Vulnerabilities / Threats
8/25/2014
12:00 PM
Don Bailey
Don Bailey
Commentary
Connect Directly
Twitter
RSS
E-Mail
100%
0%

All In For The Coming World of 'Things'

At a Black Hat round table, experts discuss the strategies necessary to lock down the Internet of Things, the most game-changing concept in Internet history.

The thing that always gets me the most about Las Vegas is how easily you can get lost at the tables. The craps table, the blackjack table, the poker table. There are endless tables with blinking lights and 8bit soundscapes that soak up your time and energy, leaving you feeling dried up, spat out, and generally wallowing in malaise. But, one table I'm proud to stay stood out from the crowd: the Black Hat Embedded Security Round Table I ran with my good friend Zach Lanier.

Like any table in Las Vegas, we were met with a lot of different personalities, perspectives, and motivations. None of us sat down at our round table as perfect people, but I feel that we all came away thinking more deeply about the strategies that will help define security for the coming world of Things.

Zach and I had the pleasure of running Black Hat's first ever round table, not just the first embedded security round table, and so we weren't quite sure what to expect. We didn't quite travel down all the paths I intended to tread, and we certainly didn't poke at all the bears I intended to prod, but some imperative points were made.

  • More threat modeling is required in the embedded/IoT space
  • Threat models must not only reflect the current business model, but projected models
  • Security integration into the Systems Development Life Cycle must be enforced
  • A security framework is needed to properly evaluate verticals in embedded/IoT verticals
  • Regulation must be enforced by authoritative bodies and guided by engineers/security analysts

While I could go on and on about these points for days (and I will if you buy me drinks and/or sushi) I'll briefly comment on each of these points from the perspective of the Round Table.

Threat modeling
While this is not a new concept, many of us in information security and engineering have either evaluated or deployed Embedded/IoT projects with little or no threat model. A recurring theme at our round table was the necessity of threat modeling. While the term itself was not often used, the concepts behind threat modeling were.

Embedded systems threat modeling is about understanding not only the technology, but the business model around the technology, and the environment in which the device will be deployed. These three key attributes of a deployed product create wild variances in the cost and components required to deliver the security assurances that match not only the company's security goals, but its fiscal goals. If a threat model cannot accurately translate the threat of financial loss into security controls that mitigate or remediate classes of vulnerability that can lead to financial loss, then the security team has not done its job. If the security team does not have the information required to identify which risks are a priority to the business, the management team has not done its job.

Threat modeling is a team effort, and can take a considerable amount of coordination and effort to bootstrap. Regardless, the result of this effort can and should be a process that enables the expedited development of a threat model for each new product or service a company develops.

Projecting changes
Businesses are not static, that's just a fact of life. We like to believe that Apple suddenly appeared from the ether slinging thin black smart phones at our faces, but it didn't. It took it decades to get to that place. Groupon is a better example. It first deployed as a simple community organization service, but pivoted into selling coupons when it realized it was a better sales model. Services that are deployed or in development during a pivot must be reevaluated for new risks. If any of the three key components of a threat model (the technology, the business model, or the deployment environment) change, risks must be reevaluated to ensure existing controls accommodate for the changes.

One way to do this is to brainstorm with the management and business development teams on potential use cases of a particular technology -- not even from a "widget" standpoint but a business standpoint. In other words, engineers tend to think of a WiFi module as a component that connects wireless local area networks. A bizdev strategist may think of this same module as a channel for relaying marketing data. If a deployed device that traffics marketing data is compromised, the bizdev strategist may not see much value in securing the communications channel. But, if the bizdev strategist considers the possibility of critical back-end databases being compromised, critical databases that monitor, evaluate, and prioritize marketing data, the priority for security will surely change.

