RISC Keynote v1 - Real-world IoT Security Conference (RISC) · 2017-06-23 · • Business and...

28
DESIGN.BUILD.SECURE Preventing a Global Disaster IOT SECURITY

Transcript of RISC Keynote v1 - Real-world IoT Security Conference (RISC) · 2017-06-23 · • Business and...

Page 1: RISC Keynote v1 - Real-world IoT Security Conference (RISC) · 2017-06-23 · • Business and consumer software is not required to undergo any formal assessment or validation prior

DESIGN.BUILD.SECURE

Preventing a Global Disaster

IOT SECURITY

Page 2: RISC Keynote v1 - Real-world IoT Security Conference (RISC) · 2017-06-23 · • Business and consumer software is not required to undergo any formal assessment or validation prior

IoT Security: Preventing a Global Disaster

Page

A Security Practitioner who is an Engineer

MY JOURNEY

1

My journey was accidental and eye opening2

Security and Privacy are a way of life3

We can secure IoT but we much change our way of thinking4

2Pa

gePa

ge2

Page 3: RISC Keynote v1 - Real-world IoT Security Conference (RISC) · 2017-06-23 · • Business and consumer software is not required to undergo any formal assessment or validation prior

How did we get here?

Page 4: RISC Keynote v1 - Real-world IoT Security Conference (RISC) · 2017-06-23 · • Business and consumer software is not required to undergo any formal assessment or validation prior

Page

IoT Security: Preventing a Global Disaster

BY THE NUMBERS 4

Source Code

Space Shuttle 400,000 16,000

Firefox 8,000,000 320,000

Boeing 747 14,000,000 560,000

F35 Jet Fighter 25,000,000 1,000,000

MS Office 2013 44,000,000 1,760,000

Car Software 100,000,000 4,000,000

Google 3,300,000,000 120,000,000

Page 5: RISC Keynote v1 - Real-world IoT Security Conference (RISC) · 2017-06-23 · • Business and consumer software is not required to undergo any formal assessment or validation prior

Page

IoT Security: Preventing a Global Disaster

• SCADA systems started adding IP connections • Components became cheaper due to mass manufacturing • WiFi and cellular connectivity became broadly available • Mobile and cloud became a “big thing”

WE STARTED CONNECTING 5

Page 6: RISC Keynote v1 - Real-world IoT Security Conference (RISC) · 2017-06-23 · • Business and consumer software is not required to undergo any formal assessment or validation prior

Page

IoT Security: Preventing a Global Disaster

• Business and consumer software is not required to undergo any formal assessment or validation prior to use

• Vendors hide behind licensing agreements • Vendors are not liable for vulnerabilities….but this is changing • Many developers lack skill set to develop securely • Vendors - No formal SDLC that include security testing

WE ARE ACCEPTING OF SUBSTANDARD SOFTWARE 6

Page 7: RISC Keynote v1 - Real-world IoT Security Conference (RISC) · 2017-06-23 · • Business and consumer software is not required to undergo any formal assessment or validation prior

Page

IoT Security: Preventing a Global Disaster

EARLY WARNING INDICATORS 7

ransomware

WannaCry

Mirai

IoT security

Source: trends.google.com

routers, security cameras, printers and digital video

recorder (DVRs)

Un-patched Windows desktops

Source: trends.google.com

default passwords & configs

Page 8: RISC Keynote v1 - Real-world IoT Security Conference (RISC) · 2017-06-23 · • Business and consumer software is not required to undergo any formal assessment or validation prior

Page

IoT Security: Preventing a Global Disaster

EARLY WARNING INDICATORS 2 8

15,000,000 Elevators Globally

665Gbps is only the “baseline” from weaponized things

Page 9: RISC Keynote v1 - Real-world IoT Security Conference (RISC) · 2017-06-23 · • Business and consumer software is not required to undergo any formal assessment or validation prior

Page

IoT Security: Preventing a Global Disaster

• Lack of global expertise in IoT Cyber Security ~500K • Lack of security testing and validation of products/deployments • Zero-days waiting to be discovered {and traded} • Weaponizing current generation IoT devices • Many organizations lack breach plans • State sponsored actors

