Here's the problem statement: With IoT, the Internet of Things, everything becomes a computer.
Basically, a light bulb is a computer that lights up your home. A thermostat is a computer that
controls the temperature. A car is a computer that takes you places. A security camera is a computer
that records activities. Everything becomes a computer. Great! Where's the problem? Well,
we know from security that every computer can, in fact, be hacked.
So if everything becomes a computer with IoT and every computer can be hacked, what does that mean?
It means this: Everything can be hacked. That's the world we're moving to. So let's take a look
at an example of what I mean by this. Take the Linux operating system. Last time I checked,
it's got about 27, 28 million lines of code that make up the operating system. Windows,
even more about 50 million. How about the fact that we have cars today with software in them that
have over 100 million lines of code in them? Now, what does all of that mean? Think of this as your
attack surface and what happens with those things? Well, in fact, as the number of lines of code goes
up, then so does complexity and so do the number of bugs that are in the software. Just because
there's more software. And if at the same rate, you're going to end up with more bugs, ultimately
that means we have more vulnerabilities. And so all of these things increase.
Complexity is the enemy of security. So that means the more complex the system gets, the more
insecure it gets as well. So what can we do about this attack surface? Think of the attack surface
a little bit differently. If we've got a bull's eye over here. If you've got a huge bull's eye,
then it's going to be easier for the bad guy to hit it when he's trying to attack you. However,
if we can shrink that bull's eye down to a minuscule dot, then it's going to be much
harder for the bad guy to do what he wants to do. And you can see it's going to be hard to shrink
some of these attack surfaces, but we are going to look at some things that you can do. For instance,
what are the risks? Why do you even care about this? Well, there's the issue of privacy. If
someone breaks into these devices, maybe they are recording you and seeing you or tracking
your activities. There's the issue of safety. Some of these may even be implantable medical
devices. Imagine a defibrillator or an implantable insulin pump one day. Those things could then be
hacked and all kinds of havoc could occur from that. Or a denial of service attack. A denial
of service could be where someone is attacked your device and now your device won't respond
to you. That's one example here. Another example is where your device, because it's a computer,
remember, is being used to attack other people's devices. And now you are unwittingly part of the
denial of service on other people. Well, what can you do to shrink this attack surface and lessen
these kinds of risks happening to you? We're going to take a look at five things you can do in your
home and five things you can do in your office and organization to reduce the risk of IoT security.
Okay, now what can we do in order to avoid those risks? Well, I'm going to give you a five things,
first of all, for your home IoT devices. We're going to take a look first at credentials--creds.
Basically, you've got credentials that are a user ID, password. Those are the typical ones. And
you've got those for your IoT devices as well as for your home network. And the IoT devices exist
on that network. So you want to secure both of those. The IoT device, for instance, in this case
is a camera, but there's probably an administrator interface that goes into this so that this person
can log in. That person probably being you, if you're the local IoT support guy in your home,
so that you can log in and change configurations and things like that. Change that stuff. Don't go
with the default. Don't go with the default user ID. If you can change it and definitely don't go
with the default password, definitely change that. And the same thing is true when it comes to your
home router and the network there. So there will be also an administrator interface here. Change
the default user ID and password to the extent that you're able to. And also the Wi-Fi network
itself. Most of these things of IoT are working over a Wi-Fi network. We want to change from the
default SSID that the network broadcasts. We want to make sure we have a strong password
on the network itself, maybe even make it not discoverable. Although sometimes that runs into
problems with the individual devices. But make sure that the network as well is secure. Now,
I said change these passwords. I'm going to say, remember this rule about passwords? Length
is strength. Small passwords are almost always worse than longer passwords. So try to make
your password as long as the system will make it. And since you can't remember it because you don't
want to set them all to the same thing, store them in a password vault. So that way you can put all
of these passwords into the vault, and then you unlock the vault with one password that you know,
and better yet, use multi-factor authentication. That is something you are and something you have
as well. So maybe a biometric in order to open the safe and then this part will be much more secure.
Okay. What's next? The network itself. I talked about some of the things you can do to secure
the network, but how about the configuration, the overall architecture of your home network?
So this is what it normally looks like. You've got a bunch of users here and they're inside
your home. They're using their laptops and stuff like that, their devices, in order to
ultimately probably access the Internet, get out to the rest of the world. And so here's our home
router again. But what I'm going to suggest to you is to carve out a special network segment for IoT.
This a lot of these routers support what's known as a guest network or a DMZ area. However,
the terminology is on that particular system. What you want to do is carve out this separate network
and put all of your IoT devices in that network. The idea being that if there's a vulnerability
that happens down here, it won't have direct access to all of these things, and it will still
be protected because it's behind the firewalling capabilities, in the network address, translation
and things like that that your router implements. So create the IoT special network and maybe you
let your guests in on that as well. But that that will give you a little better separation.
