Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

12:00 PM
Don Bailey
Don Bailey
Connect Directly
E-Mail vvv

All In For The Coming World of 'Things'

At a Black Hat round table, experts discuss the strategies necessary to lock down the Internet of Things, the most game-changing concept in Internet history.

The thing that always gets me the most about Las Vegas is how easily you can get lost at the tables. The craps table, the blackjack table, the poker table. There are endless tables with blinking lights and 8bit soundscapes that soak up your time and energy, leaving you feeling dried up, spat out, and generally wallowing in malaise. But, one table I'm proud to stay stood out from the crowd: the Black Hat Embedded Security Round Table I ran with my good friend Zach Lanier.

Like any table in Las Vegas, we were met with a lot of different personalities, perspectives, and motivations. None of us sat down at our round table as perfect people, but I feel that we all came away thinking more deeply about the strategies that will help define security for the coming world of Things.

Zach and I had the pleasure of running Black Hat's first ever round table, not just the first embedded security round table, and so we weren't quite sure what to expect. We didn't quite travel down all the paths I intended to tread, and we certainly didn't poke at all the bears I intended to prod, but some imperative points were made.

  • More threat modeling is required in the embedded/IoT space
  • Threat models must not only reflect the current business model, but projected models
  • Security integration into the Systems Development Life Cycle must be enforced
  • A security framework is needed to properly evaluate verticals in embedded/IoT verticals
  • Regulation must be enforced by authoritative bodies and guided by engineers/security analysts

While I could go on and on about these points for days (and I will if you buy me drinks and/or sushi) I'll briefly comment on each of these points from the perspective of the Round Table.

Threat modeling
While this is not a new concept, many of us in information security and engineering have either evaluated or deployed Embedded/IoT projects with little or no threat model. A recurring theme at our round table was the necessity of threat modeling. While the term itself was not often used, the concepts behind threat modeling were.

Embedded systems threat modeling is about understanding not only the technology, but the business model around the technology, and the environment in which the device will be deployed. These three key attributes of a deployed product create wild variances in the cost and components required to deliver the security assurances that match not only the company's security goals, but its fiscal goals. If a threat model cannot accurately translate the threat of financial loss into security controls that mitigate or remediate classes of vulnerability that can lead to financial loss, then the security team has not done its job. If the security team does not have the information required to identify which risks are a priority to the business, the management team has not done its job.

Threat modeling is a team effort, and can take a considerable amount of coordination and effort to bootstrap. Regardless, the result of this effort can and should be a process that enables the expedited development of a threat model for each new product or service a company develops.

Projecting changes
Businesses are not static, that's just a fact of life. We like to believe that Apple suddenly appeared from the ether slinging thin black smart phones at our faces, but it didn't. It took it decades to get to that place. Groupon is a better example. It first deployed as a simple community organization service, but pivoted into selling coupons when it realized it was a better sales model. Services that are deployed or in development during a pivot must be reevaluated for new risks. If any of the three key components of a threat model (the technology, the business model, or the deployment environment) change, risks must be reevaluated to ensure existing controls accommodate for the changes.

One way to do this is to brainstorm with the management and business development teams on potential use cases of a particular technology -- not even from a "widget" standpoint but a business standpoint. In other words, engineers tend to think of a WiFi module as a component that connects wireless local area networks. A bizdev strategist may think of this same module as a channel for relaying marketing data. If a deployed device that traffics marketing data is compromised, the bizdev strategist may not see much value in securing the communications channel. But, if the bizdev strategist considers the possibility of critical back-end databases being compromised, critical databases that monitor, evaluate, and prioritize marketing data, the priority for security will surely change.

Classifying the security requirements of these changes is enormously valuable. While we certainly can't predict every possible use case, we can build scaling models based on the potential value attributed to a component or communications channel. For example, what if we reconsider the WiFi module? Instead of thinking of the data that does move through it, let's think about what data could move through it. Can we classify the data as having a low, medium, or high security priority? What changes should occur in the product design to accommodate for each security classification? If this is 