THE PERFECT STORM 9

Page 10: RISC Keynote v1 - Real-world IoT Security Conference (RISC) · 2017-06-23 · • Business and consumer software is not required to undergo any formal assessment or validation prior

The IoT Attack Surface

Page 11: RISC Keynote v1 - Real-world IoT Security Conference (RISC) · 2017-06-23 · • Business and consumer software is not required to undergo any formal assessment or validation prior

Page

IoT Security: Preventing a Global Disaster

ANATOMY OF AN ATTACK 11

Recon Plan Attack Execute Attack Owned

Get to know your

target

Write a toolkit or

script

Launch attack and

validate success

Use your new device for fun and adventure

Page 12: RISC Keynote v1 - Real-world IoT Security Conference (RISC) · 2017-06-23 · • Business and consumer software is not required to undergo any formal assessment or validation prior

Page

IoT Security: Preventing a Global Disaster

THE ATTACK SURFACE 12

OT Network Internet

Platform API

Cloud Database

Threat VisibilityNo Threat Visibility

Hackers, State

Sponsored Threats, and other cyber

criminalsGateway“Thing”

Page 13: RISC Keynote v1 - Real-world IoT Security Conference (RISC) · 2017-06-23 · • Business and consumer software is not required to undergo any formal assessment or validation prior

Page

IoT Security: Preventing a Global Disaster

• Stuxnet • Marai • Vehicles • Home Monitoring • Medical Records

IOT ATTACK TURNING POINTS 13

Page 14: RISC Keynote v1 - Real-world IoT Security Conference (RISC) · 2017-06-23 · • Business and consumer software is not required to undergo any formal assessment or validation prior

Page

IoT Security: Preventing a Global Disaster

• Stuxnet - Policy • Mirai - Design, Threat Modeling and Testing • Automotive - Design, Threat Modeling and Testing • Consumer Devices - Design, Threat Modeling and Testing • Medical Records - Policy, Design, Threat Modeling and Testing

HOW THESE COULD OF BEEN PREVENTED 14

Page 15: RISC Keynote v1 - Real-world IoT Security Conference (RISC) · 2017-06-23 · • Business and consumer software is not required to undergo any formal assessment or validation prior

Security Controls 101

Page 16: RISC Keynote v1 - Real-world IoT Security Conference (RISC) · 2017-06-23 · • Business and consumer software is not required to undergo any formal assessment or validation prior

Page

IoT Security: Preventing a Global Disaster

• Prove that your organization was not negligent • Reduce product costs • Reduce legal fees and possible legal action • A higher level of assurance for end user • Competitive advantage

THE GOAL OF SECURITY 16

Page 17: RISC Keynote v1 - Real-world IoT Security Conference (RISC) · 2017-06-23 · • Business and consumer software is not required to undergo any formal assessment or validation prior

Page

IoT Security: Preventing a Global Disaster

• Implement a Information Security Management System (ISMS) • Create a SDLC that implements Secure Coding Methodology

• Threat Modelling (What is the attack surface?) • Secure by Design (Runtime, Updating, Tamper resistance,

monitoring, etc) • Source Code Evaluation • Understand your component supply chain • Test (TRA, Pen Test, VA at a minimum) for every major release • Formal Evaluation for IIoT (IEC 62443)

• PIA

SECURING YOUR IOT SOLUTION 17

Page 18: RISC Keynote v1 - Real-world IoT Security Conference (RISC) · 2017-06-23 · • Business and consumer software is not required to undergo any formal assessment or validation prior

Page

IoT Security: Preventing a Global Disaster

• With your ISMS you will know your data at risk! • Ensure your quality of data - Integrity • Validation of Data • Realize that decisions must be decentralized vs. asynchronous • You may want to consider a meta data approach

SECURING YOUR DATA 18

Page 19: RISC Keynote v1 - Real-world IoT Security Conference (RISC) · 2017-06-23 · • Business and consumer software is not required to undergo any formal assessment or validation prior

Page

IoT Security: Preventing a Global Disaster

• Primarily in IIoT but implications in consumer market with healthcare and wearables

• You must ensure you do not endanger human life with your product - based on the Threat Model

• Need to consider: Runtime, fault, resilience, and detection • Testing and Validation by 3rd party is key

