Digital Trust Ecosystem

Transcription

1 Digital Trust Ecosystem IoT Risks and Solutions Chris Edwards CTO - Intercede

2 What s the Problem? Billions of devices Millions of services Mixed closed / open trust networks Devices transferring between owners Sensitive data, access to control systems, intellectual property Much consumer-grade equipment lacks security CNI is vulnerable

3 Device Lifetime Security Service Consump7on Distribu7on / Retail Manufacture / Assembly Components

4 Devices and Data IoT and Big Data Sensors for industrial, infrastructure, commercial Household automa4on Personal devices for health and lifestyle Data authenticity and integrity Does the data actually come from the claimed device? Has the data been tampered with? Data protection and controlled sharing Data must be shared to be useful With whom and who controls access?

5 Control Systems Industrial control systems Manufacturing Agricultural Public utilities Water, electricity, natural gas Transport vehicles and infrastructure Rail Air Automo4ve

6

7 What are the Risks? Control Systems Commercial damage disrup4ve and subversive Personal and public safety Decision Information Reputa4on and confidence loss reliability and maintenance Financial impact unnecessary purchases Health and safety Privacy Personal data loss Intellectual property

8 What are the attack vectors? Counterfeit devices Specific device impersonation Ownership impersonation Device compromise pre-deployment Device compromise post-deployment Transfer of ownership and disposal

9 Domes4c Industrial Infrastructure Military

10 Defenses Trusted Devices and Services Factory lockdown Trusted provisioning to maintain the supply chain of trust Managed transfer of ownership Full lifecycle management Silicon è Component è Deviceè Service

11 The Identity of Things Devices require identities to be trusted May uniquely iden4fy a device or just aiest authen4city Can be used to validate device integrity Can be used to provide level 1 authen4ca4on Typically sta4c for the life4me of the device Devices have owners Secondary iden4ty creden4als are needed More complex lifecycle ownership changes Associate data with owner There may be mul4ple owners

12 Is this achievable? We need strong, verifiable trust from fabrication to service Secure elements and PK for authenticity and attestation Provisioning services for the consumer Managed transfer of ownership Cloud services for secure repositories Secure audit blockchain? Strong authentication

13 Is it acceptable? Transparent to the end-user Secure by default Mobile apps and cloud services to manage devices Personal realms of trust Simple transfer of ownership Anti-fraud and anti-theft messaging Must be recoverable Multiple means of strong authentication

14 Example - Wearables Provisioning Cer7ficate of Authen7city added at manufacture Band Factory Retailer Data read by authorized users Pair with phone Signed, Encrypted data sent to Cloud Customer Add customer signing/authen7ca7on cert Add trusted reader encryp7on certs Data Storage Service Iden7ty Service

15 Conclusions We are increasingly reliant on insecure connected devices An ecosystem is as strong as its weakest link Chains of trust for provenance and ownership Identities of things Strong authentication probably PK Convenient management of devices, data and permissions Personal trust realms

16 Further information Chris Edwards