"The State of IoT Security" Keynote by Shawn Henry at Inform[ED] IoT Security

2017 CROWDSTRIKE, INC. ALL RIGHTS RESERVED.
THE STATE OF IoT SECURITY
SHAWN HENRY, President of Services & CSO

1 Threats and Vulnerabilities
2
Impact of unsecure devices: industrial and
critical infrastructures,
3 …in smart cities,
4 …in the home
5 The Future of IoT Security
6 Questions

THREATS AND VULNERABILITIES

THE INTERNET OF THINGS: BY THE NUMBERS
Gartner & IDC estimate the amount and cost of IoT devices at:
YEAR 2016:
6.4 billion devices
totaling over
$235 billion
YEAR 2020:
20 billion devices
totaling over
$1.7 trillion

HOW MUCH WILL BE SPENT ON IoT SECURITY?
Worldwide IoT Security Spending Forecast (Millions of Dollars)
2014 2015 2016 2017 2018
$231.86 $281.54 $348.32 $433.95 $547.20
Reference: Forecast: IoT Security, Worldwide, Gartner, April 2016

THE INTERNET OF VULNERABILITIES
 IoT Village at DEF CON 2016:
 47 new vulnerabilities affecting
 23 devices from
 21 manufacturers

THE INTERNET OF VULNERABILITIES
• Late 2016 brought the rise of Mirai, the botnet “that broke the
Internet”
• Exploits vulnerabilities on unsecure IoT devices
• CCTV cameras, routers, DVRs, smart TVs, etc.
• Continuously scans for connected IoT devices configured with
factory default settings

INTERNET OF THINGS
ADVERSARY PRIORITIES
 Vehicle Systems
 ICS/SCADA
 Network Devices
 EFI Firmware
 Embedded Applications
 Linux/Unix
 BSD
 VxWorks
 QNX

INDUSTRIAL IoT AND SMART CITIES

Reference: The Internet Of Things Heat Map, 2016 --Forrester
THE GROWTH OF IoT AT A GLANCE

INDUSTRIAL IoT
Bain: by 2020 annual revenues could exceed $470B
for IoT vendors
General Electric: investment in the Industrial Internet
of Things (IIoT) to exceed $60 trillion during the next
15 years
Reference: Forecast: IoT Security, Worldwide, Gartner, April 2016

INDUSTRIAL IoT
“Lufthansa is using an IoT-based strategy to create an
entirely new business mining data from their maintenance,
repair and overhaul operations and providing it to their
customers.” –Forbes

FIRST, THE GOOD NEWS…
“Enterprises lead small and medium size businesses in IoT
adoption and interest by more than 10 points”
“23% percent of global enterprise respondents use IoT, but
only about 14% of small and medium-size business
respondents do.”
- Forbes

SIEMENS STEP-7 ICS DEVICES ON SHODAN

INFRASTRUCTURE ATTACK:
ENERGY GRID
 Dec 2015: Ukrainian power stations hacked
 Commands disable UPS systems –225,000 customers go dark
 “From an attack perspective, it was just so awesome. I mean
really well done by them.”

INFRASTRUCTURE ATTACK:
DAM CONTROL SYSTEM
 2013: Iranian hackers infiltrated the control system of a dam via
Google hacking
 Officials identified the dam breach while investigating the same
hackers conducting attacks on the US financial infrastructure
 Fortunately, the dam was out of commission for repairs during
the attack so the flood gate was unaffected

SMART CITIES
 Google’s Sydney office hacked
via its building management
system
 Michigan researchers hacked
into wireless traffic lights
 ATMs robbed via Smartphones
in Taiwan

CCTV HACKING (UKRAINE)

VEHICLE TELEMATICS
Researcher hack publicly available Telematics Gateway Units.
 Cellular modem with public IP address
 Mandated for commercial trucking in 2017
 Trucks, ambulances, buses, industrial vehicles
 GPS location, speed, fuel efficiency, potential for vehicle
controls (ignition, brakes, etc.)

TRUCKING TELEMATICS (PORT 23)

TIMELINE OF VEHICLE HACKS
• 2015: Researchers hack a Jeep’s
digital system over the Internet
Chrysler recalls 1.4M vehicles
• 2016: USG issues PSA about the
“real rise” of car hacking
• 2017: Legislation calls for car
cybersecurity standards

VEHICLE INFOTAINMENT
Vehicles pre-equipped with:
• WiFi
• BlueTooth
• Microphones
• Cloud-based content sharing

PROTECTING THE CONSUMER

WIRED HOMES
 LG announced all home appliances will feature:
 Advanced Wi-Fi connectivity
 DeepThinkQ technology
 Each item to learn from its owner’s patterns
 Example: smart refrigerator featuring a camera and
voice-activated system powered by Amazon’s Alexa
Reference: BU News Service

Photo: iFixit.com

WEBCAMS
Reference: Selling Slaving, Digital Citizens Alliance

PUBLICLY AVAILABLE BACKUP DRIVES

WEARABLES
Worldwide shipments of
wearable devices belived to
have reached110 million in
2016 with 38.2% growth year
over year

MEDICAL DEVICES

THE FUTURE OF IoT

THE NEXT MIRAI
IoT devices continue to remain unsecure:
 Outdated code
 Poorly maintained operating systems
 “Install and Forget” model
 No patching
 Long lifespan of devices
 Default credentials
 Lack of security solutions
 “Minimal Viable Products”

THE NEXT MIRAI
• Mirai converted IOT devices into a botnet for DDoS
• Estimates range up to 400,000 devices controlled
• ~250,000,000 CCTV cameras are deployed around the
world
• Source code is
openly available
• What happens when botnets are converted from DDoS to access platforms?

WE’VE SEEN THE PROBLEMS….
NOW HOW DO WE SECURE OURSELVES IN THE
AGE OF IoT?

STEPS IN SECURING IoT
1) Major expansion of
supply chain, network
edge devices, and
cloud operations
2) Defense in depth and
limiting the attack
surface

3) Red teaming and
penetration testing
4) Device reverse
engineering and due
diligence

5) Vendor pressure to provide
adequate and standardized
logging
6) Security devices that can
interact with a multitude of
network protocols

7) Managed security
services
8) Government
Regulations and
Liabilities for Consumer
Devices

QUESTIONS?

"The State of IoT Security" Keynote by Shawn Henry at Inform[ED] IoT Security

Recomendados

Recomendados

Mais conteúdo relacionado

Mais procurados

Mais procurados (20)

Semelhante a "The State of IoT Security" Keynote by Shawn Henry at Inform[ED] IoT Security

Semelhante a "The State of IoT Security" Keynote by Shawn Henry at Inform[ED] IoT Security (20)

Último

Último (20)

"The State of IoT Security" Keynote by Shawn Henry at Inform[ED] IoT Security