Classifying the security requirements of these changes is enormously valuable. While we certainly can't predict every possible use case, we can build scaling models based on the potential value attributed to a component or communications channel. For example, what if we reconsider the WiFi module? Instead of thinking of the data that does move through it, let's think about what data could move through it. Can we classify the data as having a low, medium, or high security priority? What changes should occur in the product design to accommodate for each security classification? If this is 

Don A. Bailey is a pioneer in security for mobile technology, the Internet of Things, and embedded systems. He has a long history of ground-breaking research, protecting mobile users from worldwide tracking systems, securing automobiles from remote attack, and mitigating ... View Full Bio
Previous
1 of 2
Next
Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
DarkReadingTim
50%
50%
DarkReadingTim,
User Rank: Strategist
8/29/2014 | 9:42:06 AM
Re: Great post
I think that one of the biggest challenges that Don brings to light here is the concept of threat modeling in the IoT space. It will be a long time before we can measure risk here, because the threats are almost unknown and the impact hasn't truly been measured. The risks and threats will be different depending on which "thing" we're talking about. I don't see how we can approach IoT security as we do with, say, mobile devices, where the hardware and software are very comparable.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
8/27/2014 | 6:56:57 AM
Re: Great post
Agree, @Bprince, that it's encouraging that the security community is thinking about the real-world challenges with the IoT. But I just hope that the larger community of consumers and manufacturers are paying attention!
Bprince
100%
0%
Bprince,
User Rank: Ninja
8/26/2014 | 10:58:03 PM
Great post
This was a great post. There are a lot of good security conversations going on around IoT that make me hopefully that as things move forward there will be more security built into a lot of these devices.

BP
RickDelgado
50%
50%
RickDelgado,
User Rank: Apprentice
8/26/2014 | 2:39:31 PM
Great Read
This was a very honest (and entertaining) look at the current state of IoT and security. I applaud your efforts to turn this challenge into an opportunity. Whoever manages to provide a solution with broad applications as you are suggesting will have a lot of business on their hands in the  not so distant future.
RyanSepe
50%
50%
RyanSepe,
User Rank: Ninja
8/26/2014 | 8:21:15 AM
Providing Value
A major item to take away from this for Information Security is providing organizational value. A huge advocate for security is not only showing how safeguards keep the organization's data safe, but how that saved data translates into dollars. 

I have stressed this in previous posts, but there is a myriad of ways to show Information Security providing extensive value.
Marilyn Cohodas
50%
50%
Marilyn Cohodas,
User Rank: Strategist
8/26/2014 | 7:46:45 AM
"Regulation is an imperative"
Great blog, Don. You really lay out the roadmap necessary to start securing the IoT -- and the time is now (especially for manufacturing industries like automobile which have five year design cycles) to get started. The big is (IMHO) is getting a momentum going within the technoloogy community that pushes industry (and government) to develop enforce approprate safety regulations. I applaud your efforts at Lab Mouse (http://www.securitymouse.com/#mouse) and encourage the Dark Reading community to contribute to the security frameworks you are developing. 
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Dark Reading, January 2015
To find and fix exploits aimed directly at your business, stop waiting for alerts and become a proactive hunter.
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-3580
Published: 2014-12-18
The mod_dav_svn Apache HTTPD server module in Apache Subversion 1.x before 1.7.19 and 1.8.x before 1.8.11 allows remote attackers to cause a denial of service (NULL pointer dereference and server crash) via a REPORT request for a resource that does not exist.

CVE-2014-6076
Published: 2014-12-18
IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 allow remote attackers to conduct clickjacking attacks via a crafted web site.

CVE-2014-6077
Published: 2014-12-18
Cross-site request forgery (CSRF) vulnerability in IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 allows remote attackers to hijack the authentication of arbitrary users for requests that insert XSS sequences.

CVE-2014-6078
Published: 2014-12-18
IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 do not have a lockout period after invalid login attempts, which makes it easier for remote attackers to obtain admin access via a brute-force attack.

CVE-2014-6080
Published: 2014-12-18
SQL injection vulnerability in IBM Security Access Manager for Mobile 8.x before 8.0.1 and Security Access Manager for Web 7.x before 7.0.0 FP10 and 8.x before 8.0.1 allows remote authenticated users to execute arbitrary SQL commands via unspecified vectors.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
Join us Wednesday, Dec. 17 at 1 p.m. Eastern Time to hear what employers are really looking for in a chief information security officer -- it may not be what you think.