IoT Security Fundamentals That Must Be Solved. Fredrik Beckman CEO Apptimate AB Engagement Manager Combitech AB September 2016

Size: px

Start display at page:

Download "IoT Security Fundamentals That Must Be Solved. Fredrik Beckman CEO Apptimate AB Engagement Manager Combitech AB September 2016"

Stewart Ellis
6 years ago
Views:

1 1 IoT Security Fundamentals That Must Be Solved Fredrik Beckman CEO Apptimate AB Engagement Manager Combitech AB September 2016

2 2 1. IoT products must die 2. Rosetta stone 3. Thanks' for letting me in! 4. The fall of the wall 5. Rubber bands 6. The disappearing act

3 3 IOT PRODUCTS MUST DIE product life cycle management and EOL

4 4 SECURITY IS AN ITERATIVE PROCESS Release Remote push updates Maintain critical operation Hot Swap Supplier Swap New hack Patch Hack Patch Don t be the weakest link LIABILITIES Breach

5 Microsoft stopped providing security patches for Windows XP on April 8,

6 THE NON-DIGITAL MARKET IS SLOW Cars can live for 30 years

service intervals for updates COBOL is still ALIVE and

daily by COBOL 70% of all critical business logic and data

6 6 THE NON-DIGITAL MARKET IS SLOW Cars can live for 30 years or more Digital is actually NO better They need a recall or service intervals for updates COBOL is still ALIVE and kicking: 90% of Fortune 500 business systems are supported daily by COBOL 70% of all critical business logic and data is written in COBOL *

7 7 IOT PRODUCTS WILL STAY ALIVE WAY LONGER THAN EXPECTED What s your legacy?

8 8 ROSETTA STONE interoperability

9 9 The nice thing about IoT standards is that you have so many to choose from; And, if you do not like any of them, you can just wait for next year s model. Andrew S. Tanenbaum Professor Computer Science Vrije Universiteit, Amsterdam

10 IOT - A WILD WEST 360+ IoT platforms 100+ protocols

11 11

12 DEVELOPER PAIN - 6LowPAN by IETF (IPv6 for IoT) - AllJoyn by AllSeen Alliance* - AMQP by

Management Group - HomeKit by Apple* - HTTP by W3C - IoT Platform by Intel* - Mbed by ARM*

Thread by Thread Group - WAMP by Tavendo - WebSocket by IETF - XMPP by XMPP Standards

application shall communicate with mobiles, cloud, central database and IoT sensors from

12 12 DEVELOPER PAIN - 6LowPAN by IETF (IPv6 for IoT) - AllJoyn by AllSeen Alliance* - AMQP by OASIS - CoAP by IP for Smart Objects Alliance - Contiki by Thingsquare* - DDS by Object Management Group - HomeKit by Apple* - HTTP by W3C - IoT Platform by Intel* - Mbed by ARM* - MQTT by IBM - IoTivity by Open Interconnect Consortium* - Stomp by Stomp Spec Group - Thread by Thread Group - WAMP by Tavendo - WebSocket by IETF - XMPP by XMPP Standards Foundation - ZeroMQ by imatix* - ZigBee by ZigBee Alliance - Z-Wave by Z-Wave Alliance The application shall communicate with mobiles, cloud, central database and IoT sensors from all our suppliers! It must be fast and SECURE! And we need it next week! *platform rather than protocol Google

13 13 IT S ABOUT THE WHOLE APPLICATION - everything integrated WHERE IS THE WEAKEST LINK?

14 14 THANKS' FOR LETTING ME IN remote access and control

15 HOW YOUR TEA KETTLE COULD TAKE IT ALL DOWN 1 5 BlackBerry Security Summit 2016

16 16 REMOTE CONTROL DDoS Manipulation Control remotely Hack attack causes 'massive damage' at German steel works 12 of 15 Bluetooth SmartLocks easy to hack WIRED hacks a Jeep Cherokee

17 17 THE FALL OF THE WALL decentralized applications in public networks

18 18 No firewalls Decentralized applications End-2-End encryption needed Strong authentication Unique IDs is the key Multiple applications per device Application security PUBLIC NETWORKS IS THE NEW NORM

19 19 RUBBER BANDS roaming over multiple network technologies with varying bandwidth

20 20 STAY CONNECTED GPRS 3G 4G LTE 5G Satellite WiFi Bluetooth DECT Z-wave ZigBee AND MANY MORE Roaming is essential Different connection tech in different parts of applications Security over a chain of connections, proxies, hubs

21 End-2-End security strong authentication persistent connection live feed from equipment public networks varying connection system integration ehealth

22 IT S ALL ABOUT THE APPLICATION NOT THE COMPONENTS 22 Varying bandwidth and radio shadow Constrained nodes & connections Latency Distributed processing Fog computing More reading about Object Security in constrained environments:

23 23 THE DISAPPEARING ACT simplicity and NO user configuration

24 24

25 25 THE ONLY SECURITY WORTH ANYTHING IS THE ONE THAT IS USED YOUR SECURITY SOLUTION MUST BE EASY TO USE FOR USERS, ADMINISTRATORS, DEVELOPERS AND INTEGRATORS

26 26 IoT is all about the application, and the application must be secure, from start, for today and tomorrow THANK YOU REMEMBER 1. EOL 2. Interoperability 3. Remote access 4. Public networks 5. Roaming over constrained networks 6. Make it simple

Whitepaper. IoT Protocols. PAASMER Support for Protocols. Website:

Whitepaper. IoT Protocols. PAASMER Support for Protocols. Website: Whitepaper IoT Protocols PAASMER Support for Protocols Website: www.mobodexter.com www.paasmer.co 1 Table of Contents 1. Introduction 3 2. IoT Protocols 4 3. Connectivity Protocols 5 4. Application Layer