SAFETY IN IOT 19

Page 20: RISC Keynote v1 - Real-world IoT Security Conference (RISC) · 2017-06-23 · • Business and consumer software is not required to undergo any formal assessment or validation prior

Privacy in an IoT World

Page 21: RISC Keynote v1 - Real-world IoT Security Conference (RISC) · 2017-06-23 · • Business and consumer software is not required to undergo any formal assessment or validation prior

Page

IoT Security: Preventing a Global Disaster

• Personally Identifying Information (PII) • Any collection of data that identify a person including:

• Name, address, DOB, Health number, SIN, passport, credit card • Need to known the legal and regulatory requirements for your

jurisdiction • Your responsible for data collected, processed and stored

• What is usable “life” of the data?

PRIVACY 21

Page 22: RISC Keynote v1 - Real-world IoT Security Conference (RISC) · 2017-06-23 · • Business and consumer software is not required to undergo any formal assessment or validation prior

Page

IoT Security: Preventing a Global Disaster

• Make sure you meet regulatory requirements • Use a “Privacy by Design” approach • Conduct a Privacy Impact Assessment (PIA) • Determine useful life of data collected • Securely delete old data

IMPLEMENTING PII 22

Page 23: RISC Keynote v1 - Real-world IoT Security Conference (RISC) · 2017-06-23 · • Business and consumer software is not required to undergo any formal assessment or validation prior

Standards

Page 24: RISC Keynote v1 - Real-world IoT Security Conference (RISC) · 2017-06-23 · • Business and consumer software is not required to undergo any formal assessment or validation prior

Page

IoT Security: Preventing a Global Disaster

• Don’t try to boil the ocean • Why ISO? • Determine what you need for your sector • At a minimum consider:

• IEC 62443 - for IIoT • ISO/IEC 27000 Series for ISMS • ISO/IEC 27034 for Application Security • ISO/EIC 29134 for Privacy Impact Assessment

STANDARDS 24

Page 25: RISC Keynote v1 - Real-world IoT Security Conference (RISC) · 2017-06-23 · • Business and consumer software is not required to undergo any formal assessment or validation prior

Conclusions

Page 26: RISC Keynote v1 - Real-world IoT Security Conference (RISC) · 2017-06-23 · • Business and consumer software is not required to undergo any formal assessment or validation prior

Page

IoT Security: Preventing a Global Disaster

• Change your company culture to be secure 1st • Implement an ISMS • Implement an SDLC • Threat Model when designing • Evaluate all 3rd party software and HW component for signs of

tampering • Respect PII of your users • Test, test, and test

HOW TO BE SUCCESSFUL AT IOT SECURITY 26

Page 27: RISC Keynote v1 - Real-world IoT Security Conference (RISC) · 2017-06-23 · • Business and consumer software is not required to undergo any formal assessment or validation prior

Page

IoT Security: Preventing a Global Disaster

• Read IEC White Paper IoT 2020: Smart and secure IoT platform • Read RIoT Control: Understanding and Managing Risks and the

Internet of Things — Tyson Macaulay • Actively track security mailing lists and CVE for new vulns • Track the changing landscape of attack targets • Get to know your data at risk • Get to know your risk posture at any given time

YOUR HOMEWORK 27

Page 28: RISC Keynote v1 - Real-world IoT Security Conference (RISC) · 2017-06-23 · • Business and consumer software is not required to undergo any formal assessment or validation prior

IoT Security: Preventing a Global Disaster

[email protected] @encrypto99

+1 613 447 3393

www.twelvedot.com

THANK-YOU FOR YOUR TIME


Risc Cisc

Risc Cisc

CISC, RISC and Post RISC

CISC, RISC and Post RISC

Introduction to RISC Processor · Architecture of MIPS-R4000 Processor Difference Between RISC and CISC Pros and Cons of RISC Why RISC. 3 ... All instruction will be executed in a

Introduction to RISC Processor · Architecture of MIPS-R4000 Processor Difference Between RISC and CISC Pros and Cons of RISC Why RISC. 3 ... All instruction will be executed in a

