The document discusses cybersecurity challenges posed by the Internet of Things. It notes that 50 billion devices will be connected to the internet by the end of the decade, many of which are unprotected and can be hacked, resulting in economic and privacy losses. Examples are given of existing IoT devices like baby monitors, fridges and medical devices being hacked. The document addresses challenges around securing sensor data and physical devices, as well as the need for scalable and easy-to-use security solutions for users.

1. .
Intel Corporation, Sandhiprakash (Sandhi) Bhide, Raj Samani, Tsensor Summit, Sept. 15-17, 2014
.
Raj Samani, EMEA CTO McAfee
Sandhiprakash Bhide, Director of Innovation, Future IOT Solutions,
Application Ready Platform Division, IOT Group
Building a secure future
Cybersecurity and the Internet of Things

2. .
Intel Corporation, Sandhiprakash (Sandhi) Bhide, Raj Samani, Tsensor Summit, Sept. 15-17, 2014
The Connected Home – The Last Decade
2

3. .
Intel Corporation, Sandhiprakash (Sandhi) Bhide, Raj Samani, Tsensor Summit, Sept. 15-17, 2014
Typical Connected Home, Year 2000
3
20002000

4. .
Intel Corporation, Sandhiprakash (Sandhi) Bhide, Raj Samani, Tsensor Summit, Sept. 15-17, 2014
Typical Connected Home, Year 2000
4

5. .
Intel Corporation, Sandhiprakash (Sandhi) Bhide, Raj Samani, Tsensor Summit, Sept. 15-17, 2014
Typical Connected Home, Year 2000
5

6. .
Intel Corporation, Sandhiprakash (Sandhi) Bhide, Raj Samani, Tsensor Summit, Sept. 15-17, 2014
Typical Connected Home, Year 2000
6

7. .
Intel Corporation, Sandhiprakash (Sandhi) Bhide, Raj Samani, Tsensor Summit, Sept. 15-17, 2014
Typical Connected Home, Year 2000
7
20132013

8. .
Intel Corporation, Sandhiprakash (Sandhi) Bhide, Raj Samani, Tsensor Summit, Sept. 15-17, 2014
Typical Connected Home, Year 2000
8

9. .
Intel Corporation, Sandhiprakash (Sandhi) Bhide, Raj Samani, Tsensor Summit, Sept. 15-17, 2014
Typical Connected Home, Year 2000
9

10. .
Intel Corporation, Sandhiprakash (Sandhi) Bhide, Raj Samani, Tsensor Summit, Sept. 15-17, 2014
Typical Connected Home, Year 2000
10

11. .
Intel Corporation, Sandhiprakash (Sandhi) Bhide, Raj Samani, Tsensor Summit, Sept. 15-17, 2014
11
50B Devices will connect to Internet by the end of the decade.
They are unprotected and can be hacked  loss of economic value & loss of
innocence (opt-in w/o knowing consequences)

12. .
Intel Corporation, Sandhiprakash (Sandhi) Bhide, Raj Samani, Tsensor Summit, Sept. 15-17, 2014
New Security Threats to Personal IOT Devices
12
Baby Monitor: Hacker takes over baby monitor and shouts obscenities
at sleeping child. ABC. 13 Aug 2013)
Fridge sending out spam after web attack compromised gadgets. One
of > than 100K devices used in spam campaign. (BBC News. Jan 2014)
“Wearable Computing Equals New Security Risks”, (InformationWeek.
13 Jan 2013)
Medical Devices: We’re starting to attach medical devices to electronic
health records, and they’re not secure.' (Healthcare IT News. May 2013)
Credit Card Information System: “Target Confirms Point-of-Sale
Malware Was Used in Attack” (Security Week. 13 Jan 2014)

13. .
Intel Corporation, Sandhiprakash (Sandhi) Bhide, Raj Samani, Tsensor Summit, Sept. 15-17, 2014
What is security and implications of not having
security?
13

14. .
Intel Corporation, Sandhiprakash (Sandhi) Bhide, Raj Samani, Tsensor Summit, Sept. 15-17, 2014
Anonymized data may not be as anonymous as is
believed. Or it may be now, but not in the future
14
How To Track Vehicles
Using Speed Data Alone
Carmakers keep data on
drivers' locations
FTC Hearing IoT Privacy
Concerns
Connected Home
Invasion: The Methods
Car insurance companies reduce the cost of insurance
by gathering data about a customer's driving practices.
Report finds automakers keeping info about driver’s
location. Owners can’t demand that info is destroyed
Anyone concerned about privacy would be well advised
to weigh in on this before the issue is taken over.
No incentive to secure products. With resources better
off spending on the features that consumers want