Okay. What else? Patching. All of these devices have tons of software in them. And what we want to
do is make sure that the software or the firmware, whichever the terminology is on it, that that
stuff is absolutely up to date, as up to date as it can possibly be. And the best way to do that
is to set it up to automatic update rather than do this manually. If you're doing it manually,
chances are you're not going to remember to do it frequently enough and you're going to fall behind.
And why does that matter? Because the security vulnerabilities will exist in your software for
a longer period of time. Whenever new versions of software and firmware come out. Almost always
there are security patches in there, and you want to get those as quickly as you can. Again,
reducing your attack surface. What else? Well, another idea in security is the principle of least
privilege. The principle of least privilege says, I want to turn off everything that I
possibly can and harden my systems. That's one aspect of principle of least privilege. I want
to effectively disable any unnecessary functions. Again, this is hardening. I also want to make sure
that only the right resources have access and are turned on. So to give an example of this, let's
say we've got a refrigerator here and it's an IoT refrigerator, so it does all the great bells and
whistles. Here is a user and the question is, does that user really need remote access into
the fridge? I don't know, if you think they do. Then go ahead and grant that. But understand that
you've also created some risk. You've created more attack surface. If you're not getting enough value
out of the features that you're getting from doing that, I would say turn that off. Another example
is, is this fridge connected to the cloud so that you can create your shopping list and access them
elsewhere? There might be some features that you really want to use. Just understand, with
every single one of these connections, you need to make a conscious decision about risk. And if
that risk is in fact worth it. In many cases, what we may also be doing by connecting these things is
creating a greater risk for us in terms of privacy as well. So some of these are backdoors that an
attacker could come into and take control of the device. And once they do, they could violate our
privacy. They can make the device stop working. They could do all sorts of other they could use
your refrigerator in order to attack other people, believe it or not, even without your knowledge.
And so finally, maybe the best thing that you can do, if you don't need it, turn it off. I mean,
literally not just disable the feature, but if your security camera is in your home, then
when you're in the home, you probably don't need it to be on. Probably this is a better setting.
Literally turn the camera off, maybe even unplug it if you're extra security conscious/paranoid. So
that way it cannot be spying on you. It can't be being used by a bad guy to do bad stuff. So what
I'm saying is be very conscious and intentional about the features that you have and the way
you've laid things out so that the stuff that is on is actually serving your needs. And it's not
just on because it was on by default. And that's the way the manufacturer shipped the device.
Okay. Now we've talked about what you need to do to secure the IoT devices in your home. How about
in the office? Some people will bring home devices into the office. Also, we have people working from
home in a home office. So it's effectively like all of those IoT devices are part of the corporate
network as well. What can we do in those cases to secure the office? Well, it begins with policy.
I need to have some sort of description that says this is what's allowed. This is not what's
allowed. These are the kinds of things that we are going to implement and enforce from a
security standpoint. And by the way, just saying, "don't ever bring these devices in," that's a fine
statement to make. It doesn't mean it's actually going to happen because a lot of times people
will do what they're going to do anyway. So the policy needs to be useful in this case,
not just something that you write on paper. The next thing would be to train our users,
help them understand what they're doing, that help security and the things that they do that hurt
security. Help them understand what are the risks in an IoT device, because to them it just looks
like something, "Hey, it looks harmless. I plug it in and it works." But they don't realize that it
may be exfiltrating data out of their network that it might be implanting a virus in their device,
that it could be used for spying. It could be used for all kinds of things. So make sure
people understand-- they're going to be more likely to follow a policy that they understand
than a policy that just sounds like a bunch of edicts that are passed down from on high.
Next thing, enable-- enable the security. I talked about all of these kinds of controls that we
can put in place in order to make a system more secure, an IoT system less risky for us. That's
what we want to do. We want to enable all those things, even in the office environment. And again,
start from the home and then expand out from there. And then we want to discover.
Again, you could say, I'm not going to allow this, but that doesn't mean it doesn't exist. I
need an ability to discover all of these things and find out when someone has brought an IoT
device into our network, when something in a home network has connected in that we didn't
expect it to do. The good news is there are tools and there are services that will
do this kind of automatic discovery for you. That way you can be alerted when you have now
created a case that your attack surface has just increased. And then finally, we need to enforce--
enforce the policy that we just came up with. Put into practice the training that we've given.
Also put into practice the security controls, have those implemented, have them happen automatically
as much as possible, automatically discover new devices, and then ultimately have a way to enforce
all of that and do it seamlessly. This is what we're about. What we're trying to do is decrease
the attack surface from a big attack surface to a much smaller one, and IoT is pulling us in the
opposite direction. If we don't get control of it. And if we don't get control, our devices aren't
serving us, they're serving someone else. So you want to make sure your devices serve you. Keep
your stuff safe and secure! Thanks for watching. If you found this video interesting and would like
to learn more about cybersecurity, please remember to hit like and subscribe to this channel.