Presented at Indonesia Honeynet Project (IHP) meetup. This presentation covering: 1. Overview of Industry 4.0 2. IoT Security Model 3. How to Secure IoT 4. Research in IoT Other emerging technology risk area that will be covered in my professional services: 1. Cloud 2. Mobile 3. Artificial Intelligence / Intelligent Automation 4. Data & Analytics

1. Emerging Technology
Risk
Internet of Things (IoT)
Eryk Budi Pratama
05 April 2019
Indonesia Honeynet Project (IHP) Sharing Session

2. Overview

3. Industry 4.0 Evolution
Source: http://resources.aima.in/presentations/AIMA-KPMG-industry-4-0-report.pdf

4. Industry 4.0 Evolution
Source: http://resources.aima.in/presentations/AIMA-KPMG-industry-4-0-report.pdf
The application of Cyber Physical System (CPS) in manufacturing leads to “connected factories”

5. Industry 4.0 Evolution
Industry 4.0 key technology levers
Internet of
Things (IoT)
Cloud
Computing
Big Data
Analytics
Robotics Cyber Security M2M
Augmented
Reality
Additive
Manufacturing
Blockchain

6. Industry 4.0 Framework
Source: https://assets.kpmg/content/dam/kpmg/xx/pdf/2017/05/beyond-the-hype.pdf

7. I4.0 – Smart Cities
Source: https://www.weforum.org/agenda/2019/01/the-anatomy-of-a-smart-city/
Smart Monitor:
 Transportation
 Utilities
 Infrastructure
 Environment
 Building
 Life
Example:
 Electric transport
 Traffic monitoring
& control
 Water monitoring
 WIFI
 Waste
management
 Building
management
 Perimeter access
control

8. I4.0– Smart Manufacturing
Source: https://iot-analytics.com/industrial-internet-disrupt-smart-factory/

9. Investment in Emerging Techology
Source: https://advisory.kpmg.us/content/dam/advisory/en/pdfs/2018/disruption-is-the-new-norm-emerging-teck-risk.pdf
Mobile
Application
Internet of
Things
Cloud

10. Internet of Things (IoT)

11. IoT Market
Source: IoT Analytics, 2018

12. IoT Adoption Challenge
Source: https://assets.kpmg/content/dam/kpmg/xx/pdf/2017/04/risk-or-reward-what-lurks-within-your-IoT.pdf

13. Case Studies
Source: https://assets.kpmg/content/dam/kpmg/xx/pdf/2017/04/risk-or-reward-what-lurks-within-your-IoT.pdf

14. IoT Privacy by Design
Source: https://www.gsma.com/iot/iot-security-assessment/

15. IoT Security Model
Source: https://www.gsma.com/iot/iot-security-assessment/

16. Sample – Connected Car Attack Surface
Source: https://www.gsma.com/iot/iot-security-assessment/

17. Sample – Smart Factory Attack Surface
Source: https://www.gsma.com/iot/iot-security-assessment/
Attack Factor
 Malware
 Ransomware
 Spear Phishing
 Multiple vulnerab
ilities
 Device/Hardwar
e hacking

18. Securing IoT

19. OWASP IoT Security
Source: https://www.owasp.org/index.php/OWASP_Internet_of_Things_Project
OWASP Top 10 IoT 2018
1. Weak, Guessable, or
Harcoded password
2. Insecure Network Service
3. Insecure Ecosystem Interfaces
4. Lack of Secure Update Mecha
nism
5. Use of Insecure or Outdated
Components
6. Insufficient Privacy Protection
7. Insecure Data Transfer and
Storage
8. Lack of Device Management
9. Insecure Default Settings
10. Lack of physical hardening

20. IoT Security Foundation
https://www.iotsecurityfoundation.org/best-practice-guidelines/
Secure Design Components:
1. Classification of Data
2. Physical Security
3. Device Secure Boot
4. Secure Operating System
5. Application Security
6. Credential Management
7. Encryption
8. Network Connection
9. Securing Software Updates
10.Logging
11.Software Update Policy
IoT Security Foundation Publication:
1. IoT Security Compliance Framework
2. IoT Security Compliance
Questionnaire
3. Secure Design Best Practice Guides
4. HOME IoT Security Architecture and
Policy
5. ENTERPRISE IoT Security
Architecture and Policy
6. IoT Cybersecurity: Regulation Ready

21. GSMA IoT Security
https://www.gsma.com/iot/iot-security/iot-security-guidelines/
IoT Security Assessment
1. IoT Service Information
2. IoT Security and Privacy
Organisational Level
3. Checklist For Service Platforms
4. Checklist For Endpoint Devices

22. “IoT without security =
Internet of Threats”
― Stephane Nappo

23. Research in IoT

24. Sample of Research Topics
 Device management
 Sensor data acquisition in management
 Industrial applications based on IoT
 Integration of data from multiple sources
 Device diversity and interoperability
 Flexibility and evolution of applications
 Scale, data volume, and performance
 Scalability in networking, storage and computation to handle exponential
growth of data volume from sensors
 Security of the data-at-flight and data-at-rest without compromising on
scalability
 Preservation of privacy of the user data and properly balancing between
privacy and utility
 Interoperability among sensor data sources (physical communication level,
network level, data syntax level, and data semantics level)
 Rich analytics and visualization (generic, sensor-specific, and domain -
specific) provided in real-time, as required etc.

25. Sample of Tools
 Arduino
Works as both hardware specification for interactive electronics and
software that includes an IDE and the Arduino programming language.
 Eclipse IoT Project
Supports application frameworks and services, open source implementation
s of IoT protocols, including MQTT CoAP, OMA-DM and OMA LWM2M.
 Kinoma
Works as DIY construction kit for prototyping electronic device.
 Node-RED
Visual tool for wiring Internet of Things.
 IoTSyS
Work as IoT middleware which provides communication stack for smart
devices.
 OpenIoT
Open source middleware used to get information from sensor clouds

26. Thank You
proferyk@gmail.com