15. .
Intel Corporation, Sandhiprakash (Sandhi) Bhide, Raj Samani, Tsensor Summit, Sept. 15-17, 2014
Data Storage requirements
May 16, 2016
15

16. .
Intel Corporation, Sandhiprakash (Sandhi) Bhide, Raj Samani, Tsensor Summit, Sept. 15-17, 2014
Security Connected
May 16, 2016
16

17. .
Intel Corporation, Sandhiprakash (Sandhi) Bhide, Raj Samani, Tsensor Summit, Sept. 15-17, 2014
User’s Perspective of Security
Depends end user and the app
17
Person remains
anonymous unless
opted-in
Privacy
Release of
sensitive/ personal
info without
consent
SafetyData Protection
Does not cause any
harm to people
Data safe from
theft or alteration
Identity
TRUST

18. .
Intel Corporation, Sandhiprakash (Sandhi) Bhide, Raj Samani, Tsensor Summit, Sept. 15-17, 2014
Security necessarily segments the IOT market
• Different usages require different security mechanisms
• Cost sensitivity implies different security controls for different IOT
segments, i.e., smart meters
Three types of security technical issues for IOT devices
• How to secure communications?
• How to detect and recover from malware?
• How to defend the physical security of low cost devices?
IOT Security

19. .
Intel Corporation, Sandhiprakash (Sandhi) Bhide, Raj Samani, Tsensor Summit, Sept. 15-17, 2014
Sensor Security Challenge #1
Software-based sensor attack rates rising
• Sensor data left unprotected:
1. By APIs;
2. In system memory (buffers)
• Once access to sensor data is obtained, information can be
directly or indirectly inferred
Source: TapLogger: Inferring User Inputs on Smartphone Touchscreens Using On-board
Motion Sensors, WiSec’12, April, 2012.
http://www.cse.psu.edu/~szhu/papers/taplogger.pdf
Source: PlaceRaider: Virtual Theft in Physical Spaces with Smartphones,
Sept 27, 2012. http://arxiv.org/pdf/1209.5982v1.pdf

20. .
Intel Corporation, Sandhiprakash (Sandhi) Bhide, Raj Samani, Tsensor Summit, Sept. 15-17, 2014
Sensor Security Challenge #2
• Users can’t tell if sensors are on/off and cannot control use
• Sensor data can be faked -- not certified as authentic --allowing
attacks on sensor-data-based uses

21. .
Intel Corporation, Sandhiprakash (Sandhi) Bhide, Raj Samani, Tsensor Summit, Sept. 15-17, 2014
1. How do we keep the credentials provisioned in IoT devices secret
from attackers with physical access to the device?
• Important for infrastructure IoT devices but perhaps not for
personal devices
2. How do we detect IOT Device being tampered?
• Most IoT designs today assume device functionality is immutable
3. What market segments require device hardening from physical
attack (e.g., will vandalism be common in infrastructure devices)?
Sensor Security Challenge #3

22. .
Intel Corporation, Sandhiprakash (Sandhi) Bhide, Raj Samani, Tsensor Summit, Sept. 15-17, 2014
1. Sensor data is protected at the source and remains
secure during processing.
2. Provide user an easy to use environment with policies to
control sensor data processing and use.
3. Address problem in a way that is scalable (platform &
sensor types)
Protected Sensor Data Goals

23. .
Intel Corporation, Sandhiprakash (Sandhi) Bhide, Raj Samani, Tsensor Summit, Sept. 15-17, 2014
What about today?
May 16,
2016
23
Security. Unlike PC-based SCADA systems that are vulnerable to
virus and malware attacks, our system is housed on cloud based
servers. These servers are overseen by highly skilled technicians
negating the need for anti-virus updates and continuous security
vulnerability patches required by PC-based solutions

24. .
Intel Corporation, Sandhiprakash (Sandhi) Bhide, Raj Samani, Tsensor Summit, Sept. 15-17, 2014
For more information
• White Paper: http://www.mcafee.com/hk/resources/white-
papers/wp-smart-grid-cyber-security.pdf
@Raj_Samani & @CyberGridBook

25. .
Intel Corporation, Sandhiprakash (Sandhi) Bhide, Raj Samani, Tsensor Summit, Sept. 15-17, 2014
Q&A