In this presentation about IoT, Point of Sale, and Mobile devices you will learn how these three apparent different fields are instead very similar and what they share in term of information security and privacy concerns.

1. 1
Roberto Martelloni,
Digital Banking and Mobile Payments Summit, April 2017, Vienna
CI
IoT, Point Of Sales And Mobile
devices
different names, same
Information Security & Privacy
concerns

2. 22
WHO AM I?
Roberto Martelloni
VP, Global Mobile Security @ CITI
COBIT®5(F), CISM, CISSP, CCSP, CSSLP, CSPO, CSM
certified with 17 years of professional experience in
Information and Cyber Security
Experience ranging from a startup to mastodontic
corporations, from niche sectors (lawful interception) to
economy driving areas (Defence, Oil and Gas, and Finance)
and also to the North Atlantic Treaty Organization (NATO).

3. 33
WHAT AM I GOING TO TALK ABOUT?
IoT, Point of Sale, and Mobile
How these three apparent different fields are instead
very similar
What they share in term of information security and
privacy concerns

4. 44
AGENDA
1. IoT technology overview
2. Point of Sale technology overview
3. Mobile technology overview
4. Differences and similarities
5. Common Information security and privacy
concerns
6. Questions

5. 55
WHAT IS AN INTERNET OF THING?
The Internet of things (IoT) is the internetworking of
physical devices, vehicles (also referred to as "connected
devices" and "smart devices"), buildings, and other items—
embedded with electronics, software, sensors, actuators,
and network connectivity that enable these objects to
collect and exchange data.
(Wikipedia)

6. 66
IoT - WEARABLE
Apple Watch
LG Watch

7. 77
IoT - SMART HOME

8. 88
IoT - SMART HOME
Nest Learning Thermostat Honeywell Smart Thermostat

9. 99
IoT - SMART OFFICE
Axessor IP LOCK Ucam 247

10. 1010
IoT - SMART TOYS (!)
CloudPets

11. 1111
IoT - UNDER THE HOOD

12. 1212
IoT - OPERATING SYSTEM
IoT Developer Survey 2016
(Eclipse IoT Working Group, IEEE IoT and AGILE IoT)

13. 1313
IoT - PROTOCOLS
Few words on Peripherals
IoT Developer Survey 2016
(Eclipse IoT Working Group, IEEE IoT and AGILE IoT)

14. 1414
IoT - CLOUD
Few words on Peripherals
IoT Developer Survey 2016
(Eclipse IoT Working Group, IEEE IoT and AGILE IoT)

15. 1515
WHAT IS AN INTERNET OF THING?
Device
+
Common operating system
+
Common or less common protocols
+
Cloud
+
Exotic Input/Output peripherals
=
Internet of things
(Roberto)

16. 1616
WHAT IS AN INTERNET OF THING (DETAILS)
# IoT
Software
Operating System Linux
Hardening No
Framework Custom
Cloud Yes
Wire
Serial Maybe
Ethernet Yes
USB Maybe
Wireless
GPS Maybe
Cellular Maybe
Wi-Fi Yes
Bluetooth Maybe
NFC Maybe
Peripherals
Card Reader Maybe
Biometric Maybe
Exotic I/O peripherals Yes

17. 1717
WHAT IS A POINT OF SALE?
A payment terminal, also known as a point of sale
terminal (PoS), credit card terminal, EFTPOS terminal (or
a PDQ terminal in the United Kingdom), is a device which
interfaces with payment cards to make electronic funds
transfers.
(Wikipedia)

18. 1818
POINT OF SALE – BIGGEST PLAYERS

19. 1919
POINT OF SALE
DESK 5000 P400

20. 2020
MOBILE POINT OF SALE
iSMP4 e355

21. 2121
POINT OF SALE – UNDER THE HOOD

22. 2222
POINT OF SALE - OPERATING SYSTEM
+

23. 2323
POINT OF SALE - SECURITY

24. 2424
POINT OF SALE - PROTOCOLS

25. 2525
POINT OF SALE - CLOUD: MARKETPLACE and APPS
https://www.ingenico.com/marketplace

