Vulnerabilities / Threats

12:00 PM
Don Bailey
Don Bailey
Connect Directly
E-Mail vvv

All In For The Coming World of 'Things'

At a Black Hat round table, experts discuss the strategies necessary to lock down the Internet of Things, the most game-changing concept in Internet history.

The thing that always gets me the most about Las Vegas is how easily you can get lost at the tables. The craps table, the blackjack table, the poker table. There are endless tables with blinking lights and 8bit soundscapes that soak up your time and energy, leaving you feeling dried up, spat out, and generally wallowing in malaise. But, one table I'm proud to stay stood out from the crowd: the Black Hat Embedded Security Round Table I ran with my good friend Zach Lanier.

Like any table in Las Vegas, we were met with a lot of different personalities, perspectives, and motivations. None of us sat down at our round table as perfect people, but I feel that we all came away thinking more deeply about the strategies that will help define security for the coming world of Things.

Zach and I had the pleasure of running Black Hat's first ever round table, not just the first embedded security round table, and so we weren't quite sure what to expect. We didn't quite travel down all the paths I intended to tread, and we certainly didn't poke at all the bears I intended to prod, but some imperative points were made.

  • More threat modeling is required in the embedded/IoT space
  • Threat models must not only reflect the current business model, but projected models
  • Security integration into the Systems Development Life Cycle must be enforced
  • A security framework is needed to properly evaluate verticals in embedded/IoT verticals
  • Regulation must be enforced by authoritative bodies and guided by engineers/security analysts

While I could go on and on about these points for days (and I will if you buy me drinks and/or sushi) I'll briefly comment on each of these points from the perspective of the Round Table.

Threat modeling
While this is not a new concept, many of us in information security and engineering have either evaluated or deployed Embedded/IoT projects with little or no threat model. A recurring theme at our round table was the necessity of threat modeling. While the term itself was not often used, the concepts behind threat modeling were.

Embedded systems threat modeling is about understanding not only the technology, but the business model around the technology, and the environment in which the device will be deployed. These three key attributes of a deployed product create wild variances in the cost and components required to deliver the security assurances that match not only the company's security goals, but its fiscal goals. If a threat model cannot accurately translate the threat of financial loss into security controls that mitigate or remediate classes of vulnerability that can lead to financial loss, then the security team has not done its job. If the security team does not have the information required to identify which risks are a priority to the business, the management team has not done its job.

Threat modeling is a team effort, and can take a considerable amount of coordination and effort to bootstrap. Regardless, the result of this effort can and should be a process that enables the expedited development of a threat model for each new product or service a company develops.

Projecting changes
Businesses are not static, that's just a fact of life. We like to believe that Apple suddenly appeared from the ether slinging thin black smart phones at our faces, but it didn't. It took it decades to get to that place. Groupon is a better example. It first deployed as a simple community organization service, but pivoted into selling coupons when it realized it was a better sales model. Services that are deployed or in development during a pivot must be reevaluated for new risks. If any of the three key components of a threat model (the technology, the business model, or the deployment environment) change, risks must be reevaluated to ensure existing controls accommodate for the changes.

One way to do this is to brainstorm with the management and business development teams on potential use cases of a particular technology -- not even from a "widget" standpoint but a business standpoint. In other words, engineers tend to think of a WiFi module as a component that connects wireless local area networks. A bizdev strategist may think of this same module as a channel for relaying marketing data. If a deployed device that traffics marketing data is compromised, the bizdev strategist may not see much value in securing the communications channel. But, if the bizdev strategist considers the possibility of critical back-end databases being compromised, critical databases that monitor, evaluate, and prioritize marketing data, the priority for security will surely change.

