“IoT and Vision: Why It’s a Security Minefield and How to Navigate It,” a Presentation from Arm
For the full video of this presentation, please visit: https://www.edge-ai-vision.com/2021/08/iot-and-vision-why-its-a-security-minefield-and-how-to-navigate-it-a-presentation-from-arm/ Dr. Lyndon Fawcett, Principal Software Security Architect at Arm, presents the “IoT and Vision: Why It’s a Security Minefield and How to Navigate It" tutorial at the May 2021 Embedded Vision Summit. Recent advancements in machine learning have enabled market innovators to build insights from IoT sensors in the wild. These insights can be used to solve complex real-world challenges. The lack of security in typical vision-based IoT solutions is especially concerning, as they are typically responsible for managing sensitive data (PID, CCTV) or critical systems (cars, machinery). Security is rarely the first thought for developers of new types of solutions, but making systems secure after the fact is difficult since a holistic approach is required. Exacerbating this challenge of achieving end-to-end security, the development and deployment of IoT systems often involves multiple handovers of responsibility, which can make achieving end-to-end security difficult. And, due to the complexity and diversity of these systems, security bodies have been unable to prescribe “silver bullet” solutions. Based on first-hand experience, this presentation provides insights to help decision-makers better understand key challenges and potential solutions for providing secure vision-based IoT systems.
Recommended
More Related Content
What's hot
What's hot (20)
Similar to “IoT and Vision: Why It’s a Security Minefield and How to Navigate It,” a Presentation from Arm
Similar to “IoT and Vision: Why It’s a Security Minefield and How to Navigate It,” a Presentation from Arm (20)
More from Edge AI and Vision Alliance
More from Edge AI and Vision Alliance (20)
Recently uploaded
Recently uploaded (20)
“IoT and Vision: Why It’s a Security Minefield and How to Navigate It,” a Presentation from Arm
- 1. © 2021 Arm Limited 1 Vision in IoT, why It’s a Security Minefield and How to Navigate It Dr. Lyndon Fawcett Principal Software Security Architect Arm
- 2. © 2021 Arm Limited 2 Company Armv9 SeeWare
- 4. © 2021 Arm Limited 4 Intended audience & Objectives Audience: • Business decision makers (for vision in IoT) Objectives • Threat landscape of deploying vision in IoT • The state of the art in guidance around security • Recommendations for hardening What this talk is not: • A replacement for dedicated security professionals • Holistic capture of security for your business
- 6. © 2021 Arm Limited 6 © 2021 Arm Limited 6 Vision in critical systems: • Autonomous cars • Smart streets • CCTV • Water levels • Industry 4.0 • Autonomous delivery • Smart Homes Embedded vision use cases PSA 2021 Certified Report Critical systems Sensitive data 93% See security as a key differentiator
- 8. © 2021 Arm Limited 8 Cloud to edge deployment continuum Threat modeling • Actors • Context • Heterogeneity
- 9. © 2021 Arm Limited 9 • Adversarial attacks in computer vision • Sign manipulation example • Lane manipulation example • Typographic attacks • https://openai.com/blog/multimodal-neurons/ • Knowledge distillation attacks • https://arxiv.org/pdf/1906.06046.pdf • Loss of IP Vision/ML specific threats Granny Smith 85.6% iPod 0.4% library 0.0% pizza 0.0% toaster 0.0% dough 0.1% Granny Smith 00.1% iPod 99.7% library 0.0% pizza 0.0% toaster 0.0% dough 0.0%
- 10. © 2021 Arm Limited 10 IoT threats • Webcam/CCTV incidents • Smart home cameras with weak passwords • CCTV breach • General IoT incidents (still applicable to vision) • Malicious control of car driver aids • Mirai Botnet • https://www.bloomberg.com/news/articles/2021-03-09/hackers-expose-tesla-jails-in-breach- of-150-000-security-cams • https://www.bbc.co.uk/news/technology-33650491 • https://en.wikipedia.org/wiki/Mirai_(malware) • https://www.iotsecurityfoundation.org/iot-botnets-might-be-the-cybersecurity-industrys- next-big-worry/ © 2021 Arm Limited 10
- 12. © 2021 Arm Limited 12 Navigating the minefield: Overview Analyse • Partnership Model • Setting up for success Design • Zero trust • Protecting in the wild Maintain • Operations • Monitoring
- 13. © 2021 Arm Limited 13 Analyse: Partner model to IoT ML experts Cloud and Data Telco Factory Integrator Customer End customer Producing end solutions in Vision & IoT is difficult! How many components do you do in this circle? How many components do you directly rely on?
- 14. © 2021 Arm Limited 14 Analyse: setting up for success • Perform risk analysis & threat modelling for all parts of your remit • Understand what frameworks and standards you need to follow • NIST Cyber Security Framework • IoT Security Framework • Validate your partners stance and implementation of security • Field specific standards and guidelines • Road vehicles -- Cyber security (ISO/SAE FDIS 21434) • IoT Security and Privacy (ISO/IEC CD 27400.3) • Pen-tests • Selling security • Calculating your ROI
- 15. © 2021 Arm Limited 15 Design: Zero-Trust Security • Follow and implement a Zero-Trust approach to security Zero-Trust Authentication & Identity End2End Encryption Observability & Monitoring Perimeter security Data driven protection Perimeter Security Zero-Trust Security
- 16. © 2021 Arm Limited 16 Design: Protecting IoT in the wild Implementing security at the hardware layer • Not using dev boards in production! • RoT, Encrypted Storage, Secure Boot • Tamper proofing • Fuses • Device hardening • Removing access • Minimizing risk potential • Limiting data • Limiting function
- 17. © 2021 Arm Limited 17 Maintain • Getting certified for your field • Operational security • Login detection, endpoint protection • Using Multi-factor authentication (MFA) • Pen-testing • Fast Zero Day remediation
- 18. © 2021 Arm Limited 18 Summary & Questions • Vision in IoT and the threat landscape • Vision use cases and critical systems • Adversarial attacks • IoT threats • Navigating the minefield • Understanding the partnership model • Scoping your security • Standards and best practices Parts not included
- 19. Appendix
- 20. © 2021 Arm Limited 20 Warning: Parts not included! SECURITY DEVELOPMENT LIFECYCLE (SDL) INFLUENCING YOUR TEAM THAT SECURITY IS IMPORTANT DEFENSE IN DEPTH RELEASE CHECKPOINTS AND MORE…. Frameworks & Specifications Threat Management Tooling & Automation E2E Security Process Operational Security
- 21. © 2021 Arm Limited 21 Still interested? Further reading: Related content reading • https://seechange.ai/privacy-and- security/ • https://seechange.ai/from-cloud-to- iot-securing-the-continuum/ 2 General security reading • https://www.cisco.com/c/en/us/solut ions/collateral/executive- perspectives/annual-internet- report/white-paper-c11-741490.pdf • https://www.cisco.com/c/dam/en/us /products/collateral/security/2020- outcomes-study-main-report.pdf • https://www.nist.gov/programs- projects/nist-cybersecurity-iot- program