Vulnerabilities / Threats
12:00 PM
Don Bailey
Don Bailey
Connect Directly
E-Mail vvv

All In For The Coming World of 'Things'

At a Black Hat round table, experts discuss the strategies necessary to lock down the Internet of Things, the most game-changing concept in Internet history.

The thing that always gets me the most about Las Vegas is how easily you can get lost at the tables. The craps table, the blackjack table, the poker table. There are endless tables with blinking lights and 8bit soundscapes that soak up your time and energy, leaving you feeling dried up, spat out, and generally wallowing in malaise. But, one table I'm proud to stay stood out from the crowd: the Black Hat Embedded Security Round Table I ran with my good friend Zach Lanier.

Like any table in Las Vegas, we were met with a lot of different personalities, perspectives, and motivations. None of us sat down at our round table as perfect people, but I feel that we all came away thinking more deeply about the strategies that will help define security for the coming world of Things.

Zach and I had the pleasure of running Black Hat's first ever round table, not just the first embedded security round table, and so we weren't quite sure what to expect. We didn't quite travel down all the paths I intended to tread, and we certainly didn't poke at all the bears I intended to prod, but some imperative points were made.

  • More threat modeling is required in the embedded/IoT space
  • Threat models must not only reflect the current business model, but projected models
  • Security integration into the Systems Development Life Cycle must be enforced
  • A security framework is needed to properly evaluate verticals in embedded/IoT verticals
  • Regulation must be enforced by authoritative bodies and guided by engineers/security analysts

While I could go on and on about these points for days (and I will if you buy me drinks and/or sushi) I'll briefly comment on each of these points from the perspective of the Round Table.

Threat modeling
While this is not a new concept, many of us in information security and engineering have either evaluated or deployed Embedded/IoT projects with little or no threat model. A recurring theme at our round table was the necessity of threat modeling. While the term itself was not often used, the concepts behind threat modeling were.

Embedded systems threat modeling is about understanding not only the technology, but the business model around the technology, and the environment in which the device will be deployed. These three key attributes of a deployed product create wild variances in the cost and components required to deliver the security assurances that match not only the company's security goals, but its fiscal goals. If a threat model cannot accurately translate the threat of financial loss into security controls that mitigate or remediate classes of vulnerability that can lead to financial loss, then the security team has not done its job. If the security team does not have the information required to identify which risks are a priority to the business, the management team has not done its job.

Threat modeling is a team effort, and can take a considerable amount of coordination and effort to bootstrap. Regardless, the result of this effort can and should be a process that enables the expedited development of a threat model for each new product or service a company develops.

Projecting changes
Businesses are not static, that's just a fact of life. We like to believe that Apple suddenly appeared from the ether slinging thin black smart phones at our faces, but it didn't. It took it decades to get to that place. Groupon is a better example. It first deployed as a simple community organization service, but pivoted into selling coupons when it realized it was a better sales model. Services that are deployed or in development during a pivot must be reevaluated for new risks. If any of the three key components of a threat model (the technology, the business model, or the deployment environment) change, risks must be reevaluated to ensure existing controls accommodate for the changes.

One way to do this is to brainstorm with the management and business development teams on potential use cases of a particular technology -- not even from a "widget" standpoint but a business standpoint. In other words, engineers tend to think of a WiFi module as a component that connects wireless local area networks. A bizdev strategist may think of this same module as a channel for relaying marketing data. If a deployed device that traffics marketing data is compromised, the bizdev strategist may not see much value in securing the communications channel. But, if the bizdev strategist considers the possibility of critical back-end databases being compromised, critical databases that monitor, evaluate, and prioritize marketing data, the priority for security will surely change.

Classifying the security requirements of these changes is enormously valuable. While we certainly can't predict every possible use case, we can build scaling models based on the potential value attributed to a component or communications channel. For example, what if we reconsider the WiFi module? Instead of thinking of the data that does move through it, let's think about what data could move through it. Can we classify the data as having a low, medium, or high security priority? What changes should occur in the product design to accommodate for each security classification? If this is 

Don A. Bailey is a pioneer in security for mobile technology, the Internet of Things, and embedded systems. He has a long history of ground-breaking research, protecting mobile users from worldwide tracking systems, securing automobiles from remote attack, and mitigating ... View Full Bio
1 of 2
Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
User Rank: Strategist
8/29/2014 | 9:42:06 AM
Re: Great post
I think that one of the biggest challenges that Don brings to light here is the concept of threat modeling in the IoT space. It will be a long time before we can measure risk here, because the threats are almost unknown and the impact hasn't truly been measured. The risks and threats will be different depending on which "thing" we're talking about. I don't see how we can approach IoT security as we do with, say, mobile devices, where the hardware and software are very comparable.
Marilyn Cohodas
Marilyn Cohodas,
User Rank: Strategist
8/27/2014 | 6:56:57 AM
Re: Great post
Agree, @Bprince, that it's encouraging that the security community is thinking about the real-world challenges with the IoT. But I just hope that the larger community of consumers and manufacturers are paying attention!
User Rank: Ninja
8/26/2014 | 10:58:03 PM
Great post
This was a great post. There are a lot of good security conversations going on around IoT that make me hopefully that as things move forward there will be more security built into a lot of these devices.

User Rank: Apprentice
8/26/2014 | 2:39:31 PM
Great Read
This was a very honest (and entertaining) look at the current state of IoT and security. I applaud your efforts to turn this challenge into an opportunity. Whoever manages to provide a solution with broad applications as you are suggesting will have a lot of business on their hands in the  not so distant future.
User Rank: Ninja
8/26/2014 | 8:21:15 AM
Providing Value
A major item to take away from this for Information Security is providing organizational value. A huge advocate for security is not only showing how safeguards keep the organization's data safe, but how that saved data translates into dollars. 

I have stressed this in previous posts, but there is a myriad of ways to show Information Security providing extensive value.
Marilyn Cohodas
Marilyn Cohodas,
User Rank: Strategist
8/26/2014 | 7:46:45 AM
"Regulation is an imperative"
Great blog, Don. You really lay out the roadmap necessary to start securing the IoT -- and the time is now (especially for manufacturing industries like automobile which have five year design cycles) to get started. The big is (IMHO) is getting a momentum going within the technoloogy community that pushes industry (and government) to develop enforce approprate safety regulations. I applaud your efforts at Lab Mouse ( and encourage the Dark Reading community to contribute to the security frameworks you are developing. 
Register for Dark Reading Newsletters
White Papers
Current Issue
Security Operations and IT Operations: Finding the Path to Collaboration
A wide gulf has emerged between SOC and NOC teams that's keeping both of them from assuring the confidentiality, integrity, and availability of IT systems. Here's how experts think it should be bridged.
Flash Poll
New Best Practices for Secure App Development
New Best Practices for Secure App Development
The transition from DevOps to SecDevOps is combining with the move toward cloud computing to create new challenges - and new opportunities - for the information security team. Download this report, to learn about the new best practices for secure application development.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio
Archived Dark Reading Radio
In past years, security researchers have discovered ways to hack cars, medical devices, automated teller machines, and many other targets. Dark Reading Executive Editor Kelly Jackson Higgins hosts researcher Samy Kamkar and Levi Gundert, vice president of threat intelligence at Recorded Future, to discuss some of 2016's most unusual and creative hacks by white hats, and what these new vulnerabilities might mean for the coming year.