Classifying the security requirements of these changes is enormously valuable. While we certainly can't predict every possible use case, we can build scaling models based on the potential value attributed to a component or communications channel. For example, what if we reconsider the WiFi module? Instead of thinking of the data that does move through it, let's think about what data could move through it. Can we classify the data as having a low, medium, or high security priority? What changes should occur in the product design to accommodate for each security classification? If this is 

Don A. Bailey is a pioneer in security for mobile technology, the Internet of Things, and embedded systems. He has a long history of ground-breaking research, protecting mobile users from worldwide tracking systems, securing automobiles from remote attack, and mitigating ... View Full Bio
1 of 2
Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
User Rank: Strategist
8/29/2014 | 9:42:06 AM
Re: Great post
I think that one of the biggest challenges that Don brings to light here is the concept of threat modeling in the IoT space. It will be a long time before we can measure risk here, because the threats are almost unknown and the impact hasn't truly been measured. The risks and threats will be different depending on which "thing" we're talking about. I don't see how we can approach IoT security as we do with, say, mobile devices, where the hardware and software are very comparable.
Marilyn Cohodas
Marilyn Cohodas,
User Rank: Strategist
8/27/2014 | 6:56:57 AM
Re: Great post
Agree, @Bprince, that it's encouraging that the security community is thinking about the real-world challenges with the IoT. But I just hope that the larger community of consumers and manufacturers are paying attention!
User Rank: Ninja
8/26/2014 | 10:58:03 PM
Great post
This was a great post. There are a lot of good security conversations going on around IoT that make me hopefully that as things move forward there will be more security built into a lot of these devices.

User Rank: Apprentice
8/26/2014 | 2:39:31 PM
Great Read
This was a very honest (and entertaining) look at the current state of IoT and security. I applaud your efforts to turn this challenge into an opportunity. Whoever manages to provide a solution with broad applications as you are suggesting will have a lot of business on their hands in the  not so distant future.
User Rank: Ninja
8/26/2014 | 8:21:15 AM
Providing Value
A major item to take away from this for Information Security is providing organizational value. A huge advocate for security is not only showing how safeguards keep the organization's data safe, but how that saved data translates into dollars. 

I have stressed this in previous posts, but there is a myriad of ways to show Information Security providing extensive value.
Marilyn Cohodas
Marilyn Cohodas,
User Rank: Strategist
8/26/2014 | 7:46:45 AM
"Regulation is an imperative"
Great blog, Don. You really lay out the roadmap necessary to start securing the IoT -- and the time is now (especially for manufacturing industries like automobile which have five year design cycles) to get started. The big is (IMHO) is getting a momentum going within the technoloogy community that pushes industry (and government) to develop enforce approprate safety regulations. I applaud your efforts at Lab Mouse ( and encourage the Dark Reading community to contribute to the security frameworks you are developing. 
8 Ways Hackers Monetize Stolen Data
Steve Zurier, Freelance Writer,  4/17/2018
Securing Social Media: National Safety, Privacy Concerns
Kelly Sheridan, Staff Editor, Dark Reading,  4/19/2018
Firms More Likely to Tempt Security Pros With Big Salaries than Invest in Training
Sara Peters, Senior Editor at Dark Reading,  4/19/2018
Register for Dark Reading Newsletters
White Papers
Current Issue
How to Cope with the IT Security Skills Shortage
Most enterprises don't have all the in-house skills they need to meet the rising threat from online attackers. Here are some tips on ways to beat the shortage.
Flash Poll
[Strategic Security Report] Navigating the Threat Intelligence Maze
[Strategic Security Report] Navigating the Threat Intelligence Maze
Most enterprises are using threat intel services, but many are still figuring out how to use the data they're collecting. In this Dark Reading survey we give you a look at what they're doing today - and where they hope to go.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2017-05-09
NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

Published: 2017-05-08
unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

Published: 2017-05-08
A privilege escalation vulnerability in Brocade Fibre Channel SAN products running Brocade Fabric OS (FOS) releases earlier than v7.4.1d and v8.0.1b could allow an authenticated attacker to elevate the privileges of user accounts accessing the system via command line interface. With affected version...

Published: 2017-05-08
Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

Published: 2017-05-08
Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.