately, no one was hurt, but the incident could easily have cost lives.
IoT is here to stay, and in most cases, such technologies are going to change
the way we do business - and our personal lives - for the better. However, the
majority of IoT devices evaluated in a recent HP Fortify research study
displayed vulnerabilities(4) which could be exploited by cybercriminals. The
IoT is the new battlefront between security professionals and cybercriminals,
because of the wealth of easy targets the IoT provides.
This means that security professionals need to be very diligent in protecting
their organization’s IoT devices, and personal devices that can connect to the
organization from employees’ homes, cars, etc. Controls need to be in place
to prevent, detect and respond to threats that could compromise the confi-
dentiality, integrity and availability of IoT devices and applications.
Internet of Things (IoT)
We are vulnerable and it’s scary! Let’s make the IoT safe!
“The IoT is
the new
battlefront....”

2. COPYRIGHT © 2015 VIMRO, LLC. ALL RIGHTS RESERVED. ALL REFERENCED COMPANY NAMES AND LOGOS ARE TRADEMARKS OF THEIR RESPECTIVE OWNERS
To ensure that your company’s leadership can be confident and comfort-
able in your IoT security, you need effective cyber resilience and risk
management programs in place. These programs should include the
following:
• Ensure that your cyber security policies, standards, and procedures
include requirements for IoT devices within your organization
• Include the NIST Framework for Cyber-Physical Systems (IoT)(5) in
your documentation
• During the release management process (prior to production rollout
of IoT devices) include an IoT threat modeling(6) exercise process
• Maintain an up-to-date inventory of IoT devices within your organi-
zation, and include this data in each IoT asset record:
o Business purpose
o Physical locations
o Firmware number
o Interface types
o Links to threat modeling reports, and
o The latest vulnerability/penetration testing reports
• Conduct penetration testing and vulnerability assessments throughout
the lifecycle of your IoT devices, especially during configuration and
change management processes
• Ensure that these technical mechanisms are implemented where
possible:
o Firewalls/ACLs
o Encryption for both at-rest and in-transit data
o Access controls
o Secure and regular firmware update processes
o Automated logging and alert mechanisms
• Conduct regular information security awareness training and ensure
that IoT is included in the training exercises
• Conduct regular social engineering exercises that target IoT attack
scenarios, to help ensure that your IoT training is effective
Internet of Things (IoT)
A Different Kind of Scary
(800) 272 0019
Ashburn, VA | Baltimore, MD | Boston, MA | Glendale, CA | Las Vegas, NV | Reston, VA | San Diego, CA | Tampa, FL
Conduct penetration
testing.... DURING
configuration and
change management.
5- NIST Framework for Cyber-Physical Systems: http://www.hldataprotection.com/files/2015/03/NIST-Cyber-phyical-Framework-PRELIMINARY-DISCUSSION-DRAFT.pdf
6- Object Management Group (OMG) Threat Modeling: http://www.omg.org/hot-topics/threat-modeling.htm

3. COPYRIGHT © 2015 VIMRO, LLC. ALL RIGHTS RESERVED. ALL REFERENCED COMPANY NAMES AND LOGOS ARE TRADEMARKS OF THEIR RESPECTIVE OWNERS
One more item is critical to your overall IoT threat management: make
sure that every phase of your IoT threat modeling process includes
threats and counter measures from attacks by an insider. Insiders pose a
much greater risk than an outsider – they have in-depth knowledge of
your systems and processes, and unparalleled access and opportunities to
compromise your IoT.
Take your IoT security into your own hands, and contact VIMRO now
to learn how we can help you implement and maintain controls to secure
your IoT devices, and design, implement and/or manage your on-going
IoT risk management program.
Internet of Things (IoT)
A Different Kind of Scary
(800) 272 0019
Ashburn, VA | Baltimore, MD | Boston, MA | Glendale, CA | Las Vegas, NV | Reston, VA | San Diego, CA | Tampa, FL
Insiders pose a
much greater risk
than an outsider.
Authored by VIMRO’s Cybersecurity Leaders