S3C44B0X RISC MICROPROCESSOR PRODUCT OVERVIEW … · S3C44B0X RISC MICROPROCESSOR PRODUCT OVERVIEW 1-1 1 ... • 16/32-Bit RISC architecture and powerful ... OVERVIEW RISC Machines,

S3C44B0X RISC MICROPROCESSOR PRODUCT OVERVIEW … · S3C44B0X RISC MICROPROCESSOR PRODUCT OVERVIEW 1-1 1 ... • 16/32-Bit RISC architecture and powerful ... OVERVIEW RISC Machines,

EVALUATOR RISC

EVALUATOR RISC

TSK3000A 32-bit RISC Processor - Altium tsk3000a 32 bit risc...TSK3000A 32-bit RISC Processor CR0121 (v1.3) May 09, 2005 3 RISC Processor Background RISC, or Reduced Instruction Set

TSK3000A 32-bit RISC Processor - Altium tsk3000a 32 bit risc...TSK3000A 32-bit RISC Processor CR0121 (v1.3) May 09, 2005 3 RISC Processor Background RISC, or Reduced Instruction Set

RISC:Reduced Instruction Set Computing. Overview What is RISC architecture? How did RISC evolve? How does RISC use instruction pipelining? How does RISC.

RISC:Reduced Instruction Set Computing. Overview What is RISC architecture? How did RISC evolve? How does RISC use instruction pipelining? How does RISC.

UNDERGO ALARMS

UNDERGO ALARMS

risc suveran

risc suveran

RISC AND CISC UNDERSTANDING THE RISC AND CISC ARCHITECTURES

RISC AND CISC UNDERSTANDING THE RISC AND CISC ARCHITECTURES

Super Risc

Super Risc

Risc Vertical

Risc Vertical

RiSC-oo.1.v Execution Example - ece.umd.edublj/RiSC/RiSC-ex.pdf · ENEE 446: Digital Computer Design — RiSC-oo.1.v Execution Example 1 ... (i.e. address 0 corresponds to the first

RiSC-oo.1.v Execution Example - ece.umd.edublj/RiSC/RiSC-ex.pdf · ENEE 446: Digital Computer Design — RiSC-oo.1.v Execution Example 1 ... (i.e. address 0 corresponds to the first

Introduction to RISC Assembly Language - Lagout to RISC... · Introduction to RISC Assembly Language Programming ... clean RISC (Reduced Instruction Set Computer) machine, which makes

Introduction to RISC Assembly Language - Lagout to RISC... · Introduction to RISC Assembly Language Programming ... clean RISC (Reduced Instruction Set Computer) machine, which makes

The future of operating systems on RISC-VThe future of operating systems on RISC-V ... Introduction to RISC-V RISC-V status Selected RISC-V topics RISC-V and open hardware: the future

The future of operating systems on RISC-VThe future of operating systems on RISC-V ... Introduction to RISC-V RISC-V status Selected RISC-V topics RISC-V and open hardware: the future

Tom Paone RISC to RISC Transition Procedures ... - … transition procedures... · Tom Paone RISC to RISC Transition Procedures. 2 o Use the WRKHDWRSC *STG and WRKDEVD commands to

Tom Paone RISC to RISC Transition Procedures ... - … transition procedures... · Tom Paone RISC to RISC Transition Procedures. 2 o Use the WRKHDWRSC *STG and WRKDEVD commands to

RISC ARCHITECTURE BY TEDDY LEE. TOPICS REVIEW OF RISC RISC ARCHITECTURE RISC VS. CISC PA-RISC HP ARCHITECTURE.

RISC ARCHITECTURE BY TEDDY LEE. TOPICS REVIEW OF RISC RISC ARCHITECTURE RISC VS. CISC PA-RISC HP ARCHITECTURE.

RISC Machines

RISC Machines

RISC Confirms Significant Prospective Resources for ... · RISC CONFIRMS SIGNIFICANT PROSPECTIVE RESOURCES FOR LESCHENAULT PROSPECT HIGHLIGHTS g RISC validates recently …

RISC Confirms Significant Prospective Resources for ... · RISC CONFIRMS SIGNIFICANT PROSPECTIVE RESOURCES FOR LESCHENAULT PROSPECT HIGHLIGHTS g RISC validates recently …

RISC Processor

RISC Processor