26. 2626
WHAT IS A POINT OF SALE?
Device (with hardening!)
+
Common operating system (with hardening!)
+
Common protocols
+
Cloud
+
Input/Output peripherals
=
Point of Sale
(Roberto)

27. 2727
WHAT IS A POINT OF SALE (DETAILS)
# Point of Sale
Software
Operating System Linux
Hardening Yes
Framework Custom
Cloud Yes
Wire
Serial Maybe
Ethernet Yes
USB Yes
Wire
GPS No
Cellular Maybe
Wi-Fi Yes
Bluetooth Yes
NFC Yes
Peripherals
Card Reader Yes
Biometric No
Exotic I/O peripherals No

28. 2828
WHAT IS A MOBILE DEVICE?
A small computing device, having an operating
system capable of running mobile apps, a display
screen, alphanumeric keyboard or a touchscreen and
buttons (icons) on-screen. Many such devices can connect to
the Internet and other devices via Wi-Fi, Bluetooth or near
field communication (NFC). Integrated cameras, digital
media players, mobile phone and GPS capabilities.
(Wikipedia)

29. 2929
WHAT IS A MOBILE DEVICE?
Google Pixel

30. 3030
WHAT IS A MOBILE DEVICE?
Few Mobile Device pictures and market overview
Pixel C

31. 3131
WHAT IS A MOBILE DEVICE?
HUAWEI MediaPad M3 HUAWEI MediaPad T1

32. 3232
MOBILE - UNDER THE HOOD

33. 3333
MOBILE - OPERATING SYSTEM
Android iOS

34. 3434
MOBILE - OPERATING SYSTEM
Linux BSD (Unix)

35. 3535
MOBILE - OPERATING SYSTEM: EXPLOIT MARKET
https://www.zerodium.com/program.html

36. 3636
MOBILE - PROTOCOLS

37. 3737
MOBILE - CLOUD

38. 3838
WHAT IS A MOBILE DEVICE?
Device
+
Common operating system (with super hardening!)
+
Common protocols
+
Cloud (!)
+
Input/Output peripherals
=
Mobile Device
(Roberto)

39. 3939
WHAT IS A MOBILE DEVICE (DETAILS)
# Mobile
Software
Operating System Linux / Unix
Hardening Yes
Framework Android / iOS
Cloud Yes
Wire
Serial No
Ethernet No
USB Yes
Wire
GPS Yes
Cellular Yes
Wi-Fi Yes
Bluetooth Yes
NFC Yes
Peripherals
Card Reader No
Biometric Yes
Exotic I/O peripherals No

40. 4040
IoT, PoS and Mobile - UNDER THE HOOD

41. 4141
WHAT ARE IoT, PoS and MOBILE DEVICE?
Device
+
Common operating system
+
Common protocols
+
Cloud
+
Input/Output peripherals
=
IoT, PoS, and Mobile Device
(Roberto)

42. 4242
IOT, POINT OF SALE, MOBILE COMPARISON
# IoT Point of Sale Mobile
Software
Operating System Linux Linux Linux / Unix
Hardening No Yes Yes
Framework Custom Custom Android / iOS
Cloud Yes Maybe Yes
Wire
Serial Maybe Maybe No
Ethernet Yes Yes No
USB Maybe Yes Yes
Wireless
GPS Maybe No Yes
Cellular Maybe Maybe Yes
Wi-Fi Yes Yes Yes
Bluetooth Maybe Yes Yes
NFC Maybe Yes Yes
Peripherals
Card Reader Maybe Yes No
Biometric Maybe No Yes
Exotic I/O peripherals Yes No No

43. 4343
INFORMATION SECURITY
NISTIR 8144
Assessing Threats to Mobile Devices &
Infrastructure
Mobile Threat Catalogue

44. 4444
MOBILE - THREAT CATALOGUE CATEGORIES
Physical
Access
Technology
Stack
Application
Authentication EMM Ecosystem
GPS Cellular LAN & PAN
Payment Supply Chain

45. 45
THANK YOU!
Email: roberto.martelloni@citi.com