Don A. Bailey is a pioneer in security for mobile technology, the Internet of Things, and embedded systems. He has a long history of ground-breaking research, protecting mobile users from worldwide tracking systems, securing automobiles from remote attack, and mitigating ... View Full Bio
1 of 2
Comment  | 
Print  | 
More Insights
Newest First  |  Oldest First  |  Threaded View
User Rank: Strategist
8/29/2014 | 9:42:06 AM
Re: Great post
I think that one of the biggest challenges that Don brings to light here is the concept of threat modeling in the IoT space. It will be a long time before we can measure risk here, because the threats are almost unknown and the impact hasn't truly been measured. The risks and threats will be different depending on which "thing" we're talking about. I don't see how we can approach IoT security as we do with, say, mobile devices, where the hardware and software are very comparable.
Marilyn Cohodas
Marilyn Cohodas,
User Rank: Strategist
8/27/2014 | 6:56:57 AM
Re: Great post
Agree, @Bprince, that it's encouraging that the security community is thinking about the real-world challenges with the IoT. But I just hope that the larger community of consumers and manufacturers are paying attention!
User Rank: Ninja
8/26/2014 | 10:58:03 PM
Great post
This was a great post. There are a lot of good security conversations going on around IoT that make me hopefully that as things move forward there will be more security built into a lot of these devices.

User Rank: Apprentice
8/26/2014 | 2:39:31 PM
Great Read
This was a very honest (and entertaining) look at the current state of IoT and security. I applaud your efforts to turn this challenge into an opportunity. Whoever manages to provide a solution with broad applications as you are suggesting will have a lot of business on their hands in the  not so distant future.
User Rank: Ninja
8/26/2014 | 8:21:15 AM
Providing Value
A major item to take away from this for Information Security is providing organizational value. A huge advocate for security is not only showing how safeguards keep the organization's data safe, but how that saved data translates into dollars. 

I have stressed this in previous posts, but there is a myriad of ways to show Information Security providing extensive value.
Marilyn Cohodas
Marilyn Cohodas,
User Rank: Strategist
8/26/2014 | 7:46:45 AM
"Regulation is an imperative"
Great blog, Don. You really lay out the roadmap necessary to start securing the IoT -- and the time is now (especially for manufacturing industries like automobile which have five year design cycles) to get started. The big is (IMHO) is getting a momentum going within the technoloogy community that pushes industry (and government) to develop enforce approprate safety regulations. I applaud your efforts at Lab Mouse (http://www.securitymouse.com/#mouse) and encourage the Dark Reading community to contribute to the security frameworks you are developing. 
Cybersecurity Team Holiday Guide: 2019 Gag Gift Edition
Ericka Chickowski, Contributing Writer,  12/2/2019
Register for Dark Reading Newsletters
White Papers
Cartoon Contest
Current Issue
Navigating the Deluge of Security Data
In this Tech Digest, Dark Reading shares the experiences of some top security practitioners as they navigate volumes of security data. We examine some examples of how enterprises can cull this data to find the clues they need.
Flash Poll
Rethinking Enterprise Data Defense
Rethinking Enterprise Data Defense
Frustrated with recurring intrusions and breaches, cybersecurity professionals are questioning some of the industrys conventional wisdom. Heres a look at what theyre thinking about.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
PUBLISHED: 2019-12-09
radare2 through 4.0.0 lacks validation of the content variable in the function r_asm_pseudo_incbin at libr/asm/asm.c, ultimately leading to an arbitrary write. This allows remote attackers to cause a denial of service (application crash) or possibly have unspecified other impact via crafted input.
PUBLISHED: 2019-12-09
In the macho_parse_file functionality in macho/macho.c of YARA 3.11.0, command_size may be inconsistent with the real size. A specially crafted MachO file can cause an out-of-bounds memory access, resulting in Denial of Service (application crash) or potential code execution.
PUBLISHED: 2019-12-08
On SuperMicro X8STi-F motherboards with IPMI firmware 2.06 and BIOS 02.68, the Virtual Media feature allows OS Command Injection by authenticated attackers who can send HTTP requests to the IPMI IP address. This requires a POST to /rpc/setvmdrive.asp with shell metacharacters in ShareHost or ShareNa...
PUBLISHED: 2019-12-08
An issue was discovered in libsixel 1.8.2. There is an integer overflow in the function sixel_decode_raw_impl at fromsixel.c.
PUBLISHED: 2019-12-08
An issue was discovered in libsixel 1.8.2. There is a heap-based buffer overflow in the function load_pnm at frompnm.c, due to an integer overflow.